{ "Event": { "published": true, "date": "2023-05-21", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-05-21", "timestamp": 1684713782, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "b87175ad-6511-4119-8894-80895db0a455", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db013576-f808-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684695243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695243, "uuid": "b1d50b65-725c-4560-b4f8-3b6cdd3584de", "comment": "Malware payload (RedLineStealer)", "value": "420107414b69b5739e12c4f3e7cde99d", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695243, "uuid": "0a445990-3763-479e-9d28-44bc3362389f", "comment": "Malware payload (RedLineStealer)", "value": "00631b404f0b364f339ba4df6a8de63e73b2add08ffdc6f1463eca9ab0eeb584", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695243, "uuid": "9621219d-409f-4a46-8746-6885dabafd2a", "comment": "Malware payload (RedLineStealer)", "value": "09c0ff7ad6407d803f6e562e62f864e88361abb7", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695243, "uuid": "c5d80205-3fb4-4194-9f93-1356610b7d5b", "comment": "Malware payload (RedLineStealer)", "value": "358ea0d786f4f47ae7a2f1fd33cc427f7bdfb0d064eeb447541a78231a4be8cdcab9d2516b04a3e53a7eaaa81f744b9b", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695243, "uuid": "5ba21bcc-eb0c-4e32-ae33-7067e34850e0", "value": "T1E3252307EBCC84A3CE396B7054F64AC70F35BC6189B5926B2355AE4B4C73994B832367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695243, "uuid": "daafa321-5596-49a7-b6f5-793d2a006151", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695243, "uuid": "89394c6c-83ed-4345-975e-9e911576a9ef", "value": "24576:Vy/VYHxmGqxy2jr9LWxg3ghZ/2Tv/I2V7t:w/qHxmGqxlX9amQhZ/2TbV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684695243, "uuid": "3e8b9f6d-aa3a-4499-8f34-5be4e88ed5fa", "value": 1046016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684695243, "uuid": "e5effc26-7298-4d3d-89ac-855582773380", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695243, "uuid": "7af3efa7-6fbe-487b-8930-53baa27babe5", "value": "7463534568.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "865e59bd-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684680498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680498, "uuid": "54010cb6-ca56-4178-8cbb-f23dad69dbf1", "comment": "Malware payload (RedLineStealer)", "value": "551cc61ad43c3b603508825b782ab7dc", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680498, "uuid": "2ea10a26-7142-4d6f-8d66-144159b974ae", "comment": "Malware payload (RedLineStealer)", "value": "007e74180eb6910210f4f2080217c507aaac153687812d252177a24e0ad83b2b", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680498, "uuid": "724c4a8e-be26-4c62-8516-ba809c2e0eda", "comment": "Malware payload (RedLineStealer)", "value": "2be7dfa95dac7fcf1a14317ad2debd877f94ed85", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680498, "uuid": "81dd507e-eb7b-4a3c-b1f3-56d1d326fd76", "comment": "Malware payload (RedLineStealer)", "value": "5707f8b94a3705c0bd376a77941b8102160fb1e523bf8ccaeadc451d1ee986d4f6053a78831bf0f06c00197738b511af", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680498, "uuid": "51f83655-581b-4429-8f10-5da27f082539", "value": "T12D25234368E44463ECF5233099F646971777BEA09C30432F3B95E86A0C72AD1B876B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680498, "uuid": "e51f9f96-310d-42e6-acde-7f55b61dcdef", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680498, "uuid": "0cc06cf2-cd27-47fb-bb2d-5cf7af3a2d73", "value": "24576:XyfztU61Y8qe7J5i+8MJUK9dF13Js5OhCq:ipr1Y8qg5pJTjF13mOhC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680498, "uuid": "e81f529c-3bdb-4f2f-b050-c42a04b01095", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680498, "uuid": "b5221e3a-d68a-44f4-8c10-12c2f4533f90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680498, "uuid": "8a6db0be-447d-42b8-bcbd-b1ee8d25a160", "value": "Setup760.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d422ed26-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684680629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680629, "uuid": "36fdc5a5-739f-466e-8018-620272d06d8d", "comment": "Malware payload (RedLineStealer)", "value": "d3d5706410a9418fdfb11edeee2e05fd", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680629, "uuid": "73078300-e8c7-45c0-8b00-8b53d786b97f", "comment": "Malware payload (RedLineStealer)", "value": "00b8c1e6df49daba644e4024eaa6e28f14a1be364ae5cecd2f34fc5a333c46fa", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680629, "uuid": "5bf2f8c9-783c-4fe7-a329-6955f8ba9572", "comment": "Malware payload (RedLineStealer)", "value": "38bb9c1fad13c2dda86be6d791d9bc71bef403aa", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680629, "uuid": "c98ac8bf-1d8d-4695-bd01-c446ba37fae6", "comment": "Malware payload (RedLineStealer)", "value": "dcfc4e0e8359bca3318c51d6b132912a8e4dafc1efde5d2cace5c44cdd3edaf2aadf38800c48058c95b39a4d3e2cd8db", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680629, "uuid": "af7be10b-1df8-4710-9ca4-4dfc629bcf0a", "value": "T1AA252353EAD98476D8F917701CF357D327343CA18D78A24A23866AAF1C73780683672E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680629, "uuid": "8186f5dd-3d72-4e94-a4dd-3e41f4453af8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680629, "uuid": "bc748a2b-8712-41f8-9266-eb49770e1169", "value": "24576:ty7gDpG4CnSdiTCYgN98+11FbLilE7RD8ff++mptmo0:I7r4C5CRv3rKlEFAC6o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680629, "uuid": "bcee56a5-3466-4179-b697-c9e1c7e26f32", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680629, "uuid": "534cc415-f7fc-46eb-a747-282ecc152308", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680629, "uuid": "7d1923a9-69ba-4ec2-af4d-b37112406f40", "value": "pdf-reader-plus741.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43096eca-f777-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684632711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684632711, "uuid": "df10f8f8-c002-425a-bc76-248db6ecb882", "comment": "Malware payload (RedLineStealer)", "value": "f872c7aaf5533019f3fa73990fb2a4d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684632711, "uuid": "fea86d20-61cb-4e4d-a2a1-1130a904a5d3", "comment": "Malware payload (RedLineStealer)", "value": "00c171bd3f449200aff71e2dbad14816652369a6dcaac0674579befb427ce245", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684632711, "uuid": "172c7361-0da6-4e3d-aadf-2e9d095782ff", "comment": "Malware payload (RedLineStealer)", "value": "25eed53fa42ebae576c34e66ae53569d86fea845", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684632711, "uuid": "a5854d95-6b26-4bdd-a049-257a39e8cfb3", "comment": "Malware payload (RedLineStealer)", "value": "9358cb27da8c607a42a92829fa13f64b67de01eb7ed14accd8880ee1d94b3c83cdf9ab2205ff62c90c5e59ba229ccc7e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684632711, "uuid": "2489c886-6864-4e4e-bec0-99c69e79eeae", "value": "T1A3749E11704681BFF8EE057898B896B81D7AF4790F5FC3E7AB8D01E90F945E6A530236", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684632711, "uuid": "d27e561c-9f74-4b17-9443-28ec6ae50cad", "value": "c51c419e64d37d41f3d25e7f43aa37da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684632711, "uuid": "653c27c1-c32d-4e7a-9767-8919f161d038", "value": "3072:rDdyoZRpov4qnzE5z/YMNyzKpoAOAQzjNZ1IIkYg830TAR/Lp7MW+iMdj0PUDgTX:rcoZRQw5z/NbmRX1I4bx7OiKj0PmIHkI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684632711, "uuid": "f88d29b7-8036-4d81-acfe-085797091de4", "value": 339216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684632711, "uuid": "2d1259ca-de30-4e21-9857-f0d9684a7b3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684632711, "uuid": "5fc1e9a4-91c2-4cb1-847d-4c6fb6d03e71", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1d4ba11-f7a8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684653942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684653942, "uuid": "3609130e-a962-428d-93d5-05a57b015f3b", "comment": "Malware payload (Amadey)", "value": "b35e1ce238fa982fe3a38aef5ad6a7be", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684653942, "uuid": "a21d6894-3f05-4c83-9b50-366fcbeb8eea", "comment": "Malware payload (Amadey)", "value": "00c49e2c3c76998c6003325f394fc5345f8a01e33bdb5279f0af55289ae8b412", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684653942, "uuid": "eb58ceec-927c-4566-95d2-a531d3a49ecf", "comment": "Malware payload (Amadey)", "value": "194519ecc7cd6dafd8d8ffd8ee6b5b2862cdb41f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684653942, "uuid": "1af78eb6-2254-4f04-b31b-1946f239220d", "comment": "Malware payload (Amadey)", "value": "1acb2591433d42832a1f8c73b653242e8e21e864e966f28f95c1fab7866511345a34630da856526f7c99fc82a2a9e779", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684653942, "uuid": "3922e75d-d675-47b3-89ac-353b28d39471", "value": "T11A25238367C89033E9756BB050F205530B3AFCA34E78576A53D9DC6A6CA2688F53073B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684653942, "uuid": "86f4e4f8-8edf-4963-aaa6-db6c1c5ac953", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684653942, "uuid": "9c620111-e802-4a61-8413-6cecd9f285cb", "value": "24576:cy4KHMVUsCx9BMR/RXvMp+Yp8vYs1JzXs7SfFA/:L4UMq59uHW+EeYsfDs7UFA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684653942, "uuid": "2d082182-a0a1-4238-96ae-9d1e57a8eaa3", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684653942, "uuid": "4f313756-27c3-4f7e-a59f-66d9e0415ca5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684653942, "uuid": "0e6c4f00-ef36-4cae-bde5-fa9202a7a38b", "value": "b35e1ce238fa982fe3a38aef5ad6a7be.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdcc29ac-f774-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1684631736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684631736, "uuid": "f78ee4e4-84c8-4e08-9f21-af466f3f434a", "comment": "Malware payload (RaccoonStealer)", "value": "49d136bcdd0d36f2da5fd707802b020b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684631736, "uuid": "341b9bec-9548-458a-a95b-4800e08665ae", "comment": "Malware payload (RaccoonStealer)", "value": "00f2fc459155b507239a00effaccc233a5037b7edc1fcf3f273bf6e9cbf4f235", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684631736, "uuid": "f88d361a-deb1-4aa8-9f40-97ef6434e6d2", "comment": "Malware payload (RaccoonStealer)", "value": "6ccc24ae7519a4434e94eb42c0e5b0b020e125b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684631736, "uuid": "c6be4307-6dd5-4479-b1f3-34a8582927d9", "comment": "Malware payload (RaccoonStealer)", "value": "9995e31c4fdce60f59a6286d4e0705a8c4fbc4c6b658d216fb2c431d091bd0042d9dad1b90189e0b7a54ebe1aa10eb21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684631736, "uuid": "797d4ecc-21a0-4f60-8a73-20c6e6a1e827", "value": "T1F2E43A174458349FE016B874ACB5C6A2E1BCBDF706557EC6C7CF301A8B3A0E60B961E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684631736, "uuid": "0131e841-0fff-42d2-9acf-20ebfc86344c", "value": "aa13816afc0cf283e1c2ef6f42b98abe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684631736, "uuid": "3c692fcc-424c-4031-933c-662a2b1ec39b", "value": "12288:XpRpiYdTQwDQxT2qxqtL2f1ehKSYMJaqGsW+6t/oGMcwkF:Xo6U328q12daKEvGsW+c/JB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684631736, "uuid": "d0bf2e08-27a0-4bcb-950f-fb335f21eb0a", "value": 677144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684631736, "uuid": "b2e0d3ed-353a-4bc6-a873-13306c910e83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684631736, "uuid": "94cb4d3a-0903-4e2c-a2aa-8288306f3dd6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96c3b561-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684680526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680526, "uuid": "a2c5112a-fdca-4a8b-b88d-eed0028c8d21", "comment": "Malware payload (RedLineStealer)", "value": "94d9699b1f025e3e508bf0937ff18791", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680526, "uuid": "dd610d5e-3047-4f58-ad86-8416d5159328", "comment": "Malware payload (RedLineStealer)", "value": "012da8075e9732f54943a85917d4f905ee72566ca46648c8a530b50609254d54", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680526, "uuid": "f2f358c2-aecd-4a3b-a5ef-766097d1efd7", "comment": "Malware payload (RedLineStealer)", "value": "b8265f608481805f7d02b936b9ed7eac9ac87c7f", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680526, "uuid": "22508af4-b172-4a90-a013-f159062ec069", "comment": "Malware payload (RedLineStealer)", "value": "5abefe436ef5053ebd33788d3a2e518273b17c534b0fb4704a0f106e0676bcd55805fd25fdbe48e522ed0e2abf6b5cc9", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680526, "uuid": "71a57bd7-b031-432d-9fba-96dc2dedfa58", "value": "T17C252216EAE445B3DD7453B86CF702C30E3ABE604974C36F2B09954E5DB39442AB2B72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680526, "uuid": "11f87b2e-10b5-4ea4-81bf-21478b60682b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680526, "uuid": "311986d1-23da-4e73-880e-8bdab5eeecf3", "value": "24576:DycDsO5YatxmN1sq31FYXvgmVNzQsbPxGCH4i0:Wcr5YatxesqFFYYmPQsFG6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680526, "uuid": "8abcb292-db67-4094-9371-6a5cec198293", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680526, "uuid": "c4ed7a2c-3544-4d46-afd1-64458ca107e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680526, "uuid": "bf67f8d2-d688-48ea-9ae3-77c7090875fa", "value": "changer877.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a760115-f7b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684658493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658493, "uuid": "cab8f2e6-35db-465c-9679-23c02c9ee563", "comment": "Malware payload (Amadey)", "value": "a9f7e39e7a5b82a55fed38c2c635b594", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658493, "uuid": "02a28a78-fb6d-4858-9e1d-1e5a89e6264b", "comment": "Malware payload (Amadey)", "value": "01804bd3708b08d0c74fbb4b22479dee3f41711b3031f87a0dbf6fb8b6915aa7", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658493, "uuid": "2541d3f1-a848-44f3-85cc-c96c27c4be29", "comment": "Malware payload (Amadey)", "value": "f8b918dc22c1c02449bfa53ca471da2988d9509b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658493, "uuid": "aac1b4c3-b871-4001-ba90-3f2216482948", "comment": "Malware payload (Amadey)", "value": "8d1a52619f67ffb1f3d74a1808d8937e1601c3fc8f7ef3d0c0bf0ae5b401f69b3dfd444e7039a7767de12ff12da69f8b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658493, "uuid": "f004143d-812c-4395-b757-b423373acedb", "value": "T13F252307E7D4E067E8B2373098FB03A70E727C625D75971B2382695F48B26E0A17572B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658493, "uuid": "789e0c7d-f5e7-4b70-9a01-ec4dfb8f4c80", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658493, "uuid": "092ef673-3d86-49f7-ace5-3fa0e0f6f478", "value": "24576:4ygvnZMCkCATNela5XdgPqOBzKhjEpHMGbvetT2KoJ:/gvZMVpek5tgPTpH1qtTjo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684658493, "uuid": "3499b1d1-4a61-4ff1-9e23-9dd2bbedefcc", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684658493, "uuid": "c0c604e6-a04d-4ade-b96d-b7862777d21f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658493, "uuid": "767ffb27-7b9c-4c02-8881-a246d492ffae", "value": "translator754.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02995405-f7d1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684671258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671258, "uuid": "d72fdd55-5775-4889-a4dd-b6d9b80f39cd", "comment": "Malware payload (Amadey)", "value": "2e44fddb15e00aeed16ac600bca77e08", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671258, "uuid": "87a3d888-cfe3-4461-94ed-067f0f934c66", "comment": "Malware payload (Amadey)", "value": "0180f5c48568efcf80d06f545bd69f39efb5303fe9c8a168226248d65fde8812", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671258, "uuid": "c184af99-aac0-4a89-b30d-eb5d0d0ed923", "comment": "Malware payload (Amadey)", "value": "0c8cda0514b5830edac33e05df8697f9ce38b4d9", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671258, "uuid": "bccb5220-700e-4e0d-b9a1-678394f11aef", "comment": "Malware payload (Amadey)", "value": "1c43259979f4e97c1cd9d6c8fa5349c9ea9f3080870ce7678e5cf78eeebbef8abbdd035a9cdfcf0da0b54056533783e8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671258, "uuid": "f3076186-8638-429e-99f2-2fe0f89ef178", "value": "T1FA252317A2ED4932D8B91F3158F316530A70FDB51CA887273B8BB95A69330C19531BBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671258, "uuid": "0524bf87-2776-4939-b2c0-dbbcbaaf09b4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671258, "uuid": "e4d98177-1142-444f-a901-9dbf24b83b36", "value": "24576:Oy2fwwv8yp7qqCnePNDZbOYdT3ej/KcrAJ5C:d2fw48yp7qqCeP1ZqYdSecrO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684671258, "uuid": "1e5ac8c0-36ca-4924-9a88-dfaedb0c306f", "value": 1056256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684671258, "uuid": "e7867248-7703-46f6-bf31-5f8813934d02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671258, "uuid": "b72a7c3f-8762-42ca-b359-402408e6e7f2", "value": "resolver502.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dde4796-f771-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684630045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684630045, "uuid": "7e8ef891-bd59-40c3-b165-488064833945", "comment": "Malware payload (RedLineStealer)", "value": "5b622c9117b820c2eac89b4f7b7423d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684630045, "uuid": "19f5a9c4-f4f6-4d89-bea2-6c06bbc9bcd6", "comment": "Malware payload (RedLineStealer)", "value": "01a9dceaa04306153430a76243cd3d9993acbcdc354127a5a151f03f2bc74c17", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684630045, "uuid": "b39b826a-8295-4fe0-a1e3-191586cf37bd", "comment": "Malware payload (RedLineStealer)", "value": "d1f6b59c6898b7e056193ec7ec6aace8783c0058", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684630045, "uuid": "f158b1b4-b14c-4b6d-b5e8-9119ce76e8fb", "comment": "Malware payload (RedLineStealer)", "value": "b1d2ddc590cce69d269234041dc942c3e15c7a4907ae08a0861e8c24a47e9ceac8664301aa47f3065d653c6f8137ee76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684630045, "uuid": "79eaa39a-18e9-4295-82ec-5261828be91a", "value": "T1A1252356FEF54472C9B36B7019F347930B32BC65AD7483AA2641FD2A48F1268D4323A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684630045, "uuid": "a390fc3f-452e-44df-9f1e-631c8154987f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684630045, "uuid": "88a0e556-3636-4b42-9e02-b7983a39e203", "value": "12288:sMrxy90IvFV79JRWBI65nCeY7uc6od2Pn27FWt5FH+1mLWnLIYLLx/dcL6knHGcG:ty/vlJYBbE7dskLIYv3u6iZqktKjyq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684630045, "uuid": "9d30027c-8157-4d90-9782-57a6d54fc51c", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684630045, "uuid": "d597da74-8cd4-4796-97b5-3910dca737d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684630045, "uuid": "586b7243-c1f0-4065-986c-4c7366821738", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5c6c0f8-f7c8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1684667773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667773, "uuid": "e8b2a4d5-03aa-4c1f-a5fe-4c2a0ceb7510", "comment": "Malware payload (Stop)", "value": "b7763d3dd52223e19f34add6dacb955b", "object_relation": "md5", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667773, "uuid": "37dfd6d8-ccba-4921-ab40-f2dd6191316d", "comment": "Malware payload (Stop)", "value": "02a877e82d53354ae9ac4ce96982574103fc93ac2bee9bf3d650631f49ded10f", "object_relation": "sha256", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667773, "uuid": "e0ca954f-a718-44ef-b1de-c69a222689a6", "comment": "Malware payload (Stop)", "value": "81a4e88b04bfbd4c18e4670fb8bd4674a237d319", "object_relation": "sha1", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667773, "uuid": "4577239f-870c-4d71-a6a5-29571b56b69c", "comment": "Malware payload (Stop)", "value": "074fd1edff75836bbd28223cdded1e6b3b4e9e524c16872e639e92154934f726568a4113998884711ce73896a096c56a", "object_relation": "sha3-384", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667773, "uuid": "3c1d81b7-3d69-4978-8f00-b4f01b91b14e", "value": "T1CA05E0039291BF62E5254F718E1DC2F8A6EEB9615F4C27E7721A6E1F44712B2C673301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667773, "uuid": "d1f59c67-5806-4543-9129-06fe91c0a3cc", "value": "c3945e210b1009128598ead2a7524d0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667773, "uuid": "9ee63370-d6e4-4ec0-a5f9-0ee7b01f407f", "value": "12288:/d3SvAUIryv2xJdOuqHiOK8nxKsR5OXEQKQdri/46PhIGSvtaRQ4UFn:l3cIa2PgusWW4pXEQldkPhIVaS4Uh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667773, "uuid": "fafefcbe-4917-4afa-a73a-997d1c50e795", "value": 841216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667773, "uuid": "0068fead-ba3d-49a1-85e7-d5c7665029f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667773, "uuid": "6e853423-b613-4ade-9a1a-a3f0e4e7c844", "value": "compress788.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04cfa643-f7c8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684667396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667396, "uuid": "15245b0a-2e78-4710-a5e2-be7fb26bcca4", "comment": "Malware payload (RedLineStealer)", "value": "043c03adbef51f28b3de71f64ec552fc", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667396, "uuid": "dba3300c-cb59-44bb-9866-906c93632b10", "comment": "Malware payload (RedLineStealer)", "value": "02b25d110c26b87e23b64d4920b884cb187ef3c14b52875fb694fdd83f25280c", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667396, "uuid": "3acc19af-49a8-4eab-aa32-92cc1a5a9b28", "comment": "Malware payload (RedLineStealer)", "value": "904534e1820f1615455e9c82ad9648f941d8be30", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667396, "uuid": "07b7e11f-42c5-45b9-ae02-ae58f15ff54f", "comment": "Malware payload (RedLineStealer)", "value": "7fddf0580c24106dc8511752b3297ebd16b93b8112b95f8f9f0fe50cf86f3774599493a69eccf02cff145ceceafa98bd", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667396, "uuid": "231f0867-fe42-43a1-be01-2dc0383a1052", "value": "T12F252353A3D89472CD701B755CF906432B32BCA0CEB652AB3796F90A1E73A44A631737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667396, "uuid": "64f0fe56-4cba-4fab-966a-38fb28481d84", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667396, "uuid": "17155d58-5a71-4581-aeca-0f2865e78711", "value": "24576:GyScGzNtHOMcqKUqlDgmHsd/KoyRM1CX1t3Tzxc:VScGhpO5q/qxgmBo2M+11Tzx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667396, "uuid": "5e8aee49-b62a-4bf6-bda9-2b5427b8c384", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667396, "uuid": "694a77f8-d9aa-4658-b72e-db892dee7981", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667396, "uuid": "a258fe9f-685f-434b-a593-da70bf0f5eff", "value": "report703.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efd1f018-f808-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684695278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695278, "uuid": "632b68ee-8ebe-404f-8ca6-a518044b57da", "comment": "Malware payload (RedLineStealer)", "value": "831bc079485a92ce4e20ba53861056e8", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695278, "uuid": "23ec43d9-590f-4fbf-a700-37ba01d2e3d3", "comment": "Malware payload (RedLineStealer)", "value": "02e9a6f4290848503ad7eca4e820a2568a8f9d845975c2cdc43b2541018d3f06", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695278, "uuid": "add17722-776b-40e9-8a21-2a2762ba3f7d", "comment": "Malware payload (RedLineStealer)", "value": "40e36d57d778c35eebd33b8bc259ec6f10ad9125", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695278, "uuid": "be71608e-1ed6-4898-9a87-3eefa1e4d377", "comment": "Malware payload (RedLineStealer)", "value": "7ce2eba727179cedec3bf3b60526c079ef63f12fe98c80cfab88e49d2b094019ef33c40bc078f5c810c067a37206be75", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695278, "uuid": "c7fde5a1-c0ee-4f07-aafd-159f22c3869b", "value": "T1EE25237AAAF84033EAD517B418F9421307767DB46BB9C35B33526D4B9CB2944E83132B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695278, "uuid": "ca90b610-7e3c-417d-bcf3-b00e09e00282", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695278, "uuid": "f5db7b42-f3a9-477b-8311-a8f42cd73143", "value": "12288:MMrdy90ATV5XLJS88AezZBhymxlQ17zhn/EXttTROjZyGA7EGfpHu1xL9PxnU:Byj55XLJJ8Z1B4R1UTRKyG5GKJPNU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684695278, "uuid": "6cb2a4f2-5d68-456b-8c94-c5b3bf4e4cd0", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684695278, "uuid": "d13f0589-b3ff-4aec-9357-71703550a190", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695278, "uuid": "bbd1f38b-7004-4ed9-be94-446fd5ada1b9", "value": "client473.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "683a2f29-f7f4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684686461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686461, "uuid": "4cb0a58e-d595-488b-a859-b97f0d7f7071", "comment": "Malware payload (Mirai)", "value": "2eeda6cda6062147c14c536321b7a85a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686461, "uuid": "75a5e0e0-915c-4cc6-b46a-839bbad44074", "comment": "Malware payload (Mirai)", "value": "0300451a132cdbdfcd4d79e513db470fe00c8b08f3b1fb5f5904ef4661e0f1dc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686461, "uuid": "b28f0f34-b7ad-46c5-957b-82cc8014abe3", "comment": "Malware payload (Mirai)", "value": "7bcee734115f5a6bdd0553212bf65fa366a13a47", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686461, "uuid": "ce8b4a84-e90a-4c18-86fa-b66a28593dac", "comment": "Malware payload (Mirai)", "value": "296ce5f40bad2c52c6172781965c542b68841173b98318fa6239a97e25861245d3e6a5e7877e81a61deedea366ab32a8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684686461, "uuid": "3d9ce7d3-5d62-4d48-9997-c41b20753e8f", "value": "T100F2F851B8814A27C6E023BAB6AE5A8D377073ECD2CFB617D8614B20B78151F0D63F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684686461, "uuid": "e1bd9acd-6352-4871-a5ab-3d84303cd9a4", "value": "768:zdWm4W5bQYG5zMHNSoSU1tTbHOdw7xh9aa0P9TOO4o+mwx:zd/bjG5zAPSUL3HR8cOex", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684686461, "uuid": "d500822f-746c-40c0-8c24-918fab9fc6d3", "value": 35124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684686461, "uuid": "61de7299-c14a-45fb-a722-bac391a7cf77", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684686461, "uuid": "9a938fc3-90f6-48e8-b9d6-4b5b6aac4daf", "value": "2eeda6cda6062147c14c536321b7a85a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddf484c7-f7c7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684667331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667331, "uuid": "a89ab099-ee78-4198-b998-10f585d351cc", "comment": "Malware payload (Amadey)", "value": "be4cc2c2e45e6dcc88df5d890d8a9604", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667331, "uuid": "e1b067d4-9a95-4156-88e1-be1eec20e0db", "comment": "Malware payload (Amadey)", "value": "0389339958f2bccd1ad1af24d3efbc0952be1a18f56f5fabc1c4b7b8d905d3a7", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667331, "uuid": "c68bda0f-b775-4546-b889-e765d044648b", "comment": "Malware payload (Amadey)", "value": "d1b564e7ec85858cafb9375c88931550157996f4", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667331, "uuid": "ad633880-4d5c-418d-b6ae-a0346d9d6829", "comment": "Malware payload (Amadey)", "value": "81ed9eae886f2556b6c5a5f3244a79d57abae6c3b8921ae2fdf795ee17b2dfd6c6373bb433d78eb8cb3595a7017b3ba3", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667331, "uuid": "38f68bfb-f501-44c5-a0af-3065cf7ea587", "value": "T1F1252307EBCD9472C9B53779A8F342830B36BCD0CDB8826A26505D2B1D726D1B67235B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667331, "uuid": "36116df7-bc5f-447c-8f1d-4a848c412b3a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667331, "uuid": "0c1a9154-8ad8-4f9a-b470-8499b7ba3057", "value": "24576:ZydjydXsuCtsaqTpd7p+nno8vlyisEBApTSa5y:M5nuC2aqrpQHyjEBApT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667331, "uuid": "6decdbbc-709c-4aa7-a6e9-56223ef889d8", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667331, "uuid": "f7dab937-9c9f-43d2-b8cb-126f92b5d6c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667331, "uuid": "23dbd996-5845-4499-9a01-2879cff0740f", "value": "generator785.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af93c2d3-f7a8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684653939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684653939, "uuid": "b065fe43-f55b-4eed-a7d1-bf655cc7598b", "comment": "Malware payload (Amadey)", "value": "47d8711deb810af81e380737f0466c35", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684653939, "uuid": "4ff579f0-1cf0-4544-9699-08399de725b7", "comment": "Malware payload (Amadey)", "value": "039eb1db71f1883bdc9ccd0ad033bbffc3a72ed85b3975f960e12702b926a35d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684653939, "uuid": "67227651-7073-48a5-8fad-2540a42d4f4e", "comment": "Malware payload (Amadey)", "value": "32f12e6b56e7101abee09f0dd0a61480307317af", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684653939, "uuid": "d222008f-dbed-47f7-9903-1c5e5e32f049", "comment": "Malware payload (Amadey)", "value": "7ee83585d7375b9532d66e4e27c4191f87197456fbef8e0ab036a093e9e2c8778435d78f9b4d5a045799857349569f98", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684653939, "uuid": "a874b72e-6544-4220-a8ee-3b3b511b7bc3", "value": "T186252246AADC5063D47927B084F303C30B36BDE0AE28E65F3745A99A1CB66D19C3177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684653939, "uuid": "7e7b139a-718f-4775-8841-2c57a0575f70", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684653939, "uuid": "ef4fc4db-e456-4af9-a401-cdbbb1731303", "value": "24576:Uyviy3AOqXE7ZX5ioT+FLgQiSrCaiW5EmmDtFU2hbVH:jay9qUdlT4Z7mDnUi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684653939, "uuid": "be450e34-c4d1-4ed5-ad8a-4510eead84b1", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684653939, "uuid": "2dad4311-f9c5-453e-944d-c6ea9dc0e7a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684653939, "uuid": "a77a344b-3383-4216-89a1-cbba5e92b2c6", "value": "47d8711deb810af81e380737f0466c35.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8b32ec0-f7eb-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684682811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684682811, "uuid": "bf4dd03c-bdb9-455a-8c51-5e0db615b7b0", "comment": "Malware payload", "value": "a564dc0bf655fe5b4deaddc2ceead70b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684682811, "uuid": "e5a7ee8a-35e4-4b90-9648-c339de672760", "comment": "Malware payload", "value": "03b2d29edea5b4a9fd900091e96999467d93a5794d9e172fc9c682c25d2859f5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684682811, "uuid": "c805192c-97d9-4ab0-84a2-a03c0767eb57", "comment": "Malware payload", "value": "f9e7a8c7991c0b7c6a93fd524f18fb14f813e2de", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684682811, "uuid": "2515774f-ab58-4b07-8444-daac2f2ed55f", "comment": "Malware payload", "value": "308bacf2dd191893d95f4b9119fee5ebfdd06c403d9105639912d6f5a6efe78860f4b22443ed847146efca8267303726", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684682811, "uuid": "8748bafb-63d0-4a75-b712-fde2c7411a16", "value": "T1C1E33905D7408B57C1E2277AEBDB424933339B54A3D733099A38ABF43FC27995E26116", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684682811, "uuid": "73961722-1717-4b87-b49f-5043f5b6bf08", "value": "3072:ut8iFDKEfFN+Fa+1sW9h7a8oXV7pUMbmQwfCMQiGW:s8iFDLf/+FaNQh7a8oXV7p5mQwfCDiGW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684682811, "uuid": "bfbc16fb-d407-4a7b-ac3e-340bcbef9f4a", "value": 150049, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684682811, "uuid": "cbb50098-6437-486b-b302-26a815754806", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684682811, "uuid": "9708169c-5bae-4272-81e3-681176ad62c0", "value": "a564dc0bf655fe5b4deaddc2ceead70b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8da7d265-f7c7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684667196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667196, "uuid": "de52cf43-7bdc-446f-a004-f6c67db9f049", "comment": "Malware payload (RedLineStealer)", "value": "ee01173c49ed89c12f3b3ac578bea669", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667196, "uuid": "6a351dd0-14dd-46d2-a4c2-f3ad798a4c83", "comment": "Malware payload (RedLineStealer)", "value": "04478ae26d8280dd87f0b01a23aef291e16cca9abd4d057bba4adaa28170eb7d", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667196, "uuid": "67090238-3e2a-4cc6-b57b-663843c34603", "comment": "Malware payload (RedLineStealer)", "value": "a03565ef4e399ecdfd76dd6d03efc7c8ecd4dc00", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667196, "uuid": "ca8122c0-28eb-42c9-a70d-e23ae6ef4039", "comment": "Malware payload (RedLineStealer)", "value": "82926062973b83abdae2a622e3ff1b7bf77fc651ef04f9e76ff66d4e5981a4a3ff79b0d6909f50c8ab49eca60ffb32ee", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667196, "uuid": "5f36d391-806f-4eca-be98-c0ebc90fcab0", "value": "T1CA25228B6BC48073E8712B7048FB02D31B357D915E76913B7A49B85E5D32688B8353BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667196, "uuid": "d1d9710a-cbd2-4c04-988d-5db5e0db0445", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667196, "uuid": "b904331d-32bd-4820-a46d-647b8e35ac9c", "value": "24576:Hyjym/xwL3bqyqtpTZspDrgSK6l+1xt3jnLyzK3GDfMxu:SMLzqTZsp/gQezb38fMx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667196, "uuid": "e6c54aa9-2441-4411-bc3e-672b9de08229", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667196, "uuid": "c520e862-c8da-4332-a15c-50405e1330ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667196, "uuid": "182d8ac9-3f66-4fd2-aff2-406128902579", "value": "234433512153.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc118422-f7d0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684671247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671247, "uuid": "01370892-8a57-4b11-9a42-149c974dc2ac", "comment": "Malware payload (RedLineStealer)", "value": "fad51141a8c53867b88f60101c1a584e", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671247, "uuid": "4b3ea32c-3a71-4a2f-abd6-b283d61e155a", "comment": "Malware payload (RedLineStealer)", "value": "0466273435628dfdc5e6d9087ee4f54a5e0e17295ffaa422a04c6bda39698463", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671247, "uuid": "2e0cd114-8b0c-4901-9b1a-0a9d755f471f", "comment": "Malware payload (RedLineStealer)", "value": "2ed68104fd8a6946e54e3a897354c85950597fd5", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671247, "uuid": "25f1899a-8e34-43d2-a919-4b27bda0d9f9", "comment": "Malware payload (RedLineStealer)", "value": "187cd5bb3047c4466ca25480f8a4a13e9b08482d8fe95cddf58bfa3d0da12410d048cc2e966c0c54a100a56e5a8b961f", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671247, "uuid": "0d27d8da-f8ef-483a-911a-f91ac4af2cc9", "value": "T1AD25221B77C59531D8F907B05DF383970672BDA6AEB8431B2702658F2DB22D0E276722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671247, "uuid": "656f98d8-0399-4655-8dde-666aa7db19ef", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671247, "uuid": "cfc6e7f3-8bdd-48d2-97ee-be0689af5925", "value": "24576:myBL7EQDaMv+9w7z7G2mEyFYfylohi/ePu/8e:1BPDROEZf7c2PU8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684671247, "uuid": "1e624b94-f539-4242-b388-1c1c3b64ba4b", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684671247, "uuid": "a2e9752d-84dc-471b-9213-cf6558832598", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671247, "uuid": "23a08947-d69d-4f8d-a799-7b6ced0b4d4d", "value": "pdf-readers952.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a2f06f2-f7a9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684654225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684654225, "uuid": "cd5267d2-1321-4f5b-8f91-b8be3df875a2", "comment": "Malware payload (Amadey)", "value": "3998473d93cf9a453a9110d19407a949", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684654225, "uuid": "a71e1989-0a41-4376-bc15-1e5ac01f56c9", "comment": "Malware payload (Amadey)", "value": "054ea77f89045e6d13ce544be3957d6371a06899fe097f14f3c2d65816923511", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684654225, "uuid": "762a06f3-5f3b-4821-a803-8fe3c4a68043", "comment": "Malware payload (Amadey)", "value": "709b791415ffd02f31bb2d79ee70bd32cb1a198d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684654225, "uuid": "cb9e1b6c-e78f-403d-aff1-1ef0b1d715c1", "comment": "Malware payload (Amadey)", "value": "dc906747fbcc3a421f1b91f70ef52e7897c800e687612fe746cd2ddad2ea05aaf03bc5d4d96245662f31f2615960051a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684654225, "uuid": "d2db6d94-8391-4d2c-9c7a-35520809c717", "value": "T1F825230AAADC90B6DCB4277008F702670B767DB14E7897662397992D1832BD4BC39737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684654225, "uuid": "8d47e370-7dec-4f28-ae97-d3e643fed472", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684654225, "uuid": "967f11a4-9044-40ae-93ec-dcae49095af1", "value": "24576:UyvsjPO6eqt7qE+UGbFGM89mMOvRTRAi9xAe:jv2PGqtG9bEM8GZRA8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684654225, "uuid": "60a4a271-694f-4bcf-9ba7-f49dbe26e898", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684654225, "uuid": "0f179e38-251d-4845-a675-dfa6656a76d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684654225, "uuid": "0ddb9753-2894-47a2-b319-69a675293cc8", "value": "3998473d93cf9a453a9110d19407a949.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13c211d7-f808-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684694909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694909, "uuid": "f9dac7f4-d937-4300-8326-d72be5c7e6cd", "comment": "Malware payload", "value": "39197cee6c710965e2499e3e4dbe00dd", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694909, "uuid": "07efc67f-b706-4e8d-a25c-9155ab3c7181", "comment": "Malware payload", "value": "057bac45b0f9d57d7027659e80d87f61ee6e9a47eb36fcbbce8e1ef9104836d5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694909, "uuid": "e3feb77c-1b39-43c4-bc39-9c1152e180aa", "comment": "Malware payload", "value": "9a7897a25e72948ed36e2b5e0a958868df4a04d2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694909, "uuid": "4906e101-2343-4aad-8213-739da61d25e9", "comment": "Malware payload", "value": "2339aa12a74c6555a3fd5862f808bba02a259d4563b473470c10804ac23fa16b88daa1441ecbed780ac5709713668813", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694909, "uuid": "9d3af7f8-4a9d-4766-bfde-9ef38ff43650", "value": "T1CC252326EBF48031E8B003B05DF102D32F367DA19DAC579E775A6D6A0A31294A97173F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694909, "uuid": "b1d6d5bf-2f72-4979-9178-ce80d2f635c0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694909, "uuid": "09676b92-5fdd-4f56-aea8-8ceb2e52c5d9", "value": "24576:ryFtiPTCNcjsptyfN1Fq2TO4Ewma8cHE:eFtgwXC1Fd8c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684694909, "uuid": "1c2a5669-9e9d-4144-b783-23d7b176761c", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684694909, "uuid": "8dc1667d-ea58-47dd-aee4-3114ec173ae0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694909, "uuid": "fa797ac3-f21f-4e8f-bb24-016f886f360d", "value": "multiplayer398.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78d1f7df-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684680475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680475, "uuid": "2f215c4d-5918-40c6-a5ee-1b4c3a45fa4b", "comment": "Malware payload (Amadey)", "value": "51d1d8e410df163061d5133abd723e6f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680475, "uuid": "6388dc70-021a-4278-8cdd-ac96e8dc4fc9", "comment": "Malware payload (Amadey)", "value": "05c1d8f06827b0760370818b07f10d923d14cb2b11053841e72c657ad5304c59", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680475, "uuid": "9543bebd-4e0e-4c40-92ae-13663b2265ea", "comment": "Malware payload (Amadey)", "value": "8b9f13e3af5a5af2c2a097c313451236822a9460", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680475, "uuid": "298ecf70-8933-4983-b67e-fb2420b2ab75", "comment": "Malware payload (Amadey)", "value": "894d878bf5459f13857f7d9bc2cf001f8d3476227f7ad4a4dcccea56144edc061b870a850a946a812ff16059ff80e962", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680475, "uuid": "4f815f89-d85a-4ed1-b301-446c200a4d33", "value": "T1AE2523169AE444B6DEF167B00CF306C31E367E41997C976B36428D6A0C722C9A9307FB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680475, "uuid": "ce294888-0872-4b4c-923d-58ae660e6a69", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680475, "uuid": "0c3a4a54-c7df-4ee0-9a79-1a78efebddec", "value": "24576:7yAScyXiXfxIcZ1jM9SqddscV9FUivm6M2/O0btEXge:uWyXCfxdZ1jaSSsEmivL/OkP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680475, "uuid": "96dfb79c-cf68-45c9-ad01-dfdfef174dec", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680475, "uuid": "aa6806fa-d54a-4a1a-bb66-12f83048e78f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680475, "uuid": "c5769ffd-da14-4ace-aa33-cdc8b35854e4", "value": "7463534172.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32bb4a90-f816-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684700974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684700974, "uuid": "946628c8-b627-48a1-8e7f-38ce4122c11d", "comment": "Malware payload (AgentTesla)", "value": "de810661253723f2addc77820dc81aeb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684700974, "uuid": "e6eeea2b-f629-4c14-a9d5-e093ef18e173", "comment": "Malware payload (AgentTesla)", "value": "060cbd961bb22ca26578ec782af86ae672f6d39c9e06808889c4ba103a05221d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684700974, "uuid": "edfe23f4-ea81-45b6-863d-8d627db51cb9", "comment": "Malware payload (AgentTesla)", "value": "12149dbb2bc46f6ffa886796827de5bdd4ba41f5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684700974, "uuid": "7d18c04e-ae67-4eb6-b14b-2a09ed7eb5c2", "comment": "Malware payload (AgentTesla)", "value": "25986880320b3658e49464d5c7da63220b95666d3c4fddf40a5e4ae358dab3863bc3d3c8302bbcae454ae9f0680fb689", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684700974, "uuid": "b8f8d4c1-12a6-4b9f-b664-2e96f3ab3b81", "value": "T190F4BE2071B94B45E03F97F15AA8FD2803B270A3A6F9DB255ED6B4CA5A21F001F45F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684700974, "uuid": "4536a718-3751-458f-beeb-c70d378c2175", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684700974, "uuid": "a7ae7c60-3450-4634-8b6c-ced7a0364474", "value": "12288:0iTSA2tTYp6R8iB2klyc3SG2PNnEBxpVvxlYVoaFVpdiQKpv5/v:LTSRTLR8i4klLKPqNvxeVoQVpdwJN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684700974, "uuid": "47cae1de-57e2-4a84-9982-7513c8cdf9a3", "value": 756224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684700974, "uuid": "bf96f559-34c0-49ca-a198-3a43ab0b8f97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684700974, "uuid": "2d2c5c19-d6cd-4a0f-94f9-aa7190cb58b2", "value": "de810661253723f2addc77820dc81aeb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03f53897-f7f3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684685863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684685863, "uuid": "3eea27b7-197f-4a9d-a090-9c91ee18d8d4", "comment": "Malware payload (Mirai)", "value": "73894d71ea30e5d5145b10e50570ac07", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684685863, "uuid": "4ba775d2-e1a2-45f7-a1cc-6a5b1da54400", "comment": "Malware payload (Mirai)", "value": "06625ca3bed5b6d0c7492e232f092f2de2f8ce700dbe54357d3dc979a2db37b9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684685863, "uuid": "e09b3fa2-8dc0-4e18-84be-a2410679845d", "comment": "Malware payload (Mirai)", "value": "bc883fc4fcf2117e5ac7ebde3e7db7397c6e84d1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684685863, "uuid": "69ea4478-462f-47f0-a130-496bf5f74be2", "comment": "Malware payload (Mirai)", "value": "43279fb1f3a3d1553eaa887c68eda4d78db5df429f9a5ef035231465a22992db734cdda56adfbb5cce3258817587dc7a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684685863, "uuid": "5d841c3d-9069-4c90-94cf-b47ebd2b4f3d", "value": "T1AF73E615FB650FF7DCABCD370AA91B0139CC554A22E87B367534D828B65B20B49E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684685863, "uuid": "b7516b6d-2d63-4010-a78c-882759379f9d", "value": "768:YGI8RZU53j6lRSfaOkfqdrTMNeJgkef6OrD+wdujMlZhChXiL3XKzesAQ2gXwxKg:9bUlGSrra0gkA6wUaZhCaKzbAQMxKg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684685863, "uuid": "87bd8997-d4bc-411b-8784-1c09ef222b17", "value": 76416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684685863, "uuid": "9feec4e7-3eb4-463d-a88a-4fb15c62e267", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684685863, "uuid": "52089d8a-5176-407b-b658-6ac3ee3374b0", "value": "73894d71ea30e5d5145b10e50570ac07", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bf10a55-f809-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684695325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695325, "uuid": "a900cb78-5242-429c-bc18-5ec4eabc2e12", "comment": "Malware payload (AgentTesla)", "value": "0e04344484259d16d6ec521d2c7ee543", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695325, "uuid": "f0cd6320-2d0c-4da2-845e-a82677c688f5", "comment": "Malware payload (AgentTesla)", "value": "06cc900bfb3fdf34a5dfaba0c74cebf64d41ffbb067ef32f32246df185a01b6e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695325, "uuid": "4025cfc4-3038-48c3-8567-8b143ba9af4e", "comment": "Malware payload (AgentTesla)", "value": "a17b3bd93940f0cd13811edd27305a9ce345d866", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695325, "uuid": "b9353ac6-c23a-4fc6-9af1-192b85aa73e4", "comment": "Malware payload (AgentTesla)", "value": "2fd66ae36355642d81adb7d497cc0b06fa81e5540faf9cc06ae7459640d53d1d4fe5361185ca2a92e25d533b9981bc6a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695325, "uuid": "1b1f49aa-2f2d-4993-b367-39570aee4336", "value": "T18813F1901B4A1BDA22515C7A60BFA87F8D4975CA13AFF24E3ED28C6C4910343645EEDF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695325, "uuid": "f18d6143-8784-4f5d-b786-035bb7adffc6", "value": "768:Yx6Ahkl1gmGHnB8PlAxahM6fg6ucvB+8FoFu70qNXg3N/DqG62VYRPrm:Yx6jl+mI8tAsvBBFoFu70qNXgd756LRi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684695325, "uuid": "99a3447f-3f67-4c98-8e84-0258582b3eb3", "value": 42653, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684695325, "uuid": "d90b9b8d-dfdc-405e-8ead-fd5c018601a1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695325, "uuid": "ea2ede8e-a211-4748-b28f-86292686b09e", "value": "monitor789.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d33d864d-f7c7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684667313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667313, "uuid": "d363dfac-0690-4d5d-bbab-38aa36f8aa5f", "comment": "Malware payload (RedLineStealer)", "value": "9e3e1c66c6baa33987b910db06f5ae1a", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667313, "uuid": "d6574256-86ab-4854-98ff-c4a94ac29398", "comment": "Malware payload (RedLineStealer)", "value": "06d6dd46160bcf15a4d20d68a943fc93bb2895e2e828339ebc6a096550013302", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667313, "uuid": "4d0a3484-3eee-43d2-b71c-e372fbba7ffd", "comment": "Malware payload (RedLineStealer)", "value": "c24dd3ebbb78b5f6c57b72d60addb98db4c16a39", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667313, "uuid": "41c822a7-babd-4a4c-b3e7-bee8e49cdce9", "comment": "Malware payload (RedLineStealer)", "value": "5ae3e81d297ada266afbd1ead94564103ac3c8ee88a46304ed536056e163db695955bf93ae1018340c552b5315ea27cc", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667313, "uuid": "2f52b8f9-2ae3-44cd-a98a-5f8abab58f13", "value": "T1FF252306F7DC9472CDF1277088F702CB1F36BCA168B8927B3781A9251D73646A972762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667313, "uuid": "65e91307-b45d-4824-97be-91b7f5a56ebb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667313, "uuid": "858e3640-18a8-44aa-b8bd-3b20fe4b9975", "value": "24576:ayBM9ENpHgjHqSGBtVeYxj98WGCz6uvLb2wYuQGFd:hBAIHgjHqSGBD0LMbmuQ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667313, "uuid": "8430ce12-803b-4978-bca4-bd4cfe34dc26", "value": 1047040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667313, "uuid": "71899104-28c8-47c7-9625-7a42d0955f40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667313, "uuid": "d763679e-71d3-4c38-a6d6-577ce9224756", "value": "engine828.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bcafccc-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684680454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680454, "uuid": "e89e350f-b067-4d13-a389-309d85710992", "comment": "Malware payload (RedLineStealer)", "value": "10c9ddaf18f5db7dcd4777aaacc22511", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680454, "uuid": "c2a19c26-197d-4f0c-89af-b2256592899c", "comment": "Malware payload (RedLineStealer)", "value": "0702aad4cf15c92030e253f4b6b6b7a2fb560d388792d149fa20e79dcf0191b7", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680454, "uuid": "d32c9735-b1cf-4edc-952e-08111d764d7b", "comment": "Malware payload (RedLineStealer)", "value": "cc786d9097b2335ec0c4afe0407b6485c79292f2", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680454, "uuid": "e02134a8-d92a-44f4-b5da-c677930eb2d8", "comment": "Malware payload (RedLineStealer)", "value": "7fdc291ff3bcd500d86e59ad3b41e3646f7f03b4c8f10aacd05e9e990eb7bfcd70f56179fcb3f09f5a6861e04e4f75b4", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680454, "uuid": "21373243-1adb-4a97-bd05-f348fba0d5f0", "value": "T1F225232376ED817AECB41BF02CF902931A317DB158A8467716069D5F1EB36E4A87133B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680454, "uuid": "c1de44b4-60cf-49d5-b0fd-b8e60623e5d5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680454, "uuid": "5a98d6ad-1f8a-4908-b3b9-42db0f213573", "value": "24576:ky3qHjnZ+Oim8CncDyn/DX3pMd3HG5w/6:z6DZ+Y8CncDODpC3w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680454, "uuid": "ff663489-1f3f-40b3-918f-4640f918e630", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680454, "uuid": "969e7310-8a65-43a7-a368-1e4757681e5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680454, "uuid": "89b879bf-4008-41b2-bf83-1689631c6390", "value": "274722859.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54105763-f7f5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684686856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686856, "uuid": "066784e2-8968-4507-a36c-468bd86d78fd", "comment": "Malware payload (Mirai)", "value": "795e99f53ee13937b47662eab1db4bc4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686856, "uuid": "f90bdb51-e1a7-46d3-a4b3-09a0c1dce766", "comment": "Malware payload (Mirai)", "value": "07231f78d4bae6df178ffc98d6c14b81f9f878b918555c0e99ce9258a7cceeed", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686856, "uuid": "f5cffbd7-1062-494d-9297-1f42e4f0137b", "comment": "Malware payload (Mirai)", "value": "f9cef36515ce93a4b8e8aa7b51ffb15685dd36e4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686856, "uuid": "ffe93a96-73e5-430c-ab01-f70372f3ee54", "comment": "Malware payload (Mirai)", "value": "35e0b7126c6a477a3ecfab144b0573c706abdb83e112b96c25601c89e9be684e3e167a507bd43416737c7754a7d7d3e8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684686856, "uuid": "c1e19dc3-3cd9-4c21-9ca9-1edb8a5f2af1", "value": "T16B338D67E82A9E54C086417075348F351F63F5C493531EBB2AA9C2B95093EECF644FE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684686856, "uuid": "9c74543b-76e4-413d-b003-cfef0bb87c19", "value": "1536:ta4xL/dIXfGERwAwfKrT+VKNn5Ccdf1xH:tPxL1IXegwCrzNn5h1xH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684686856, "uuid": "64fdb278-e31c-44b5-bcd5-c286d775909a", "value": 51320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684686856, "uuid": "e13209a9-60d7-4947-86ab-a8c74102940f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684686856, "uuid": "2ec891cb-1294-44d9-b933-7dc520089663", "value": "795e99f53ee13937b47662eab1db4bc4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6aa52e9-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684680687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680687, "uuid": "1d54529c-aabe-4720-9c3c-a572a9273837", "comment": "Malware payload (RedLineStealer)", "value": "965f38ebec77c8c5044ec4fd01d0af50", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680687, "uuid": "8f2529f7-f483-413a-aaf7-3a52dc04751f", "comment": "Malware payload (RedLineStealer)", "value": "074b1edc5c4ffcb5ccb9938e8f04ec43faf654fd9400c06e0cc5731828f70530", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680687, "uuid": "e613116e-91c9-452d-a5a4-2ff25e2b368e", "comment": "Malware payload (RedLineStealer)", "value": "00cb64e372c476be3c2bfb4963d261c8d5c4a876", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680687, "uuid": "1356f8f7-d1f7-41cb-aa28-4a1ce98a27cb", "comment": "Malware payload (RedLineStealer)", "value": "b1647b0445796c5c1ca9f5f7f20134843bfee9f6f8cd1a0205d23f7f0f244c7199bb15249740a735145df245a2dff4c4", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680687, "uuid": "a693a367-8d06-45b6-9eef-4e546e79db0e", "value": "T185252303BBD4A173ED7A1BB199F616B30B30FC61ED29876F6240A9160D73544AC61B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680687, "uuid": "d1a14e9d-948b-4946-8a9c-48792a9d036e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680687, "uuid": "2d6cc9e6-f2d0-4b9c-a116-5bee398c04c2", "value": "24576:Ayt0feH8AnASrvyqo5rbyejkY2OGu8RD89toZpGTwhFyZd:Has8AnXrvyqoJmeVGu8S9yZIchw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680687, "uuid": "9fa0443d-fe69-4b2f-93de-041fb859ef9a", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680687, "uuid": "112e76cb-555d-4c7b-8411-b385d8fdc2ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680687, "uuid": "7c18a903-aab9-4294-be6c-27b4ae49514a", "value": "updater337.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0eec075-f7c7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684667282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667282, "uuid": "c3ef11c7-12d8-4487-af36-c89ab1e65d7d", "comment": "Malware payload (Amadey)", "value": "44dc86efce68699ea1e01de8abecd507", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667282, "uuid": "d71ecd8c-4a10-4b48-a14d-622ff4ed7d6e", "comment": "Malware payload (Amadey)", "value": "078d75a7192a905b9cee4c60c307b00640e55b9d38b8cbcbd768123eb226c1f3", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667282, "uuid": "7d71863f-9ae9-4f69-9f9a-b1bcf70bac35", "comment": "Malware payload (Amadey)", "value": "497aecc2db33eb1e35da236e87cf55a9460c94c9", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667282, "uuid": "70abcc62-4a06-4ece-a4d4-0842a7efe844", "comment": "Malware payload (Amadey)", "value": "663ac7b2c9e38d0967dcf9db5c991cc77321d24f6a88a867170751a01c5ff3641697b8b29c2d541d22680e3e2c5b03b1", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667282, "uuid": "b42d66e9-092b-4922-9c61-fa3ed74c1ee9", "value": "T1DE2523031AF98166E8B52730ACF706D30636BE816779D75F3B848E4E4DB25801A753BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667282, "uuid": "6aed1a62-12c4-4d43-8538-b6f1887b0046", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667282, "uuid": "f62f9880-a404-4e7c-ac9e-e8b3f7df6d88", "value": "24576:uyUxUA+/SGlOlq83qAXm++22YTUB/iBmcAYutKOaDlzKzcdNyGvi:9U+/SGlOlq/+ta1cnutmDlUQyGv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667282, "uuid": "384a5e87-d037-4430-87f0-e428671e4700", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667282, "uuid": "ca59dd1c-989c-4489-8bef-1d53ac1e468d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667282, "uuid": "7186ed5b-06d0-4c4a-bf91-585f08fc5864", "value": "client448.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bd20238-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684680507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680507, "uuid": "e775a12c-fb85-4fda-932e-c40660724262", "comment": "Malware payload (Amadey)", "value": "e06372317aedc2638ee1d41146ae2295", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680507, "uuid": "1c65354d-1386-4068-87c0-96b059553662", "comment": "Malware payload (Amadey)", "value": "07beb896f3d881552d5b248b94e121a7fb8fb0c9eeaa7c99aaf6775a95506093", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680507, "uuid": "9594892e-81f7-4a9f-876d-0f851d150e99", "comment": "Malware payload (Amadey)", "value": "1caf2dab40b48ab4aab885c5a8afa10f2bd624ca", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680507, "uuid": "1990b11a-f746-4921-b63a-f603ea6caeb9", "comment": "Malware payload (Amadey)", "value": "22f83ec5a4150c0efeaaf2232dc56ecd4f24f366aae1ba1d918534fb536fa507e110dd5ef52fd0083f3b2edca93abcd8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680507, "uuid": "af2a7fad-e471-45a6-b3d0-e1f5ceb681bb", "value": "T1A0252216BAEAB022CDB427302CFB06931B35BC729835D31737C6695E1D73A95A530B1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680507, "uuid": "a235eefd-6d6e-4f6e-8587-bc4757a4c606", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680507, "uuid": "f2e89511-b616-4562-85fb-1f358af77ef5", "value": "24576:ZyEMWaRLvD9bWnTOfitvvm1WkTd4zm1XtfrtReGKVCTKeFi6qF:MdWaVDYTRxvm12S1XZGG0CTKec", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680507, "uuid": "61da4efe-0b75-4302-a60f-978354e467ce", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680507, "uuid": "81678946-d079-47bf-9b18-3f6a0ce63233", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680507, "uuid": "94f7ef25-43da-4266-b5f1-d862f42feea2", "value": "Unlock881.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc21f6b8-f7c7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684667301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667301, "uuid": "9a5111c7-579c-4413-9096-02bb256e6ea0", "comment": "Malware payload (Amadey)", "value": "305aa33ef5c420ba09859b2cadb13097", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667301, "uuid": "78af6392-16da-420f-9660-8730c46111f8", "comment": "Malware payload (Amadey)", "value": "07d2aeef92e930f8f3334a72c100b3e999e0ecc8617e11bdb2e5432aee6fbd85", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667301, "uuid": "35f76d16-1e33-43e8-ab0c-7c4b3ba20249", "comment": "Malware payload (Amadey)", "value": "cbba68750e36c97571ee6cb1cf3589d8ba03dc34", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667301, "uuid": "bad3f756-2eec-40e4-828f-0a948a631afe", "comment": "Malware payload (Amadey)", "value": "80b07974c5828f27099c8074d3accea94a83d3bef895581c522b47752341552f2815e0d2477459890e7e4ecb4a846685", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667301, "uuid": "c043e04e-712a-4178-b6e5-d5aef4f742a3", "value": "T1E8252323B7D800B2DD7123B158F902471B3A7EA38475832F3745A97B1DB26A49A71B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667301, "uuid": "432020f0-3a86-4450-bf6a-0be2226ff2f4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667301, "uuid": "4bd2426c-80b3-444e-b21f-491f234d7c00", "value": "24576:qy2X/hXNCfp1eqOsArQzMISQy4gx2yYV82MLWwwgUR:x8/h0f+qL0CUH/mENw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667301, "uuid": "21c9bde1-20b0-43dd-a0ff-f34ee24eeae5", "value": 1054208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667301, "uuid": "d87e9cf2-0a91-4ccd-91a5-648820b74e1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667301, "uuid": "6c78264f-f800-490c-8af8-b8cbfab906c3", "value": "download675.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0844391d-f807-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684694460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694460, "uuid": "56c71b6d-96bd-4652-be43-e764548e892f", "comment": "Malware payload (Mirai)", "value": "2a8a9a425ff232a83e94d677b0c60e7b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694460, "uuid": "b4ea7e3d-8166-4de2-840a-914b086e3463", "comment": "Malware payload (Mirai)", "value": "0834343b7a844b531387027a87fdf471bc598cf322684f80a69ad1312b5b6c99", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694460, "uuid": "35a8a50b-a564-4a80-a1e1-c7ba783e6fdd", "comment": "Malware payload (Mirai)", "value": "a90cba67242a45fa9997af2deba8bad10d6b0b09", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694460, "uuid": "ff033948-2687-40fa-a53c-e7b4d101d714", "comment": "Malware payload (Mirai)", "value": "2d4d8193c1653a6a3f3f3aadb0f773acd8d81817aaf509e2c54ac09339cc69de339bc4a4f9ee6f29658284ce1e62513d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694460, "uuid": "50cdd072-3c28-41f9-92db-2cb019cf84a2", "value": "T14B633A32B9760D2BC4C5A47661F74B25F6F243C625AC8A1A3DB10E9CBF756403247FA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694460, "uuid": "38331525-a260-47ae-bf1a-ccb5b4c96aab", "value": "768:7iodUrookek4FvQV6ytI+nJFBO+NHG5VxLd+T1EO2oa/dnNDtw5jwGBWnIs:7iOF5eRFvQV6ytB1Nm5g2oidVtwdBiP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684694460, "uuid": "da0c5719-df8a-4c3f-a987-242ef6f30175", "value": 67124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684694460, "uuid": "331d9227-4999-4021-b52f-6a6b3a7f7c45", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694460, "uuid": "d2e9c63c-c570-4fcb-af6a-f5b9c52b533e", "value": "2a8a9a425ff232a83e94d677b0c60e7b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fd39610-f7c6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684666636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666636, "uuid": "1a6305c6-c270-46f7-a625-ac0c31a0aaae", "comment": "Malware payload (RedLineStealer)", "value": "59204fcdcba1141be6774626f8e782d0", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666636, "uuid": "df505884-9c72-49f8-901e-7766f3212c33", "comment": "Malware payload (RedLineStealer)", "value": "084d749a74ba8a0e7d1cd7e255c78632dc7434cbeb6b59610fcbd0a60a578099", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666636, "uuid": "1d625af2-6321-42e2-a2c7-d59bf196f4c9", "comment": "Malware payload (RedLineStealer)", "value": "c9af3fcdfe75fe0a578b9ad501a41a7f0acd6c49", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666636, "uuid": "7be13f05-b30d-4460-9e1c-a8a02d627047", "comment": "Malware payload (RedLineStealer)", "value": "0b3b5df9d25b308aeb485804c2ea15224c4c192a589ef91cc5493a224a08bc2783ed9d79459ce9108f2c36cad252001f", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666636, "uuid": "06a6106e-0a56-44fc-8110-3af4732cf89b", "value": "T100252307D6D8E4B6D0B92F7044F616871B36BDE4897193BA3784BC063DB29A0947237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666636, "uuid": "a37d49a6-57cc-4464-8577-96ba94b3af2c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666636, "uuid": "a1083e28-267a-4748-ad68-b638b7f11476", "value": "24576:ryMWQmU3SgGNqYGbzHDKIQMHXq0MerN9Wk/J6L:eMWm3SgGNqYG3DKIQMHbMQPWk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684666636, "uuid": "d0d86539-ddf3-45d4-8efc-edef82bd8f05", "value": 1054208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684666636, "uuid": "149614d6-6436-421e-bcd3-d85a20a78f99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666636, "uuid": "74c600b4-8662-41d5-8254-bf47e8c382eb", "value": "launcher559.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26b15f18-f7b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684658433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658433, "uuid": "cfe55028-f140-4e09-9653-d6657b2f363b", "comment": "Malware payload (RedLineStealer)", "value": "6232bfab68641d56eb9e8cdd2beb3297", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658433, "uuid": "87b33f5b-71b6-436f-91f1-ca07a4a321d2", "comment": "Malware payload (RedLineStealer)", "value": "085d0458446af26c7b42ec51c13aaf58fb73fb63434520bdf757e53d6f3b0364", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658433, "uuid": "debda28a-f906-4ef0-a03b-d73f1254807a", "comment": "Malware payload (RedLineStealer)", "value": "2520ec998f57c4eb4701813a5aeee7d53a9138df", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658433, "uuid": "0749dba7-05b0-404a-9c01-8e0124e75bb2", "comment": "Malware payload (RedLineStealer)", "value": "950ad85416c0222a62e81c072cf42e64904c628eea8f159a2de4c37a44a10d99bacebd1ed301ede918ebc25cb48a5537", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658433, "uuid": "709744cf-f39b-4156-9e0f-32cfc0cae383", "value": "T105252202BAD440A2ECB12B70D9F616831B35FE619E74835B3B96B99B0CB22C17531737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658433, "uuid": "cd08316e-e9ad-4ace-9136-732358467a60", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658433, "uuid": "c043d55a-f743-4cb6-8725-1d31c18bf84c", "value": "24576:eyv1fIJ6Bq4U50gRS1psfmDD2NRi2MOh:tv1fU6Bq2IfC8J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684658433, "uuid": "622df813-7383-41cd-8369-fc8fc2df2aa3", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684658433, "uuid": "88c39d8a-2609-4031-a9a1-84f609d68fcb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658433, "uuid": "96987037-1a40-4912-832e-b26b9e40a4ef", "value": "encrypt275.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0912908-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684680569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680569, "uuid": "f7ad1c17-d214-4cad-a2e3-9d0af35c62e3", "comment": "Malware payload (RedLineStealer)", "value": "05bb8fb9226be022e4084e29cf6427e0", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680569, "uuid": "3336b7dc-f987-4ced-be0d-379b25f9f37d", "comment": "Malware payload (RedLineStealer)", "value": "0881a223ca333076a930768748b248a8cf12662b5a35a20970978db87ef455b4", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680569, "uuid": "663ae249-769c-4733-a4f1-1f91fef6c5ab", "comment": "Malware payload (RedLineStealer)", "value": "9a49907a1091958017bc48b8c46d1a92f0eead18", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680569, "uuid": "6e5cef3a-0ec3-4d98-a3c1-63f97c5f5256", "comment": "Malware payload (RedLineStealer)", "value": "71e7a17cbfd8d6f4c5207a3cab17bf449aaa56432f1812b28394955414c8a1e13c488e90a61cf00dbe2fcb2c681495af", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680569, "uuid": "3910e648-0c01-4851-a49d-5f1bf1ff78ae", "value": "T1002523476AC99163E9B5377068F703570B3A7DE14D36A22B3744894F2D326E49830BBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680569, "uuid": "07311b7c-80ad-446a-a6e1-01cebed8279b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680569, "uuid": "f2dee5a5-8bfe-4ed7-bced-25d5b4454a82", "value": "24576:CyAg7RiC1ycFvj/A/q7FxFKggS2qz3vnJLC6UNMXc:pAeR0WvjOqBxFbhLlN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680569, "uuid": "c8d2f9df-d5ce-402c-b12a-84951874eb08", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680569, "uuid": "7d0c9cd9-db47-4786-a891-317e25687b40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680569, "uuid": "5bbc7c7a-ece9-4cb4-83da-d12a884b24c1", "value": "extracted607.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6904c0d-f7c7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684667238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667238, "uuid": "b7c16bae-78c3-47a0-85a8-c947f538b0c5", "comment": "Malware payload (Amadey)", "value": "24e15c447add4297caed1f6ca1416863", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667238, "uuid": "282ebf8d-227c-456d-87cb-0ed66112f81f", "comment": "Malware payload (Amadey)", "value": "092fa6f6b9e9ddb985e913b3f40d6ae4728c4eb03b5b995493414a47ce8220bb", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667238, "uuid": "879ff3aa-bd37-42fa-9511-26e6e2c24ddf", "comment": "Malware payload (Amadey)", "value": "7046418c326ce8b8106827ac7086254b65d734e6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667238, "uuid": "fa8de1c1-5c5e-4c7b-9894-9d5159bafd3f", "comment": "Malware payload (Amadey)", "value": "b8b268c10644ce3ea7603995dcfe4250b91fc9acede64f941f7645c0b3079eaa5e77a30b88675c6fd0835e317af7d475", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667238, "uuid": "8d172ba7-550f-4f80-932a-fab25062f511", "value": "T1BE2523029BCC9062DC7427B05CF316EB0B35FDA049B4C72A6B55AE1FAD72AC4953172B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667238, "uuid": "447e6187-cb32-4beb-9d10-b93aac742022", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667238, "uuid": "f6b0c5d3-6b40-4ca8-8294-57b5e87607fc", "value": "24576:wyhvYIDlQIjN4vqu9kiy/eYqeyUG83rc:3hvYICIjmvqwkH/7nyUG83", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667238, "uuid": "9c5cd708-7ae3-464d-9c04-a4854a296f02", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667238, "uuid": "e290f4e3-5077-4d35-aa28-70c326496c09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667238, "uuid": "aef38d88-46ab-43ca-ba52-be05cc258203", "value": "99242642.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c33a4626-f807-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684694774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694774, "uuid": "25f9c58a-56ba-4fb7-8d81-8a06c5fe5599", "comment": "Malware payload", "value": "be00ab29513242313cf11ec2274ac0c0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694774, "uuid": "5318ce71-ec46-46a4-a540-73e2ba7fbe51", "comment": "Malware payload", "value": "0989fa2a349001f9a3fec0ad5a31318f9d81d786f33a1c89552dfe839a13a20f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694774, "uuid": "59329c66-c1a2-4f4a-8ec7-289b071ab2bc", "comment": "Malware payload", "value": "59016585e02a40b09ff9f90ec7063fbeb6eabd6e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694774, "uuid": "4c30145f-7101-47d9-b6ac-d3d02e1fc446", "comment": "Malware payload", "value": "279ba1e2f5c326402fd07d5958653b6d9639719baf02b2484d1fae96bf9a2ae41f88a6069d4af8e6d7236cf72145b46d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694774, "uuid": "10e5609c-8fd5-4e3c-b8cc-d55254746d88", "value": "T127252306E6E990B2DC766330A9F302970F777C915E7C926F2695B80909B22C0B57277F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694774, "uuid": "10905281-d8df-4a23-ae39-ebfdc7a007d4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694774, "uuid": "6bb1e2e3-7321-4d98-8361-0d3035c7539c", "value": "24576:tyT23AqXbeXNJy/fvIU+GWAsrcU3DfFmt30y7Dcfvw:Im5CJy/ItpJDtmywYn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684694774, "uuid": "75798841-9359-4908-bf71-5dcf6f5cf003", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684694774, "uuid": "195d8252-3d87-4943-96a0-a1a20e2be7bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694774, "uuid": "e2bd2fbf-b58f-466c-bebc-10b275dc531d", "value": "compress834.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59f56fe1-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684680424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680424, "uuid": "280fcf38-2788-4ddb-9ebc-b03ff21f33b6", "comment": "Malware payload (RedLineStealer)", "value": "ca00b74ac41a0b0da6ef108aad9de078", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680424, "uuid": "18902773-3b4c-45a8-b2cb-69e094ad46c0", "comment": "Malware payload (RedLineStealer)", "value": "0a790e9273bb88b8940ed31e8dee60e7bcc5e00e7f9cc349b8b00e00f0b99eaf", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680424, "uuid": "1480c326-3e99-49b6-8be9-001df7f33c1f", "comment": "Malware payload (RedLineStealer)", "value": "a56ac0700d3e9da69a2105ce97df5940f80d8671", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680424, "uuid": "a9e6654e-a5f7-4021-9e8b-1ca98bdaa3ea", "comment": "Malware payload (RedLineStealer)", "value": "481a1293ab0d295e167df0612d02df07b22ecb203867ba3f7b024803c4315deb183ee64dee8e9edd0fe98a99acf35182", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680424, "uuid": "0bf1ebc3-e60d-4665-841b-afc7ebe46e73", "value": "T1F6252303AAD44437ECF57F7928FA0AC31A3AFC9298F4825B36D1A9271C726856570377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680424, "uuid": "6f4474c3-e61e-45e3-be8e-b24ec3a0429c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680424, "uuid": "dc6b3d7c-2dc8-4fa0-b4d1-063d997a3633", "value": "24576:CyhSZFW7/fWuOTIqIfD16qYLAtssqn/AIuPKJHFH6ZPGt:phsFWLfpOTIqIr16qYLAtin/ALqlkG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680424, "uuid": "8ac22f40-8f93-48ee-ada5-1f419ae61b37", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680424, "uuid": "61f58fae-f07e-4f73-bc4f-c72058cd823e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680424, "uuid": "739cd0be-c130-4641-a889-b67b4487f66d", "value": "234563663.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32e1ada8-f7b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684658454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658454, "uuid": "d31e0277-6300-4163-bb58-a045485f741f", "comment": "Malware payload (RedLineStealer)", "value": "0ddfa83e10b309614f1580360ba99acf", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658454, "uuid": "f0322a32-3b2e-476e-a23a-a033680373b5", "comment": "Malware payload (RedLineStealer)", "value": "0b0bef1b30aa286e0ad699927073e31d0c0b4decd17b4a148eb9e457c677d2e8", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658454, "uuid": "71acb993-6892-4ca1-bcb2-527929ada2bc", "comment": "Malware payload (RedLineStealer)", "value": "8fe83f9a40091d3ae4573319eb12af7333be6377", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658454, "uuid": "84b1585b-5059-49dc-bb5a-7070181c2696", "comment": "Malware payload (RedLineStealer)", "value": "e394a4ce5a74a40c28f047aef29bee4b743b9c3f478e94e937422661673c3d0c54b9883175e1554a9ee10cdd8d10cb33", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658454, "uuid": "bc8c5417-5f42-4770-b363-035d51fdba3c", "value": "T1C9252317BADC4023D9E21BB569F202D30F39BCB08D7C936A3B51984F6DB354898747A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658454, "uuid": "de8538c4-5de3-4ef6-8894-4d385428712a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658454, "uuid": "eeaeec68-899d-4c7f-beb9-584ea34a975e", "value": "24576:KyysM6B199B7LqruDA8ojgqTZ3FF9dDV+O:RxH799B7Lq+ok2Z3b9d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684658454, "uuid": "33162fc6-18d2-4592-a787-e709c0ab9e18", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684658454, "uuid": "efae234c-95fe-459f-b324-0503b94e3d37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658454, "uuid": "39a0e8b1-fea9-4616-9ea8-cfda4471f5d3", "value": "islauncher532.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfa439da-f7c8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (TeamBot)", "timestamp": 1684667763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667763, "uuid": "78eddf37-e957-4351-9559-6409eb48cb1d", "comment": "Malware payload (TeamBot)", "value": "5c03743f13de536a0787c5d90fd96eae", "object_relation": "md5", "Tag": [ { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667763, "uuid": "ad97b294-68f2-4aed-8145-6599af87ce92", "comment": "Malware payload (TeamBot)", "value": "0b5b173442717540eafb8319b62aaa98aa3c222eaae1ebc49a712f7b6dc9bcaf", "object_relation": "sha256", "Tag": [ { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667763, "uuid": "29953b55-204e-4a14-a368-fc36f8e93ee1", "comment": "Malware payload (TeamBot)", "value": "5179b67bc8b556ada6770de0efc358a6b2061a05", "object_relation": "sha1", "Tag": [ { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667763, "uuid": "f750abae-7f89-4d52-b9fa-6b03d4a46d61", "comment": "Malware payload (TeamBot)", "value": "3027e7b569f2a5d18c5e3281fa342ef0909dbba9606af1259eb2b7b19672809b044a3719070f8947c62b4c7d923f2957", "object_relation": "sha3-384", "Tag": [ { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667763, "uuid": "e8975373-c659-454e-8a51-3cb333af5e82", "value": "T19A05D002D7D1BF62E9154E729E1EC2F8A6EEB5508F493BDB66187E6B04702B2C573301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667763, "uuid": "7f38f71e-d2aa-4278-8a47-393f15593ee9", "value": "52052f823a75c3e49d6f33c06369892a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667763, "uuid": "1aca4f4c-7e46-438f-88ba-1a8705b997f9", "value": "12288:Ru2R1aBpw0DBH/qT4ExdNnv4WIm0O4ffLtPQt4ALYsaGul7T1uT5PUtD:R71av5d/qEkNvtR0O4HRcLYX7AT5PUZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667763, "uuid": "ed9edbea-ef2b-455c-9200-91389abf6bf0", "value": 842752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667763, "uuid": "5d296494-0341-41fd-a556-a2c46f1097ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667763, "uuid": "75eea6a2-ac89-49c6-90a9-f16242a34c6c", "value": "Unlock856.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f74c313-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684680487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680487, "uuid": "0e76e30c-0ffd-426f-82d4-e3021a4701ed", "comment": "Malware payload (Amadey)", "value": "5e30ecb94d67181acdc16259d4c3c7a1", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680487, "uuid": "ace0739c-5f01-4846-8796-102047776867", "comment": "Malware payload (Amadey)", "value": "0b7590862c8359b17bfd38bdc45ae873f00322ed9133a9c19b0e6906f771d0d4", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680487, "uuid": "68cba5b9-8a65-4b4d-b6d5-ae4cf4dbe419", "comment": "Malware payload (Amadey)", "value": "fe58b145a03dd9779c8fac6212582015dfd92f54", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680487, "uuid": "349c51b6-3870-4001-8cf9-9073192660ce", "comment": "Malware payload (Amadey)", "value": "09b6777b5dc23a09cc1dadb3ac2be7a32d763637629993daae3a0d6478b2d3af384a16435d1959c6e9ab11877c6ac03e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680487, "uuid": "08d0e0d8-7003-4b6c-83c9-39e51f79c6e3", "value": "T1A8252217F7E59073DDB52730A8F712930B31BD668D6C825F2688692B0D732E19A7036B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680487, "uuid": "3ebc9db3-38a2-40a9-a98b-064dd46ee290", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680487, "uuid": "d0bf64d2-0f36-442f-908b-3ba2b4f1d4f7", "value": "24576:JyW7EQnQfNXKatKmqddbkOl3VYFyDACTYycR5e:8WJnQfBkDdl3VpsCTYycR5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680487, "uuid": "23d9a343-0860-42d4-aa35-1d1116b7bca6", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680487, "uuid": "8b915345-0e30-48f8-bdd5-8247f785dc05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680487, "uuid": "6d8c2eff-8281-4bfd-a11f-572cfae89dd4", "value": "AdminCrack708.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0d1dc53-f808-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684695226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695226, "uuid": "f0674d83-dccb-4bc2-90dd-dfec69ea9d06", "comment": "Malware payload (Amadey)", "value": "2a4706a20c2b6353cc65a2e21925d733", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695226, "uuid": "6a4c550b-f4ae-434f-88ac-989f2953f485", "comment": "Malware payload (Amadey)", "value": "0b8b47a620667ce21d9055a7a8cb14b076e8c060d66ebbf1f13e67030b9d50c8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695226, "uuid": "2d747637-b959-47e5-934a-496c468e0787", "comment": "Malware payload (Amadey)", "value": "6d97a805c50c02bd7098425ce21b2c33e7d37d6b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695226, "uuid": "47364dcf-5f94-4b79-a6e9-a24203d0237d", "comment": "Malware payload (Amadey)", "value": "339ec9f5775880eae1e82256af5655435e7f775cad29d959bff2b188df2a44ae6fa233a5043e3a16466a99984f82e597", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695226, "uuid": "45280111-5abc-4f1b-be33-07c3164041d1", "value": "T1B3252313E7E86972CAB1177498F702831737FD625A30926A2706986F0D73796B836733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695226, "uuid": "cadc4912-60e4-4284-b885-99e006e59f31", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695226, "uuid": "9bf58d91-3296-4c10-89f8-72174ce682ec", "value": "24576:FyukSMqRxNaCar51ECeMeeki4fH3LFVTmtng5T:grq7ar5dfv/4ffT2ng", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684695226, "uuid": "f43d9491-ef4d-4a6a-8e06-085fba1fa2f1", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684695226, "uuid": "4fde66cb-064a-4c86-bc26-b1fb84ebecd0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695226, "uuid": "7828b76b-09ef-407a-92f2-0766dc927bd3", "value": "3535634248.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6539cbf9-f7b2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684658109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658109, "uuid": "23369fda-6bea-4e0f-8170-de421dff1e15", "comment": "Malware payload (Amadey)", "value": "d657068b82d05a293de45aae8b6f77d4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658109, "uuid": "4c1bba65-2f91-4a1d-a1ce-e4be92c36b5c", "comment": "Malware payload (Amadey)", "value": "0be9e727a7dc7db9f1b8eb031eeb3d6aefa5278910c5b68c285d2c06f66ef179", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658109, "uuid": "77f64ea1-1767-4c3d-86f1-fdeb233d5f4b", "comment": "Malware payload (Amadey)", "value": "65a92f5df9ae25397ea3764f682beb207bff255f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658109, "uuid": "4d85718f-dd16-4ac2-b00d-2581c995df14", "comment": "Malware payload (Amadey)", "value": "e79d9dfc62c539fc694a7a074d5ce8ad7a8645a618279c5ef9adc84ac3c6eaa041554a89800804d759f5535f40eca9e7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658109, "uuid": "0dcef4ab-d82b-40bf-a473-c694b230c020", "value": "T1E3252307A6E892B3DDB4273098F607830B79BCE09D70936A3756BD0A1D725D0A47277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658109, "uuid": "937d1108-1765-4687-a879-77e477882b28", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658109, "uuid": "355f769a-2599-4b20-af05-f6280e273f2f", "value": "24576:fy5cPxh6qd4sqOCNbknzDBtTjTPXSwIJ63pX0kV4+:q5+xhpesqQXrf6juR0kV4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684658109, "uuid": "e478a694-2e21-4225-9879-898591288535", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684658109, "uuid": "b0a85ea9-64ff-46cd-85f2-77bb012ac58b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658109, "uuid": "e375c807-e084-4e43-9d63-51bd57935e75", "value": "utility.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d8031ca-f7eb-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684682658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684682658, "uuid": "1cd34270-6726-4b5a-b794-7c0a96acb3bf", "comment": "Malware payload (Amadey)", "value": "448be7ee03498f73177b00c17bf3850d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684682658, "uuid": "aa64a7cf-3c4b-4b57-8a62-962046f10eb8", "comment": "Malware payload (Amadey)", "value": "0c16adf574337009ba84419e2681cef81612e0e3d87e93a213dfce55a9fdd4dc", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684682658, "uuid": "cc001ec0-47e1-4c70-973c-c21fc6f61056", "comment": "Malware payload (Amadey)", "value": "aef616aa997716e773dd372248533f67d3bb81a4", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684682658, "uuid": "ee3003b0-4dbb-4aae-848f-8c8c91d8ecb2", "comment": "Malware payload (Amadey)", "value": "6186bf2cbc8577590a39faeb1070c69e9c5b4d283261ab498fc6e80b703868c72ca0d2fd2c2262b8663910a1e3cbb6e0", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684682658, "uuid": "23f34469-53ff-4ce3-86ea-8f95976e1bfd", "value": "T1F5252323F2E86066D8A57B701CF207D71636BCA15B34832B7346914B1CF35E4A8B57AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684682658, "uuid": "aeba16bc-418b-4d0d-8c5d-ed19adf16ff5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684682658, "uuid": "2a4e7b4d-424c-4128-b54e-89d75c359dc8", "value": "24576:MyELuYfB1lKlNmM0mnZ/OIQf7WIKrCgXlzqDP8pqlv:7SfB1lKB0mncI27hKGKSkc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684682658, "uuid": "8b05c6b2-689e-43eb-81eb-9ef958f05d79", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684682658, "uuid": "328d76bc-4e39-44aa-8034-5640cf0ef07b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684682658, "uuid": "80a3fa8c-8c89-48f3-8c1b-ee574ceb059f", "value": "448be7ee03498f73177b00c17bf3850d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2165676b-f77a-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684633943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684633943, "uuid": "3a3b0b40-7fc0-4001-aa2e-5cb2c37eb807", "comment": "Malware payload", "value": "7869c200d3d1057a06ec179acd4dccfd", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684633943, "uuid": "cedadb13-02ba-4c75-9dda-572078be09a3", "comment": "Malware payload", "value": "0c476855834bd76db137ed24aa0577fa42b9fa559a4f16911a53f03e8f09a496", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684633943, "uuid": "250da17c-33cc-451d-bf17-14809a395b34", "comment": "Malware payload", "value": "57ab186ebf82c0a21062feebc1794b17a998ce83", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684633943, "uuid": "05d5f796-0768-4e56-8e76-58f16f9eee89", "comment": "Malware payload", "value": "d469b58538315dfbb3f6f810b449e54ecae43a693203c764bc575a34189fe04be47f435a4f6499cd57803e5e8988ceb4", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684633943, "uuid": "168e2a2c-916d-41f3-bada-dbcc7a8e699f", "value": "T1C9865BAB5397A6A5E0D123334BE9A3C19154A23B7DA00EEE4CC8EC49167DD73436C6F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684633943, "uuid": "8b6382d0-425d-4a42-b012-60ebbbad5d00", "value": "c983ca29445c3b0f29b987d079b73fc4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684633943, "uuid": "cd55cb28-02c0-41a7-a439-6ed94ed24e29", "value": "98304:C9ZbwlHtCGUwzscd0LAKcvkw0I0mZc8Vfssphx+sh82BfSKF7X:CM1tC1Yd2nVbILZv5hx+S82BfSU7X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684633943, "uuid": "c61efaad-fae8-4aaf-89c7-772a72e8ed36", "value": 8031232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684633943, "uuid": "82a146fc-04e0-4049-84e2-46043f00f86a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684633943, "uuid": "27c79968-1f10-4070-bb9b-49f20e8176b3", "value": "7869c200d3d1057a06ec179acd4dccfd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dc2d230-f801-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684692080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684692080, "uuid": "597bd10a-b316-4973-be1d-51b078aab74e", "comment": "Malware payload (Mirai)", "value": "e2fedf619b489efdd9376a4098ba0640", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684692080, "uuid": "a94bb57b-e7c8-4ee2-b8df-0769edbce33c", "comment": "Malware payload (Mirai)", "value": "0c9cad6f28931de6d5fc809b0f8aa31334454cc0fb38382e27a47b969beefbd4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684692080, "uuid": "93c78a3b-eaf3-49f0-bec8-e7ed4b8c9bb3", "comment": "Malware payload (Mirai)", "value": "6104b557231c99c00310db0e4919e3518231176c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684692080, "uuid": "5a845994-c692-4faf-96f1-0ffca1ce8453", "comment": "Malware payload (Mirai)", "value": "cdc62448a4fdd9452c50cc228fd47778e721189df54b33060b9daef0ebd86b4bdbd5eec9a05c9e8efcf6b3a2700ded5d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684692080, "uuid": "be857337-4b9f-4e93-b6a5-ee72382ef319", "value": "T10CF2F1E2D75A6CA2C2E11EB6D419C4C396EA2CF4F896A1402FA0C96C9FC707795F1542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684692080, "uuid": "9f459b43-d488-424f-8563-c0e7730ece71", "value": "768:/5MQXDDSIQ834PiD4F0VzhpgZ72jBlJRSsPvui3UL:/5MWQ834PyqdwBlJRSsn6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684692080, "uuid": "0eb339ae-b472-4bd1-8769-5a24bbfd53df", "value": 34580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684692080, "uuid": "702aa8e0-ec83-44ed-a21e-948545ffdca8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684692080, "uuid": "2928d007-0a2d-4c50-ac88-58df0388dd4c", "value": "e2fedf619b489efdd9376a4098ba0640", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81174a21-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684680489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680489, "uuid": "fe2385e4-e957-4441-b9c5-70bf7e4a82ac", "comment": "Malware payload (RedLineStealer)", "value": "f462aeee6aaa3386eb7ab1074e1a1f5e", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680489, "uuid": "dd4fadc4-d12d-4190-8677-db9777a3d928", "comment": "Malware payload (RedLineStealer)", "value": "0cc18850b44ad1993a808b9fe0bf20c8b8dacc1e382e5cb3910b6a5bbc2f5b44", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680489, "uuid": "d14963cd-b2be-460e-bfd3-ced2be67cf0a", "comment": "Malware payload (RedLineStealer)", "value": "ac5b156d7998d9e030bb126a14a2f9eec3642eb8", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680489, "uuid": "9b144b9f-02cc-4bcc-9a00-f198b54c051b", "comment": "Malware payload (RedLineStealer)", "value": "d1c9822959dc7ba8879296c7ea41067408e84b505f1e8422e383a1bff47c6a2602aecc7a667add5a4dad3e111d91ddf9", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680489, "uuid": "fcc96a25-b2ef-4c4c-b09f-9b1dac249d35", "value": "T19B2523126BDAD073D8F06BB198F709D30F34FDA0C97827472B9251AA1D7268464737AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680489, "uuid": "bb15812d-a41a-4d78-a58e-cf181ac7a4bd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680489, "uuid": "b722a62f-7d2b-4322-9c0b-246cf355e098", "value": "24576:0yxziKeclI2HByqHCsybsR6reOgsNwjmgIFZqZOqPYqU4cbSM3K:DxziKesIAUqHopreOXNwZIFUYsYqU4cv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680489, "uuid": "5a955b01-92fe-437d-b2cf-9a9d5819e8c8", "value": 1056768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680489, "uuid": "3ff00a00-807a-4e24-9837-95d1a4ce8724", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680489, "uuid": "b9e2eba7-022f-4b3d-9787-3b3c73cd41db", "value": "DiscoSetup756.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61af8f48-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684680437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680437, "uuid": "d1c5dda5-c47d-4020-986f-3d2bd6813a70", "comment": "Malware payload (RedLineStealer)", "value": "0d2dc30cd1728a89a586f990b8a70017", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680437, "uuid": "1feceb09-7a3e-4b15-8c37-f7710f4d82a5", "comment": "Malware payload (RedLineStealer)", "value": "0cfd9e778dee004860807efb403e5eff8164c12624af55e720bf984efd43b76f", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680437, "uuid": "ad2c4a92-5eb8-4a1b-aa9b-8bd29092b02f", "comment": "Malware payload (RedLineStealer)", "value": "907a5a53e44ec08b3da54636c7c9c91ec5ac1c27", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680437, "uuid": "b0063165-f9e7-4434-9762-637cfd4203e2", "comment": "Malware payload (RedLineStealer)", "value": "1d5837b79dc58a8beb325e7a22fdacefc62d412d76e629a58f841447ddc3a6293b38b3560f1c408bfe6966f4de130119", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680437, "uuid": "3f7e0c62-a204-4332-88bb-1b27619e6d2f", "value": "T1B2252253D7E99472DCE917B018FB02D71B7A7DD0DC74826A2386AC5C2CB3948A87436B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680437, "uuid": "b2404ec9-03eb-49f7-96f1-de70129465c9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680437, "uuid": "4c20ffb3-7d04-4e32-849a-3e00bee1264d", "value": "24576:RyF6LN1FAtYDE5Hs5d0jL65Pr1xxyeU50:EFY7vo5M5qjO5P5HjU5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680437, "uuid": "41b700cf-6a9f-4d22-9b97-9738643ccd47", "value": 1056256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680437, "uuid": "bdf626ea-fa9d-45a2-b220-dec072a9a9c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680437, "uuid": "0d7e4c4f-7591-4e8c-b369-4296ea265c31", "value": "2467388.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ba1cc14-f7b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684658469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658469, "uuid": "e7c8e7dc-c975-411a-b0b7-c5a4e04a2842", "comment": "Malware payload (RedLineStealer)", "value": "250c74fa547206cc94af1ff645799062", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658469, "uuid": "69d2a439-3f56-4c6c-9518-f7adb56d2d9c", "comment": "Malware payload (RedLineStealer)", "value": "0d28e85e7e0ececbee2eef6565476ea9438a47b0d47766ae0497c137b821d787", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658469, "uuid": "cd6798d7-c616-4d46-a714-f5529fcc388f", "comment": "Malware payload (RedLineStealer)", "value": "4f07f794b761923421ed5e6753cda1896e541948", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658469, "uuid": "883592ce-a96f-4be9-b86a-44766d495663", "comment": "Malware payload (RedLineStealer)", "value": "5678bfc562b4687b1b06ba87a6540aeb2ab56c62ecf1ad572b96da5f0a3c61f0bb8e6097ced8218b90dfddcd95ba1cb8", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658469, "uuid": "a3949d49-e9fc-4582-96dd-21ea691aff83", "value": "T193252303E9DA4472C9EA27341CF213D30732BDB25EB593362B46AA4E4D336846A35777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658469, "uuid": "766b52db-aa63-4c03-b53d-601d5f8c340f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658469, "uuid": "615e5ad2-cd42-418f-8ace-2293098c5395", "value": "24576:tyiU7rh4ilZDTGddqMD9osMWduftcQYXdkk8cxy:IiU7SEZDTqq4eNWdyEdk0x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684658469, "uuid": "86a6dd64-f3e7-4608-9f56-0c3bbbabd15b", "value": 1056256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684658469, "uuid": "170fab6c-af70-4db9-84d5-a23b8f0ceef3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658469, "uuid": "f596f386-6212-44e2-8733-2f77d1eaf0c5", "value": "pdf-reader-plus916.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1412c75f-f79c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1684648524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684648524, "uuid": "0480203e-2510-4a1f-90ed-4ee816598c33", "comment": "Malware payload (njrat)", "value": "f73792222c156fe0ffced8cf42875cb6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684648524, "uuid": "4429dd1f-0a31-4353-97e1-b4aee4a1b617", "comment": "Malware payload (njrat)", "value": "0d83ce91f555aa55fed821066d8341df017f7a25c9a4790d161feed26d627973", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684648524, "uuid": "ddd92f3b-8834-4b29-acf3-eae8021e7128", "comment": "Malware payload (njrat)", "value": "b68899261b66f1789334eff798f5a80bb0cbdca0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684648524, "uuid": "e0de7f36-068a-4072-a82f-c7e916e1cad2", "comment": "Malware payload (njrat)", "value": "42234b1d844f129f34757b21004be4de9ca861640e3155221f30503ff2033437b90080202e615eb0ca71b647fdb4a4d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684648524, "uuid": "41782709-eec1-46f9-9f6c-8a204aba365d", "value": "T1C3653D2C79B48392C9011075E2CF15E9FBF627919351AA01F0A05AD9DA47ECDFE2BCB4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684648524, "uuid": "2b16e933-4917-481d-9690-7060b3db3dfe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684648524, "uuid": "694e3a7f-755c-4631-a322-4b7386b477fc", "value": "24576:D5gJ05B4XvH8ByKj+Gmw5rp/s5HRxBiCogit:D5gSUXvcByKj+GmwvMRxBBit", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684648524, "uuid": "5d9aeb26-67ad-4d8f-a5c5-329eda755b4e", "value": 1502208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684648524, "uuid": "7a3252c0-986f-461d-8626-2eda8e93be02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684648524, "uuid": "955af6b5-d98d-4da2-8427-ab827b13e58f", "value": "0D83CE91F555AA55FED821066D8341DF017F7A25C9A47.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1f83d48-f7eb-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684682826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684682826, "uuid": "325a487c-eb5b-429f-b864-bf01e4a94b11", "comment": "Malware payload", "value": "6d274b83ff3cd04785ea77ea14269fa4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684682826, "uuid": "e1cc9bee-e2dc-45d5-b7e4-e25fc201089e", "comment": "Malware payload", "value": "0dd6f6df3a229d30231d406d07d6d384d28e16e1050226f1c130a0c994c7506d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684682826, "uuid": "e1a694c6-f691-4b3b-ae4f-8b6c6bee25a9", "comment": "Malware payload", "value": "89fa27638e40a8d4ce9bc1d8044fc294e578ac99", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684682826, "uuid": "7c1c7cd4-c4d3-492c-b289-79d5f86163b0", "comment": "Malware payload", "value": "caae044c926390d3a68ac5291bfdc6f4130bc826978e78a2b36f30d1924a7cbaae51165bcfe84420f564f09b12d7ab25", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684682826, "uuid": "a48eb986-a0ea-4400-b93d-4ba57735f8c8", "value": "T1FFE34909D7408B57C1E2277AEBDB424933339B54A3D733099A38ABF43FC27995E26116", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684682826, "uuid": "f20453d6-a01b-466b-b151-596a50ea16c9", "value": "3072:ut8iFDKEfFN+Fa+1sW9h7n1erM/9pUMbmQwfCMQiGW:s8iFDLf/+FaNQh7nsrM/9p5mQwfCDiGW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684682826, "uuid": "85f59daa-84b5-4a10-bbbe-e0f1fcd73000", "value": 150049, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684682826, "uuid": "9407b2c1-b030-4b53-add1-37c9d117b1ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684682826, "uuid": "2a7fe958-9f54-4f7d-9348-4da2d53a7788", "value": "6d274b83ff3cd04785ea77ea14269fa4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22fe0b13-f809-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684695364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695364, "uuid": "8782028b-6962-4498-9de0-9d20204e9852", "comment": "Malware payload (AgentTesla)", "value": "0e293a989fffbaa7066db6006dda6f03", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695364, "uuid": "c9a1232b-1ccb-425a-8f11-2e9700092a7b", "comment": "Malware payload (AgentTesla)", "value": "0eeff88e23192ec1f6142e0a69160b0917aeec1cd925bdd36f1657d1f9ec6062", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695364, "uuid": "4a621e4f-f190-48ab-9a33-e7b86d0d8be2", "comment": "Malware payload (AgentTesla)", "value": "75716695ade18791fba5fbde68feb4553d0a58db", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695364, "uuid": "cc138a0a-2f5e-43b8-aa9f-6ea128a74335", "comment": "Malware payload (AgentTesla)", "value": "f3d0cf87654329bf784c5d8d38f1535931782a7b873a080767ed343f1aa7bed96d624a39b9fb30d517c0476c181b8588", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695364, "uuid": "0662c414-a7b6-4918-8b2e-b85a643f8be6", "value": "T18CC42359C08F6AA9B3C851FCCC97470C26F8977B4A651AE5A6CE124E1AD18F473C0CF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695364, "uuid": "cd0acdb1-f55d-4d33-bae1-13b2df93f1d5", "value": "12288:uABcgd+hLajGx+C7dXEjSbyYRJQGeL9lYwFDc0JI0tlxyXcuS+3p6V:u0cHtB7dXbR789nFc0tlxYcF9V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684695364, "uuid": "b6444bc5-a489-4baa-87ef-5680b949a700", "value": 572909, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684695364, "uuid": "20080e7b-75a7-4d45-b5e5-35f27a762a5d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695364, "uuid": "cbc4c323-8c5a-4b5d-891d-5f06320a4feb", "value": "stealer915.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "168fed73-f809-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684695343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695343, "uuid": "cbc03231-f99c-4f08-ad05-acf0c98ebfd2", "comment": "Malware payload (Amadey)", "value": "de578a7ee388820eac7a710fc4b4da2a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695343, "uuid": "ea91959a-a949-493d-8e5a-c27afb40762b", "comment": "Malware payload (Amadey)", "value": "0ef0ed7930c910ec4b2089a3d122fde08fd4646dac2ebdd77d03ba5495c9e9e8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695343, "uuid": "220dcd83-b6b8-475b-82c8-12a24aa16e47", "comment": "Malware payload (Amadey)", "value": "f775e36b7f26a95cfe92ac184f89261424e6b51c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695343, "uuid": "a2a5c877-243b-4d11-970c-187520bb255c", "comment": "Malware payload (Amadey)", "value": "6757c51999092b3d18db7eaf81cc83c6f14e3230dbd84fe7f0e8e3b6e9714886c2d8fefcfb5beb552129b08f87212b33", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695343, "uuid": "ca89a699-c0e2-4edd-ae41-8542a8068ba3", "value": "T1D2252303EAD16033C9B6AF7025F20293067BBCE54574867B2758E94F1CB3592A971B2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695343, "uuid": "39187df0-dfd0-4d9a-8dca-7435f394c542", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695343, "uuid": "de2ad84b-6839-4bea-8ecc-01d9794f1892", "value": "24576:LyAIlb7evv1kJEhTJXoDPjVIPgPYrox4k1SXIuc5QTho:+fB7eVPhThoDJIPgPYroxzEz9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684695343, "uuid": "9a1c37a5-eb62-4704-994a-fabf5268e952", "value": 1047040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684695343, "uuid": "56dc2631-f24d-4af5-94c5-6a3120a85ace", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695343, "uuid": "bc416925-6211-418f-a54a-8e5bc56769f8", "value": "player323.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb777ddf-f7ec-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684683272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683272, "uuid": "32f81cc0-670a-4f6f-9b26-5f057b5b3b5e", "comment": "Malware payload (RedLineStealer)", "value": "a09e487e5914d5e57973d17c3f80492e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683272, "uuid": "e77abece-378f-45e3-b1b1-2f313421cc18", "comment": "Malware payload (RedLineStealer)", "value": "0ef4a5673ffa38758277b9700d88ca81941921260fdb6c11c6046741348b27c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683272, "uuid": "021de5ef-4284-4ea3-9570-4af405d868ad", "comment": "Malware payload (RedLineStealer)", "value": "55e4c83d2667290a3f0f20b576248433daa568a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683272, "uuid": "82cfc4e3-cd0b-42b2-a8d1-55268596922b", "comment": "Malware payload (RedLineStealer)", "value": "49e0436bf4a43cb4b696f155cea38c897240ced2efe7377f6a6871492060e364731036876bd47f792c2000528a5a5421", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684683272, "uuid": "f7f5de53-5603-4852-a13f-7eb0e02c1ec4", "value": "T1DFA35D2067AC9F19EAFD1B75B4B2012043F0E08A9091FB4B4DC164E61FA7B865957FF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684683272, "uuid": "91c10abc-09e1-4a46-910e-87c06fa2c10c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684683272, "uuid": "6091ec8f-4770-4e0c-8967-e8b017a3c58e", "value": "1536:Bqs+FRcqWClbG6jejoigI743Ywzi0Zb78ivombfexv0ujXyyed2ttmulgS6pUl:veRclyY7+zi0ZbYe1g0ujyzd1U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684683272, "uuid": "5d28a9d0-b1f5-4477-aa00-7cbfc27c14f6", "value": 97792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684683272, "uuid": "c5285c07-849e-4e4f-a91d-ba8ce0c53d69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684683272, "uuid": "139eb461-226e-4990-b835-4bcf933b41fb", "value": "a09e487e5914d5e57973d17c3f80492e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef865710-f7d0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684671226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671226, "uuid": "5a85d8b2-eb00-4dbf-a3b2-98889941455f", "comment": "Malware payload (Amadey)", "value": "f914b95146d4f2907db1ef2b3f659231", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671226, "uuid": "6916b40a-89f1-4c23-94de-08888f8031e5", "comment": "Malware payload (Amadey)", "value": "0f0c7594143d09ab80a5efa1ab5d61b4ecbaa5526c4cd8f6240f08ffcc4d7930", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671226, "uuid": "e3775589-29ff-473c-a8a0-21d19437cedd", "comment": "Malware payload (Amadey)", "value": "51264dff5f1ed8f0aba520649c05348ee70a71a3", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671226, "uuid": "3b3c5bf9-b14c-48da-bb28-39fda334e96e", "comment": "Malware payload (Amadey)", "value": "31c11be1a1f23ef962ddc8bbb99ca920207cabf0b4c0598cb88cefa4627fb8ead2c513fa974cdb56319ecb8009df9410", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671226, "uuid": "81516d24-1110-4b90-96ec-bbfdb733eec6", "value": "T15C252203EBE9A072CD7167B65CF212870B35FCE1D974822B67516D592C32985AEB033B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671226, "uuid": "47b8c099-fc9a-4811-b1a9-f9fbd0d8876d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671226, "uuid": "0142d17e-8e8a-4375-b3ef-e8131399f223", "value": "24576:tyZGnaHKXZqnW0HH6otIJcOfl5sJTJd4cKjIqG/AEl+:IZ+aHKXZqnW0HHltMcC5svd4cq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684671226, "uuid": "ed885207-d4f0-4887-9053-418c33737f19", "value": 1046528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684671226, "uuid": "4d10565b-4494-4a82-b0d4-362e0edd6f42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671226, "uuid": "8f940507-fa74-4d35-87eb-9ab39f2cd521", "value": "compress140.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca4be924-f7c7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684667298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667298, "uuid": "0905a21d-d7f6-472c-a2ac-472722baacd9", "comment": "Malware payload (Amadey)", "value": "8c0d604ecea209bb725cd4826655e578", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667298, "uuid": "96c12572-912b-4ed8-b615-c7f727efc83b", "comment": "Malware payload (Amadey)", "value": "0f343b97c51df7d0e78c5f62ee445a696bafe048344ac34ac881a15842200862", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667298, "uuid": "6b46f669-7915-43cf-8875-20b1389acb70", "comment": "Malware payload (Amadey)", "value": "476c0f6f5c2fe79b4c66128d60bdcbcb96192477", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667298, "uuid": "afec6c00-8dcc-42fc-8b05-18861b2ffeb7", "comment": "Malware payload (Amadey)", "value": "0b8dcafd49fd2dcc889875a906ea6e24a0c5179ef491eb12c52b0b2cebccceea69570a9856de95043435122470bc3fc6", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667298, "uuid": "6a9dfbe1-44d7-4358-b5b4-3f0679da7a48", "value": "T16B252343FAE98073D5B517315CF603970B32BCB18D7493BA12925A6E1CB2784F9B171A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667298, "uuid": "096ed9a4-682b-4a86-b437-455c942a6785", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667298, "uuid": "05d2631f-29aa-43cc-8fc4-c5362a1db94f", "value": "24576:RyRKvkGesHtqwf3EGK1x6Gc+uhswP8pr/wIBbz:EWVtqiU1x6GcPhjP8prYIBb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667298, "uuid": "71582f80-f484-4f9e-a4ca-a26b79ec1859", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667298, "uuid": "d6fad157-0a0a-4e9f-9d64-c9cdc37d61ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667298, "uuid": "473c1f1c-4f4e-45a9-b4a7-ce0dd73b2cfa", "value": "debugger896.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7471e072-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684680468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680468, "uuid": "51bf560b-2162-408e-bb6d-fae2febb30e7", "comment": "Malware payload (Amadey)", "value": "59e091820e755ca236b560b5a784009e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680468, "uuid": "7890a2be-22da-45fb-a50d-fa6f7439ef98", "comment": "Malware payload (Amadey)", "value": "0fb67bb8ba75eda459795d6748fefd12f085bfc2892e92a33a68635b373b21c0", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680468, "uuid": "8746665f-1f01-48b8-a7ac-eff82525bc64", "comment": "Malware payload (Amadey)", "value": "32f6a8872148656d1da32c6419f954ec98fb89ab", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680468, "uuid": "3e1426bc-c692-455e-b29b-dbb360b4d05a", "comment": "Malware payload (Amadey)", "value": "c52beef28606756a45d1da8262e88afbaa6cc3ba9ce2f10c59da83413621c0991347bc81abae9ae1aee5a3f2e69df5cc", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680468, "uuid": "4eaf2269-5cb1-42ef-b407-f407166ada0c", "value": "T1F9252352B7C8447AE9316B3020F703A30B39FDE89D28977B23099A692DB35D44B78757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680468, "uuid": "19350591-b4e0-44e0-85fe-691169aaecd8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680468, "uuid": "e61fcb20-7300-4182-ae86-b96a70c9ebb3", "value": "24576:ty3acKfbmRqfqa/5iRBcZTd2JQhmh4by9nuKrkX:IqlqqXYjcj2JsmhWyk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680468, "uuid": "1b424c9f-ce10-4c88-9836-c62acf0b993b", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680468, "uuid": "70bb6c8a-a89c-450b-ba31-73de33946300", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680468, "uuid": "7af35ede-8bba-46d6-a95b-44464170ec92", "value": "423541.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f170ce60-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684680678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680678, "uuid": "63d4aec8-280a-4019-a69b-aa276063306e", "comment": "Malware payload (Amadey)", "value": "2aaf2bb8744dd08c5c0df156435b0aca", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680678, "uuid": "9a8b08ed-444f-4cff-aa9f-51e79d19d848", "comment": "Malware payload (Amadey)", "value": "0fdec1cb542d09bf1eb1cf1f8654a8119f7d7fdd9c412bec7afe9a482f184edb", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680678, "uuid": "4a23999d-1bbd-47d7-ae61-aeed14514043", "comment": "Malware payload (Amadey)", "value": "7c2294618093751bbfb77f2ec7e7a0109108405b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680678, "uuid": "41953714-4243-4d23-b592-117a48dfd43b", "comment": "Malware payload (Amadey)", "value": "7ce0fd8b1155be8367583ad96fc03ebef02ad49f0c3f46bae63a441c1600785b483d6bd78c390e18c25b9e84ee8f548b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680678, "uuid": "ef80d108-ddc8-430e-b93f-27959d315454", "value": "T1AC252303F6DEA162DDFA1BB049F603831E337CB15C28436B12456D6F0DB2A94A53676B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680678, "uuid": "a513bc85-f374-48d2-8f9c-3b793b1364e0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680678, "uuid": "07665326-0a87-4f21-8e75-e8be20e7fb5c", "value": "24576:Wy87pvRweIkdU76MJlinoaIUeCF5cxaUaNHX8OMS46nKPpUC:lUTwA63Jvaiu5cxHaVX8OMSHn6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680678, "uuid": "4e32ef15-8d53-43ce-9db8-8eabc94e1792", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680678, "uuid": "66957c06-8433-49ee-a9b4-ab17d75a4189", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680678, "uuid": "75f2e029-d575-4cf7-b47a-211fc3b536ae", "value": "token308.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66776750-f7c8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (TeamBot)", "timestamp": 1684667560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667560, "uuid": "7d7176ce-29c2-4717-8d64-d3128a9c7df5", "comment": "Malware payload (TeamBot)", "value": "9cb7d6e3d9759c5d9efbb6d934c4bc01", "object_relation": "md5", "Tag": [ { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667560, "uuid": "b76ecf22-2cc7-4b32-a880-227f6b68d0d9", "comment": "Malware payload (TeamBot)", "value": "109783a5e86b84f9afe4669f4afbdbfe7c77a52c19a843239f1b454e391688b1", "object_relation": "sha256", "Tag": [ { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667560, "uuid": "4e1a3cad-7eaf-4cf1-a883-106701db54da", "comment": "Malware payload (TeamBot)", "value": "126838f19eb730941df75e0abe8dab41f59e982b", "object_relation": "sha1", "Tag": [ { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667560, "uuid": "66a7e349-10e0-4810-87e0-56154b7b7d03", "comment": "Malware payload (TeamBot)", "value": "03db419f537e621cf193fdcf4fd8d884fab597aa79ad932895ed166bf95c644d96c8a9dd1089b3c86dceed620a67a8d9", "object_relation": "sha3-384", "Tag": [ { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667560, "uuid": "29cebe7c-67a7-42ec-85f2-3f8d5c4ecce6", "value": "T192548D22A191EC71E56686F6CD2AC6F8252EF8617F1967CB33446F7B34311E2C63A341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667560, "uuid": "d2b6226d-7c66-4b57-9af3-be910d7d840f", "value": "bb27c4958c76443fcfe46f9765d838a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667560, "uuid": "46aa7c8c-f109-407a-8321-04ee24431adb", "value": "3072:Cra5PfQ/IXOS9FUeDmGoZmrwc79Swo4P0MphDPr/LfSu1tcCxTdCkkS:0mPfc/S9hKGy4R7pFcITA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667560, "uuid": "a5bd0a0a-99fc-43b3-ba9a-da166cb21cbd", "value": 294400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667560, "uuid": "626255df-7c51-4f43-9387-9bfa006b36f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667560, "uuid": "8f76d114-c00d-48e9-98cf-69b7f9ce86f8", "value": "DiscoSetup686.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed6bb343-f7e5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1684680242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680242, "uuid": "250e1289-68c5-432d-a1eb-f3fd8e1a7ee7", "comment": "Malware payload (Smoke Loader)", "value": "d92276c84c75bd82767a295a8bda8d5c", "object_relation": "md5", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680242, "uuid": "afb7ba2d-8e9c-4b8d-8690-b40fe85490be", "comment": "Malware payload (Smoke Loader)", "value": "11325288f142cf353e15360dc916d0dfbd847a48bb747d5a3de6bc6e8ec32e61", "object_relation": "sha256", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680242, "uuid": "1c0466f6-22ec-4dcc-94d5-a4ac5e9e116a", "comment": "Malware payload (Smoke Loader)", "value": "c49b49c83fba299ed34fb0ef59227bfc6c25e743", "object_relation": "sha1", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680242, "uuid": "232ccfa3-0f3a-4f85-af1a-86f7965324fa", "comment": "Malware payload (Smoke Loader)", "value": "610901d6663e9da01e3505afd15fb0c218a09c3062bd8d1a2ed4e52845931da3bcd0433b7b572f5a9922346ebd39050f", "object_relation": "sha3-384", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680242, "uuid": "2d4106a2-ca21-4495-b0d5-1e11a2355c7d", "value": "T128547D926292FF71E5668673CD29CEF865EEF8618F0527CB22542F6B15712E3C632301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680242, "uuid": "bb186248-82c3-49b0-b875-fb90c6bbee77", "value": "40be65705a95a43e6733e98c1ce5e92b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680242, "uuid": "a129213b-92dd-43ba-8e76-2143a30a33a1", "value": "3072:guhDZF37mO8nQiaREt8w5VQ0tTW5JRpPUVn1ggGF1diurwSBYffOTo0yo:ZDZVj8nQ1Eb5cJLPY1sd7xCOT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680242, "uuid": "ed6d68c6-b266-466a-ab45-e8a00a5d2239", "value": 295936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680242, "uuid": "333c4dca-ec07-43dc-a051-203d03feecb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680242, "uuid": "a9916498-7d54-4280-8ce2-cb94145c5124", "value": "editor155.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "165bb3ee-f807-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684694484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694484, "uuid": "6a9dd7b3-8ab4-40fe-b564-17b3e675b896", "comment": "Malware payload (Mirai)", "value": "0806c4ed80188022b992cf39d2cd85ec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694484, "uuid": "4342f093-3079-4236-ae51-ce06afb3ab67", "comment": "Malware payload (Mirai)", "value": "1153327ea72ca75a0ad0d2d7305a10ceaacb9cfda4ac3ee5f03fbb0b17d45452", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694484, "uuid": "f5c08a9c-ddb1-4b4e-ba82-dae27ca0a743", "comment": "Malware payload (Mirai)", "value": "0341daa83c8b3719a1cd248d37e408062048a753", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694484, "uuid": "6e0963b7-a871-44c3-babc-9b66ebc06c6c", "comment": "Malware payload (Mirai)", "value": "656eb8116982f6448ebf9ee3084eb0182381b45baeec6d6c29edc7ac17e4d8dc28941bb1aa2f8b1f2a2c6a2f714e178c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694484, "uuid": "cc71c5ac-3355-46f8-a54e-12b73e4f311e", "value": "T157E32B56E7418B13C0D62779BADF424533239BA493E773065928BBF43F8679E0E23905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694484, "uuid": "2fd7a8f6-e86e-45fc-838a-04e0fda7b11c", "value": "3072:XWbZaLutmalCgNHmmI77/E09tc0h7TrP7C0rM/9kFA:XWbHmalCgNHmn77B9K0tTrP71M/9kFA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684694484, "uuid": "23aafdf3-3402-4b15-9fcb-2105ecd4d92a", "value": 146903, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684694484, "uuid": "28f7e4e0-3761-4634-8a48-60fc748e6698", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694484, "uuid": "b69915a5-3b36-4b0d-86ea-2a3fd45a9fa0", "value": "0806c4ed80188022b992cf39d2cd85ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3df121b-f7f4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684686588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686588, "uuid": "33f77b69-2b7e-4380-9c11-5fb23864839d", "comment": "Malware payload (Mirai)", "value": "4882ff3d8d5695131b88bac0a364d74a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686588, "uuid": "87e3187d-4a06-400d-be13-b9daf155ab56", "comment": "Malware payload (Mirai)", "value": "116d7dc76b16bc69573557884b1dddad955a02d4dd4a1f9a8df7f170c57d6206", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686588, "uuid": "32b54584-9e8c-4ad2-b3ca-82a319e4b7ed", "comment": "Malware payload (Mirai)", "value": "4c5bceba1f294c445d8f8e948eba5e748be84add", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686588, "uuid": "db8362bf-8315-4bd8-9316-68551a79001a", "comment": "Malware payload (Mirai)", "value": "c39e16f423b5bf56e9d74cd8b17e1438e0502ece5d4fe4b0839150f7c4eb3da19f34adee3d42b87d763fc7c50b3b820e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684686588, "uuid": "f95b2643-d884-45db-b8f4-b49b9dd67d54", "value": "T19B73A61ABE228FADF759823147B74E21AB5823C637E1D685E25CD5002F6134E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684686588, "uuid": "b26f04f7-49e3-427b-991a-c73d058b3158", "value": "768:/BXuHnOYFLWm1QwmCP/+P/8VEWNx5uDCtOob77SjFy6oREa76cmKhQaaykRpeDjW:M1LWm2w2o81Fy3EDiZKeHKrx6DG/7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684686588, "uuid": "e9b49252-19c7-4fa1-b8eb-854d13e5576e", "value": 73440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684686588, "uuid": "6aa310eb-9aef-4378-aa1c-b0ccbf47e7bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684686588, "uuid": "7d8a7bd9-8c83-4be8-adb4-190f8b41ebca", "value": "4882ff3d8d5695131b88bac0a364d74a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6ef31d1-f7c8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1684667802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667802, "uuid": "a5879cfd-c4e0-4097-afc3-52670daa845c", "comment": "Malware payload (Stop)", "value": "aee3d6d2cda5f96765ea45695339f688", "object_relation": "md5", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667802, "uuid": "8b81c833-c642-4ab1-a80d-fe397e16a26a", "comment": "Malware payload (Stop)", "value": "117bd105679704680c490279b89e47201550752c17e189f4902fbd93fa93d354", "object_relation": "sha256", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667802, "uuid": "6347102b-3ae7-4feb-b399-b26f8b5a7583", "comment": "Malware payload (Stop)", "value": "d430971937f7327c3e52287c0784b0952bc84935", "object_relation": "sha1", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667802, "uuid": "07089cb6-ae6a-4395-a103-a79f4f77597c", "comment": "Malware payload (Stop)", "value": "84aea797f204156e1d7ca299129b6e4f3cce21cdd680c2f3643d1cee9b2f3d21a39b8fabcebc0cc46368f85f10f2fdd2", "object_relation": "sha3-384", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667802, "uuid": "1ef9b23f-0cd1-4415-8397-3ef9473d6567", "value": "T1EE05D00291A1BF62E5214F729E2EC2F8B7FEF5514F492B9B6215EE3B14712B2C572301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667802, "uuid": "4195b810-94d6-47d6-8d53-1d8f3b71dcb1", "value": "c3945e210b1009128598ead2a7524d0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667802, "uuid": "dca83327-0449-4bd2-bd4c-d57099b00903", "value": "12288:8hE2ExrfbCLxXV9DZ1sBasNM04KAwLAInM+9LTT9WVS3ovAtUFn:uE9m9nN1L04KAwLvnVTTdttUh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667802, "uuid": "e2ba6bdd-59d0-4139-a511-7757a6ff7a0f", "value": 841216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667802, "uuid": "fbe9d119-bb14-4443-9dbe-77bd8157eec7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667802, "uuid": "1609ac0f-1472-439c-b02b-74a99a09dd1b", "value": "listener552.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e58b9329-f808-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684695261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695261, "uuid": "a0baaae2-d147-4984-aaf6-5c404cbec0f7", "comment": "Malware payload (AgentTesla)", "value": "f2dc5c88fbbd39061431626a598224f9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695261, "uuid": "887a4491-f62c-41b5-8ddc-381f074ea6e0", "comment": "Malware payload (AgentTesla)", "value": "119e0b0a9d5a8d92dde425a7968a573faf5406dd244de05f176860c0b87492b6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695261, "uuid": "9f78cc43-e649-4fea-91f9-4bce54bd1d19", "comment": "Malware payload (AgentTesla)", "value": "118752225c64c619c364d272113d735f19b1a650", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695261, "uuid": "ae4d3c1a-7ab4-432e-86d2-e0f6dd2fb8e4", "comment": "Malware payload (AgentTesla)", "value": "d93571982d21fa8d68113bce2bdf0e467cefbdcda709fe1006e63f9736ea9c1e7eb008cc81baa447e100e0cc751ead62", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695261, "uuid": "7ed37c4f-33ec-4fc4-a6a6-f81c63eaa8e3", "value": "T158F423824E42920E276A5CF4B636A41AF1FF133E5D41FDA461F48C67222CAE7C98DD47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695261, "uuid": "07dfb439-70dc-4ab6-b2ef-3f94ff1490f2", "value": "12288:oIAHqgn+Btqd9VrLobp/1bIGC5JkHHZHI5uW5lgUc7BvWwzGzKrcETOkPJiT7:oIAHYtq9V/oFBzC5JkHJDW5zcd6zELRy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684695261, "uuid": "e02a6ff7-baa3-4d41-97ee-d22d80667142", "value": 747817, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684695261, "uuid": "e30480f1-9e07-49f0-a115-37db062ed72f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695261, "uuid": "b8b0b76c-d115-467b-bc1a-3ba89e470e6f", "value": "achievements503.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0312c9ee-f7c9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1684667823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667823, "uuid": "3717f53e-337e-45ef-9578-080158927e74", "comment": "Malware payload (Stop)", "value": "2cd390076cbc21c791aeff66b5d4c5e4", "object_relation": "md5", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667823, "uuid": "5d529f95-1ef9-458c-a803-b761b5dd8ecf", "comment": "Malware payload (Stop)", "value": "11ac22a2b13bc6271e8b9e916fa5de67902b11a62a4bde404803545f74315773", "object_relation": "sha256", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667823, "uuid": "b05ec259-fbd1-4e2a-8ac0-84c8d1e0315b", "comment": "Malware payload (Stop)", "value": "fa2318438c335b86f564e4619d60ae853199c348", "object_relation": "sha1", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667823, "uuid": "cb81ccf9-a498-4eb8-9112-6c3a9367bef5", "comment": "Malware payload (Stop)", "value": "0023008e2ae09c3653ec60452acc8807f1a0eb4dfef005fa9aa8cf9992d4a4bc6ed68b6bccc01e2ad1dc6669cbb846ee", "object_relation": "sha3-384", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667823, "uuid": "c0cad6e9-990c-4e0d-b4c1-8c06ab8bc7d3", "value": "T16305E00351D0BF62E5A54F728E1EC2E8A6EFB5518F492BD772186E2B24702B2C577313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667823, "uuid": "edfff56e-c7ac-4091-9488-064e3aca4106", "value": "7de32ae9ac35dca47df77c89a634ed40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667823, "uuid": "e56331c0-9058-42c1-8f6a-df42b0d72a8b", "value": "12288:rbqxXZ34AtxTjdSlo46fr+uX6K6klVwlhAnwspTyQPnbp8A/KUF:ruX34WJU646D5z6QVkhGwKTyGVeU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667823, "uuid": "ee75ab0f-7ff9-4f99-a05f-4e1f21ca661a", "value": 842240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667823, "uuid": "cd362c7d-d72c-4cc4-9bd0-49f1a8ecf6e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667823, "uuid": "325af0be-bcec-4938-9305-a7078ed99fb8", "value": "renderer856.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12e1f110-f7b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684658400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658400, "uuid": "cfcfcaba-d507-492b-8bf3-f12155af8724", "comment": "Malware payload (Amadey)", "value": "35600946f0309fe2b8902f53fee34fcb", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658400, "uuid": "4a07fe83-f2dc-456a-9bad-f8bbd9560d23", "comment": "Malware payload (Amadey)", "value": "11c7b09e65a94fc56dcb997a9dbe40e8fa61947283b1d65b9089ac7f1ec3e3a5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658400, "uuid": "5c64a8dd-30a8-4b87-96ab-ea64f692b772", "comment": "Malware payload (Amadey)", "value": "cbd4d6c007e1d150dc8dfd50ed82ff63785a14e0", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658400, "uuid": "325f0412-fb65-4790-a72a-4f853783689b", "comment": "Malware payload (Amadey)", "value": "b16740c4e850a46c61d483cdea7c0c96d66a5e5229e10dc87da83ae4913962b83e6d959d6911b321f023675efec4679f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658400, "uuid": "5e5f159c-5acc-46e3-afa4-24575e1d43f6", "value": "T120252386BFD84033F8F92B7058F217831B35BDA2CC74963B2396A92F49B25845171767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658400, "uuid": "c494ba20-3c73-4d82-8979-fc8a0a228894", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658400, "uuid": "04ccdb2a-8f09-4d66-9243-57dd844a024a", "value": "24576:iyDNAiAHjEaUPq5qn2qIEb58J5dCT1qPf3PFm:JDN3WEaAq+2uuuJM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684658400, "uuid": "b3282c95-f80b-4740-b554-f844846a545d", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684658400, "uuid": "b53defa4-21ac-46bb-8199-0ca947c33251", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658400, "uuid": "46b27539-4e98-4233-9369-ef3d6bca1a31", "value": "AdminCrack644.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc05eb74-f7c7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684667328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667328, "uuid": "ac596ca1-e75b-486e-966b-165304a56cbc", "comment": "Malware payload (RedLineStealer)", "value": "98fe66c8e17f05de1afe7ae5d31d2989", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667328, "uuid": "75fcf9a9-ea44-41f2-97f6-992976960051", "comment": "Malware payload (RedLineStealer)", "value": "11d06957f4d1284caafc2d1911ede4d447054746ad9b409c0e8fdd987b10dec6", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667328, "uuid": "a8a45483-6606-410b-9aae-7bb47b600853", "comment": "Malware payload (RedLineStealer)", "value": "60d53203b52767daeea9981cbd8cb7a795a3d4de", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667328, "uuid": "b63a1184-1d46-4a9c-9d26-66864416bd04", "comment": "Malware payload (RedLineStealer)", "value": "c58afff6a03eba822d0952914cf8386c06a21126414f3f36cf952d80d448acee066b0c261f58f810cb7b4f3468add2e0", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667328, "uuid": "03802ad6-8dc0-4296-9976-d3c46099a8d5", "value": "T15225220286CC8072ECB57B7025FA06E30B35BCE49D759B3B2786285A59739D0B932777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667328, "uuid": "b523e8a9-f0f1-4a47-8d53-7ebaa8a6363e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667328, "uuid": "12e4a188-52f7-4fa7-b83d-c7f3b2d79f71", "value": "24576:NyMysyWcM73qENtpdV0WAnq8EyGKnKtdc:oCyWcM73qipdGWtsnmd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667328, "uuid": "6fc28f72-55d8-4e15-bfb6-d985cebd7ad7", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667328, "uuid": "40a45692-e970-4c7a-a61f-c9da919634dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667328, "uuid": "9a1cba0f-9ca2-4d57-ade3-930760b15eec", "value": "gateway122.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00b02e9e-f7d1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684671255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671255, "uuid": "86945c1c-c6b9-4eb6-acbe-efab7331441e", "comment": "Malware payload (RedLineStealer)", "value": "d8f8c912b54774554e1336e4ca08cdbe", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671255, "uuid": "38d5e651-40dc-4d33-bc72-0b740bbd3a31", "comment": "Malware payload (RedLineStealer)", "value": "12461a8ab9de4e08cf2a379eb7aea4dcd50abe4dc211c97f56c97fcc23b401be", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671255, "uuid": "eee581f0-74c7-46a7-aa33-346bc5eb71ef", "comment": "Malware payload (RedLineStealer)", "value": "30e6e4e11f3ec030590cb4710fc6870541d392b9", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671255, "uuid": "ce6a209c-0b7c-4e3d-8ccc-ee4bd7b88e96", "comment": "Malware payload (RedLineStealer)", "value": "0ebc6cc66411ef9da2839237f9b9e44335cc607d129e7d7dd445efe2ccfa19cc1881c5a6a3dd5899b810724c88e3b2b2", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671255, "uuid": "786f6c58-cf38-47bf-a040-d40381b167dc", "value": "T1FC252203B7D896A1DCA2677089F643870B25FCF386B1436B2365954A0D729E17A3373B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671255, "uuid": "b200fea2-bc20-4772-9386-41a7b67e7472", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671255, "uuid": "702d86c1-a142-427d-83e6-af20fabec928", "value": "24576:lyrcG+50Kys1DkH070qP6pFGYORfDrmUsLAP/htHspHTMi:AfT9rH070qPyFGYOlQsP5tMpH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684671255, "uuid": "65be96ad-0938-4051-a928-b2c5be6a0731", "value": 1046528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684671255, "uuid": "e4149d1c-52bd-47dc-b149-d0d218ac2232", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671255, "uuid": "c716b9ea-0853-4078-987c-14d1045a5feb", "value": "report929.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7e794e1-f7f4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684686594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686594, "uuid": "dd622a28-211d-4e9e-b859-7bb37d86c8e7", "comment": "Malware payload (Mirai)", "value": "ebed097adc2c24d9b061b9aa95d4bede", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686594, "uuid": "7acd9b17-e0b6-40e1-9475-c6f91d0ffde9", "comment": "Malware payload (Mirai)", "value": "1250b748c9b18095d89d0c7213b54818b8a9728da26495998fe2ff4255c895cd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686594, "uuid": "3368206e-a4e3-4cec-8331-1a11436d3644", "comment": "Malware payload (Mirai)", "value": "e76811f7ea44d1103a3240830b0eb456f03c90c6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686594, "uuid": "e7adfcac-9147-4d66-ae65-04a95a7b046b", "comment": "Malware payload (Mirai)", "value": "4f138414032ff3d79ed311510e820ed831886f5cc9691e744c74837b7426c1a92a50a67d8ec6c8c11a130e8733203111", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684686594, "uuid": "bbea8850-b8f7-4b3b-82a2-6f11af135b9b", "value": "T119D33B56E7408B13C4D61779BAEF42453323ABA493DB73065928BFF43F8279A4E23905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684686594, "uuid": "b771235f-8b6d-4bac-890e-bcd0e4c21fcc", "value": "3072:KcsCNV79eXOxag9m54TY2vsaGkn6tx6PzAHSM/9EZZOZ/:KcsCH9jxag9m54soscWx6PzAyM/9EZ0l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684686594, "uuid": "115591f9-58d7-4911-9af9-dfd0a61c24c3", "value": 141739, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684686594, "uuid": "cb339296-db5f-4b75-84d9-f0e77a4b24f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684686594, "uuid": "55ecc279-5e3b-4eab-bf78-4d9684ef9dec", "value": "ebed097adc2c24d9b061b9aa95d4bede", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29c2423a-f809-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684695375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695375, "uuid": "b17af377-e748-4ea1-b75b-e8e46f31bd62", "comment": "Malware payload (Amadey)", "value": "7ca701e1e9b7076fca0b8484313ecef4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695375, "uuid": "7b470ae7-4023-41de-81ea-de34b146e877", "comment": "Malware payload (Amadey)", "value": "12a0f4f89563fe7b467112233830d66cd0f119f5e7076a4cadc0e499cdf78117", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695375, "uuid": "39c28217-b7a2-4304-97a5-93f5982c8dee", "comment": "Malware payload (Amadey)", "value": "c0e9fffa915e67c568b7a4ea6f482b5847643952", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695375, "uuid": "5773ac51-b65d-4170-bd9d-9c6d8cb2ef50", "comment": "Malware payload (Amadey)", "value": "28e3122aa39581c1c379395eb20c6fbf49241c0ff3214908f5f51ae918cc4eb1f6461af4f1f08d8ab4c1fe28250b8732", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695375, "uuid": "40048202-d8ef-46e5-98cf-285bd8a4f620", "value": "T1C3252343EAEC8636EDB9233409F7126329317C612DB8035A4B52964E4D73691FE3277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695375, "uuid": "5d2ff7b1-b18a-4771-965b-f9927e6bef74", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695375, "uuid": "3db42611-975a-4b33-9502-5cb0a56060f6", "value": "24576:6y+cI68jPfV/e/XryZk51uAU6nvVc0UF/+mi:BxT0toUyni3pN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684695375, "uuid": "82b80537-c1ca-48d9-bdab-e8e1eb8f4b42", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684695375, "uuid": "b9c7a962-096d-42ef-8840-cc4cc80ff064", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695375, "uuid": "91d0c34a-e3c1-40c0-8986-48b32b0485f9", "value": "world682.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff66e7c0-f7c7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684667387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667387, "uuid": "1b82155c-fdc2-4e6a-9a5d-3d985b851a6d", "comment": "Malware payload (Amadey)", "value": "1ad142fbdb6c7e8c84d22795d05365dd", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667387, "uuid": "ea6fc87a-0850-407b-8c6a-996bbdb3cae5", "comment": "Malware payload (Amadey)", "value": "1304908dce2af91cb5befb4dbf3a8075f81fa3a57f0d2aa0b3d01a22a700830e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667387, "uuid": "c021754d-0eb5-4b8d-b162-3f42ad5faffe", "comment": "Malware payload (Amadey)", "value": "ba224b4e725d9348290a291d2a172af79fcaec4f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667387, "uuid": "f1645844-ccea-4b58-8457-bea713b6aa7a", "comment": "Malware payload (Amadey)", "value": "feb9f36890ad8f8011156ec575d7ecc759e40e119f58ad595a970e8b07ff07d5efca796f290f8d132a43aa98dfab5d33", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667387, "uuid": "97eea344-596d-4b75-8993-47fde57742bb", "value": "T163252307ABE65432D8A52BB45CF702C30B35FCA06D7C821F6A52A85A0E73991B57077F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667387, "uuid": "ec54a3ca-25dd-43f9-8bd7-b9dfb42c3f30", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667387, "uuid": "9115ed38-22c5-49d0-85a6-f47690a6b024", "value": "24576:TyL3OUWxnZZq5osboPUJxBjPUheUwp9T4etCUnTypPfvOl:mLeDZZaoiBD3UwvEetdTQf2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667387, "uuid": "9d39ddef-4938-4386-a21f-c629780d648e", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667387, "uuid": "e24e8ca6-df73-431f-ae19-54838d012c02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667387, "uuid": "da117734-abef-4222-ad64-cc9eb52ddb99", "value": "reader918.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f493f353-f7c7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684667369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667369, "uuid": "f20d72fe-b9d5-4b9a-a47f-9c6b5147603e", "comment": "Malware payload (Amadey)", "value": "2cf4c092046553a66b667af638f1e436", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667369, "uuid": "45b07872-dcb7-4f49-8efa-73d1da3c39e0", "comment": "Malware payload (Amadey)", "value": "1324d03cb0a805bb0cb7672240abdab250217f2c40160e6a85261a850b863bd1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667369, "uuid": "fbe57df3-48b5-4441-925b-e57a160cb36e", "comment": "Malware payload (Amadey)", "value": "ea50d774632ad64552c95b88b790bec799bab83b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667369, "uuid": "5e1bf016-8e72-4b14-bf3d-69420a00690f", "comment": "Malware payload (Amadey)", "value": "eb046b77d3e59edd993120d2d3352e5869d141612d3fb880c00bd853ed25ee0b4bf5fb68c26c2d61ce447949b81a4ae5", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667369, "uuid": "a64be04a-d10d-4c68-82c1-c6e6cae678a6", "value": "T188252352BAFD5032DDF91BB048FC1B832B32BDD15865C13B0B01594B5EB2A449A7AB73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667369, "uuid": "4570a417-b746-46c7-ac76-7331c57d617b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667369, "uuid": "86ed2db3-6291-4b7a-9c0c-4408ea5892f1", "value": "24576:SyCeK7gUODjqy0c7AokIpUKhKp2HnW4mmVzH/:5CeygDjqyr7Aok/Q24mWzH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667369, "uuid": "25a9c293-b8dd-4b91-a6e6-5f7cd72528df", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667369, "uuid": "0325ea2b-e042-4892-a9f3-380637960b3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667369, "uuid": "f5a565cb-c594-4299-adfb-5276877919ba", "value": "patcher633.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d4f3f59-f7c6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684666793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666793, "uuid": "5f60dae6-e89e-4304-b270-add42ba9ff35", "comment": "Malware payload (RedLineStealer)", "value": "d8f9722a964d025549004b849d952e1c", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666793, "uuid": "4d572c01-8ad5-4c69-b83c-66b43fd286d9", "comment": "Malware payload (RedLineStealer)", "value": "138de232a10152679ce7660a6021e159e5ee18721080de825ce4e4b684b1974e", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666793, "uuid": "545a8e36-06f6-4d15-95f6-d989b578a7eb", "comment": "Malware payload (RedLineStealer)", "value": "4714d5c42dbab10a2469facab5eecbbee20255f9", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666793, "uuid": "8e7f8ec7-c96e-4ba5-8772-8e70c7f9531c", "comment": "Malware payload (RedLineStealer)", "value": "872d1c4a28f746a89ed08f17692918c53df9e1f48b91ca09e15886d508d976e9c9df8dd23f2cec241bbf4474c70634b7", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666793, "uuid": "9464eb0c-df18-44d7-9542-6ad0b6082413", "value": "T115252312BBC85477D8B02F3069FB02D72A3ABDA26A60C65B0B557D1E5C732C0B635367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666793, "uuid": "d427d9da-0b39-4ed7-8b4e-d60ab680c168", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666793, "uuid": "26ed4410-44ce-4a0b-ac26-01e68cd2df4a", "value": "12288:YMrJy90YImMXhyxGrhw71ys1LTcDvb+BflUX3HidEZG765JeSHWV5xxzGTMvi2Ob:BytIJhyxGux8yflQ3Mm8V/xGTMqh7dh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684666793, "uuid": "52118115-babc-4b50-abae-fcea734cf0bc", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684666793, "uuid": "3e0a1e74-a4b6-43b5-8e9f-8686d9df1f74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666793, "uuid": "01a9a225-255e-48ba-ab9b-edffb8fa52ab", "value": "registry278.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21fa969d-f808-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684694933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694933, "uuid": "7ecde807-4ce1-4ca8-9d34-54fcd5198237", "comment": "Malware payload (RedLineStealer)", "value": "df571bfc4b733a2dbb4d94231bdcea7c", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694933, "uuid": "6801aac0-4174-4eef-b90e-6e8214b4275d", "comment": "Malware payload (RedLineStealer)", "value": "1433a6eead658686d71a5d967a68dd4f27ec55cb026526f6c61bca67d96920d3", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694933, "uuid": "108cea2e-5bab-4792-9d17-6741dbd01a68", "comment": "Malware payload (RedLineStealer)", "value": "0aef9f3b8d69dff62e401e2324b3dfbbcfdde9f7", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694933, "uuid": "7a9fd213-8280-42e9-bc20-74572961b600", "comment": "Malware payload (RedLineStealer)", "value": "6db12e374daaaa84cad32aca466e96833e0a3fa25392eaff862ad2e0a63762c94dbb9d891c9e42a3d49c59e821f45bec", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694933, "uuid": "fdabf261-819b-46b9-b8f6-160a6b2817e7", "value": "T188E3D624279F8930D6BB4E3D6CB19CC076BCEC12A542D74A4ECCF5593A73B809B116B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694933, "uuid": "03d86311-bac0-4413-a6c6-14439db0953d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694933, "uuid": "79fe3e4c-86a4-4b56-9f24-485c1f7a2eb3", "value": "3072:2V+m5cNQmRSxWWAcP+DDXedh7Z58e8hk:2jwCUudh7z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684694933, "uuid": "928d7d3a-6a0b-47e8-a39a-4eebe2151d5c", "value": 148816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684694933, "uuid": "6c1a4925-426c-42ed-887c-d890e7466984", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694933, "uuid": "ce271adb-2d3f-4ede-9745-22f691d36a82", "value": "saves694.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caa7210f-f808-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684695216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695216, "uuid": "502560fb-9ec8-40bc-8244-11d2b5baca00", "comment": "Malware payload (RedLineStealer)", "value": "fb9d8a953a851ddc1cf9f23275bab493", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695216, "uuid": "3777ae7f-2cf6-4ac8-84cd-c499fb209e65", "comment": "Malware payload (RedLineStealer)", "value": "1450b8cd2a6bd9509294447efb5f0290a27d95ebbb57ac225ca14fa46ea4e6ef", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695216, "uuid": "208f74a2-d463-4f1e-b427-55f46a542891", "comment": "Malware payload (RedLineStealer)", "value": "7d864566d8de0aa4d19d0c4b678b28e6e11302ef", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695216, "uuid": "7a22b03b-fd65-4a37-80c8-96ab874558d8", "comment": "Malware payload (RedLineStealer)", "value": "30896b1bdf37b9b810b5d2dffa4c9001fa2c6864196f74c7eb3301aed71ff6fc32f55ce9f431d6dcac6c8ffa7562af9d", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695216, "uuid": "1d23348b-173f-4bd1-9253-cf625561d225", "value": "T1C2252357EAD88577E5F52BB44CF603931B383DA1E8B54302670645AB18B3AE0B93437B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695216, "uuid": "695a329f-78b0-46af-aaeb-3088d5dfd892", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695216, "uuid": "06c10a80-d6cb-4dda-bff3-c12cde631814", "value": "24576:1yWjp4uK/LYi0pjhEZpNu0QN482swL10B8u0u7U5DYTx+/x0:Q0p4L/B3pNmN4/sog7XTxm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684695216, "uuid": "e4576a35-e2d3-4798-9242-fb672bf4e718", "value": 1056256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684695216, "uuid": "9f33669b-8dd3-4a95-a6d3-c93c8c8ae655", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695216, "uuid": "dba5ef3b-26ed-4a49-be08-5e9b3bfffa7c", "value": "32332363.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e76480a-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684680458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680458, "uuid": "908326b8-e851-4138-b6dc-c1e40d960d34", "comment": "Malware payload (RedLineStealer)", "value": "7338bcb03d8a04ed60883d2dd14a3cc2", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680458, "uuid": "125e704d-c0f4-49c1-b326-19bf402246d9", "comment": "Malware payload (RedLineStealer)", "value": "146c894aa71c2078a04657f9893ed33597acfc5e685d20aefd2742d1f595d1f0", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680458, "uuid": "126906ec-70b9-4bf1-a549-a3bf475116b4", "comment": "Malware payload (RedLineStealer)", "value": "624fc9e5bfe119e0db423db8ddf12bb173ddea23", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680458, "uuid": "b164d79f-810b-4415-a1a4-144801bcbe11", "comment": "Malware payload (RedLineStealer)", "value": "5cc745bb21f0d389186678dcd738bd4fcc6df0d49b4248240c20372ef5423912d364c31c766a73057143bcd28ba7ced0", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680458, "uuid": "cefdfbc6-c91a-43fa-824f-99966bec2567", "value": "T1FB25230367E44131CA751BB184F907970B35BCC69D74A22F32D9A9CE1CB3A41FAB275A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680458, "uuid": "f0aac567-e541-49ae-8ad6-c3253e1fca1f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680458, "uuid": "5738cbde-a92f-4292-8590-2cf77bf4c9fe", "value": "24576:ny5+HbRQu5RZuhvdnwICqdsRGDxCDKofLch:y56VQuchvdwI5K4x4Lc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680458, "uuid": "2bed17a8-e0cf-4a8c-8902-6feac6d9c9ef", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680458, "uuid": "24c36bd3-e65b-4f16-9516-1ea9b4bea096", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680458, "uuid": "7f8b1ee1-3727-47f4-86d8-3b96b0f266dc", "value": "353512807.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d09592e1-f7c5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684666449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666449, "uuid": "a2bf1cbb-2585-4d92-bbb7-6ed75179c0ad", "comment": "Malware payload (Mirai)", "value": "61e824bc400a15bddea2dd5a0f5e2054", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666449, "uuid": "b4c83e97-c9f7-49e8-ba7b-cee0034952f8", "comment": "Malware payload (Mirai)", "value": "1488dbb3a008f457ff9c98689f0c95478255b574d33431eaae8ec2fcea7804c8", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666449, "uuid": "249bd9e5-3132-4db3-a558-a5dbd5cb7aa2", "comment": "Malware payload (Mirai)", "value": "f4e1e6e17fca5c7d2fc3ea086ab2c618da021e09", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666449, "uuid": "4d9249bc-c4e1-4520-9203-6901e3bdd06e", "comment": "Malware payload (Mirai)", "value": "1174bdd407ffe585b25597a69bd6c1a03d0feac78ec6ef35f05d87f879bebaf129e5c9ed431fcb9d502ff0af001e6090", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666449, "uuid": "6ee1da12-b5d4-4381-8bc5-79d7982e6452", "value": "T1F5634A07BD8086EDC089E1B802BF7179C056F1BC277571CB6BD4FF2A3A15EA01B69949", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666449, "uuid": "f5fe09c9-0289-4132-bb10-600a134842bc", "value": "1536:Tfu73WGGE0DUm8lquk5O7eGdkmM1b1ce48/yUVf:6Z10DU3lqVRCkmMB1ce4HUV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684666449, "uuid": "6f693fef-8037-4b4c-8f02-97b7968ca65a", "value": 68512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684666449, "uuid": "0feb7b7a-d8e7-45f5-ad93-96b2cfc780f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666449, "uuid": "46a2cc35-6451-4d00-8408-f769832e0eae", "value": "61e824bc400a15bddea2dd5a0f5e2054", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bfc86f8-f7bd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684662684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684662684, "uuid": "973c38f1-7df2-4c31-afdf-49e1f671d064", "comment": "Malware payload (RedLineStealer)", "value": "676241a9b86983e713d21e5854b368c3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684662684, "uuid": "34eab110-a9e7-4777-9114-8e1ea09a970e", "comment": "Malware payload (RedLineStealer)", "value": "14eaa5abc921931a75c1496d523556a91f9c9ff436dd9d1d1eb8dad74d7929c5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684662684, "uuid": "ad858129-8638-4615-8dbb-14effa2b639a", "comment": "Malware payload (RedLineStealer)", "value": "8a88c56656f8feb17a5a51b0e377466b35a7ccf8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684662684, "uuid": "73d7c9ca-77f6-423e-9fa0-33b45cb17d23", "comment": "Malware payload (RedLineStealer)", "value": "9052886c43e3ffaec91cd0c2ba204b9a2bf96d99f9ef18f409ad3353db0832b4c44f261549e3f880afe942751a03cbb7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684662684, "uuid": "9090a3ca-9a40-4034-b3b0-b86eebfe0c4e", "value": "T1CB84AF42B293FB71E56586718E29C2F865EFB8618F152BD723586F6B18312E3C933701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684662684, "uuid": "01a67ee1-5334-4074-a757-d019b71200b2", "value": "c37a1f908dc8ba7c67223959bc2021cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684662684, "uuid": "690311d0-4e56-4659-a941-cb3b02b6bcb9", "value": "6144:0eTiYRMdeqmncNi+p/HpttKG3TRzFKtDozT:0GMtmYLbTCW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684662684, "uuid": "feabcddb-caea-41c8-b377-f55130582656", "value": 375808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684662684, "uuid": "837355d8-98bc-4aaa-9bf4-94b270ac15d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684662684, "uuid": "6a0cb152-14ed-4c9a-b5f7-cc2b87f8a5f2", "value": "676241a9b86983e713d21e5854b368c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9853c7c4-f7ed-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684683535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683535, "uuid": "1eabc666-dace-4b9a-92b8-17c5bc8a0748", "comment": "Malware payload", "value": "2aee70961638ab675bd6f4d58a986124", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683535, "uuid": "41f611c1-a6b1-427f-840a-762d6cfd0bf4", "comment": "Malware payload", "value": "154ef383c16545e9bbd58c2549a15cdbacd1ff6417709ebf1d210c70549750b9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683535, "uuid": "b21d0438-3a03-4584-8fc4-dc80b8b847de", "comment": "Malware payload", "value": "d1fa26ef42fc0b12331934c54a76caecbc096dff", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683535, "uuid": "2dc45374-c55b-4af0-a4e9-1af1fa844f56", "comment": "Malware payload", "value": "2c94eca6064d04c332b4895b5e43d0b229841592268c2c8aa30b89ad3411c85b5b3c96dd62e44ddb20cd779cad6f5426", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684683535, "uuid": "47205f78-0e55-4e2f-95aa-1433b456b9b0", "value": "T12E1451047F515FF7F4A5AC36C6DA1BE63C7CE41120893FB06C1CE4A6F12698F18966A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684683535, "uuid": "69fa9749-b395-439d-9d1e-b8e8e8314013", "value": "3072:/lR+M5gR4VugNoeKN0AaTdNZ997zErA+JyDgm:/lR+4gSVugN+Mr7YrAeug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684683535, "uuid": "964b5660-dd71-4a72-906c-1582f4e9b861", "value": 194712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684683535, "uuid": "024dc65e-6cfe-4a60-ab7e-a745ee2ceb4a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684683535, "uuid": "26de7287-8e4f-489d-a619-85534061b078", "value": "2aee70961638ab675bd6f4d58a986124", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40f2cb3e-f7b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684658477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658477, "uuid": "669338f6-7575-4c30-b79f-f22cc6eabb43", "comment": "Malware payload (Amadey)", "value": "da96083df6a5fb17a71f941b3480a51d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658477, "uuid": "d22fc4ad-343b-4ebb-95ba-ee9e12808cae", "comment": "Malware payload (Amadey)", "value": "1550dcab3a419545bbb2f857294cd213055aac21242bdf457b73a438ebef2358", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658477, "uuid": "dee30538-8017-4731-b3ba-c964dbc1375b", "comment": "Malware payload (Amadey)", "value": "c7ac0c4c51d6b4a646c022edbd1897e8543e4492", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658477, "uuid": "6faa4579-d7c8-4137-a8c3-c3e7b8275754", "comment": "Malware payload (Amadey)", "value": "44925a2447ae74d5ec64757b5b3d2702bb86b263a2c472805d2e93d3ac74ad2bd1c79a570fa8870d30cd16f75a963db8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658477, "uuid": "356483b3-c77d-4de8-afa5-7c0f6952cd8d", "value": "T1CB252307EBD8947BC9782B7069FB4A970E31FC80BAB4661A3341EE650C72190DA75737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658477, "uuid": "c7743b70-a8fd-40e0-afb0-874258713a1c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658477, "uuid": "1d52ff43-0950-4128-9b67-c1f2ba26cffe", "value": "24576:lyt4W4PM4hZn+NOdtqUkbGOh8y9GaQuJjv+sl6ynE:AaFU4nnlqUkZV0A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684658477, "uuid": "ba8e95dc-ccb9-4516-ac06-62d06663911a", "value": 1053696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684658477, "uuid": "8d60bca3-245a-4b94-b81d-7dc01667c121", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658477, "uuid": "b1aca204-a145-47ad-9c4c-48cb4ddf4256", "value": "registry238.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f90f944-f7c6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684666689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666689, "uuid": "0fc9d488-dca4-4e47-9697-aad1eae5d1f2", "comment": "Malware payload (RedLineStealer)", "value": "a00d0f9a28143a80951e3640630634fa", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666689, "uuid": "5a6f2236-5777-49d1-9311-6eae440ff7fe", "comment": "Malware payload (RedLineStealer)", "value": "15b0036f4875ca0d441796f32d8884f928fb4940a12ccbfb13ed54d776ecd6bc", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666689, "uuid": "0cbef090-a258-4bda-a50a-8540c3544f40", "comment": "Malware payload (RedLineStealer)", "value": "f8c9a1af04fa15c7525d68c989e83c3686605e49", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666689, "uuid": "59563acd-5613-44d3-9081-599b431cb6f1", "comment": "Malware payload (RedLineStealer)", "value": "f26fcadb43932d5ee6869cd2a8b9b7cdf8d90db14f6f18678e8e25501c658f247d62c1802747cb88981ea9c7b0c54dad", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666689, "uuid": "f21035a5-d2ee-44fd-976f-bad82d0717fb", "value": "T1972523536AC40173DA752B3044FB09D3173DBC609C38926F2B68AAAE5CB77845EB171B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666689, "uuid": "f3bc4ed1-27b1-4a49-8865-6d1e2a06e2cb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666689, "uuid": "d30e9059-dbcf-4957-98da-7fd1dd12921c", "value": "24576:9yz6oH+oWCMqBQHMGXKI9KdEwXeSrg+g/hRq:YGu+oiqC5XKSzwOSrFg/h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684666689, "uuid": "1788d85e-810a-4317-a782-38b10a5c1c26", "value": 1054208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684666689, "uuid": "4b8638a2-0610-423b-a31b-df9345e4c49e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666689, "uuid": "b7cb4f98-c169-4ba3-9e7a-07607e4871bb", "value": "patcher523.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "808d75c7-f7f3-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684686072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686072, "uuid": "e5f7b247-321e-4772-a0a0-cfc2a97ec010", "comment": "Malware payload", "value": "cbfca6bac76bae78506b23ef0c5f2a20", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686072, "uuid": "b88d02cc-458e-4ca4-8e75-03d250099f8c", "comment": "Malware payload", "value": "15fedc86e87841c141b113efa635ef5b7d28f7cf906597a60354cd2d3ba85e3b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686072, "uuid": "71648e56-d9b0-49ab-9f53-f932ff813d80", "comment": "Malware payload", "value": "ec0998d7e46b457432a4de49b3dc8330ae892254", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686072, "uuid": "82772ff9-75df-44e4-bb42-3fabb71db269", "comment": "Malware payload", "value": "2b7291aebe654052477957d3e01fd5a674669fae51b5c3b8a9bec7fb43c59796d2ed84917884d598e58f8facc622f4a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684686072, "uuid": "3ea9da3e-92a9-4389-8a70-2537fa63cc62", "value": "T10BD439817BE8DA57E2BF1779D47248015B70E04BE7A2D70F68C061B91CA2B806D177BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684686072, "uuid": "1d1b1ed9-7d2d-4d55-962c-3dc5d06f9bd0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684686072, "uuid": "adfca407-42f8-4fdd-b275-d696f2a699af", "value": "12288:q5uHsKs5FNFfcaFeFOFwcGF6cmFWc0FWc8cIcKcUFJFpcNcHc7cbchFFc5cbc1cT:q5GTD+b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684686072, "uuid": "adb41b71-f79e-4439-86d7-c5c9575e6270", "value": 599552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684686072, "uuid": "979c7200-e278-48e9-a748-d72b0e389020", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684686072, "uuid": "44fec022-a606-4daa-943d-4a9ed2a2cad0", "value": "build2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b0cf31d-f7c7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684667192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667192, "uuid": "561554b7-b49d-4cdd-940e-30d05a6c7656", "comment": "Malware payload (Amadey)", "value": "66b853fbe3672bf7b50ec8e63e49687e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667192, "uuid": "5cac0273-eb48-444f-9381-7146fda1d945", "comment": "Malware payload (Amadey)", "value": "160cbbe6e825a192f411d5edec6884c84684d5ddecb6e4f58b695a1a673b9e8e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667192, "uuid": "ff10231a-92d5-4578-9e8d-86ebd56fe3e9", "comment": "Malware payload (Amadey)", "value": "b3a099b1e884a3ac942e198bab72830ef36d4654", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667192, "uuid": "2ab61cb9-e013-4528-a3d7-6690a8b0778c", "comment": "Malware payload (Amadey)", "value": "a0aa18c060b69cd3f0c210ad3efa122ceeb20c6d44325ce5d010d3ff026f92676208b882a1b1666690b0d5145900fb73", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667192, "uuid": "0e4c63f4-29e1-4f17-89c5-3e351bee582c", "value": "T1FD252316AEE58062EDF4277098F703C3073ABDA06E75DA0F2795E94A1D718849631B3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667192, "uuid": "b9f0b17a-773d-4548-bef6-f73acda3f390", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667192, "uuid": "371bffc3-81ef-4d73-b27c-e36c7b024566", "value": "24576:9yyjR6w4NuTXWn4qsQblXHqK9flHgd/ckAsGkkoA+:Y20MTXWn4q9h3X9hI/PGkg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667192, "uuid": "2bd501ea-137c-45a5-b0d1-e06cacda892e", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667192, "uuid": "74638da3-96a6-4950-9e48-28d23973eef9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667192, "uuid": "8a9f807f-5c11-4f8a-a5a2-f65cc649b03c", "value": "1212324758.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d843ccb-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684680457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680457, "uuid": "588f7554-e311-41ba-b225-c353b173613a", "comment": "Malware payload (Amadey)", "value": "6e0877bd751feedb8bb5d8492797818f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680457, "uuid": "bbc150f0-7b08-46fb-8477-43fec7ab64cf", "comment": "Malware payload (Amadey)", "value": "16289c61f33d8ed03c39e73f8d45d562dea33739bf2a00d2a71c4db944c85efa", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680457, "uuid": "441583d4-ab6b-494d-8bad-e7e0f1eabd51", "comment": "Malware payload (Amadey)", "value": "cd283db75daec8a739328dd22c2bc22ffb7b5eb3", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680457, "uuid": "acb4494e-959a-4399-993f-4106ce50ae74", "comment": "Malware payload (Amadey)", "value": "587fa525228f9a5d449958152419c0feb616479d27bbfbf242df0eb757bb36ed8125cafea6b805916f5e94ddf4fe03cb", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680457, "uuid": "11db09ff-37aa-49f4-89e3-6e66c56adaac", "value": "T1E6252383E7E99467F9B017B014F943930B31FDA17976406A2B81A51D0CF3AC5B9363AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680457, "uuid": "d12c204e-7e94-46c5-bb01-b928c18fcbcf", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680457, "uuid": "cf8a9fea-472b-4e43-a29e-c7485d028554", "value": "24576:WycwaavV5AgKtvWbfIQR0p3mjGoI2JkowsjT9r:lciV5AggubwQR0kGF2yorjT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680457, "uuid": "a10e9cf7-6467-48cd-9966-5d2833e09dad", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680457, "uuid": "27d36b22-5a09-4d26-88a2-8dc2a363193c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680457, "uuid": "326ba4c3-256e-46d4-85f7-09c8d28df9e2", "value": "32332459.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b377d3e0-f7d0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684671125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671125, "uuid": "7c53b65e-b2d1-4d6e-a73a-516fe13c3e86", "comment": "Malware payload (RedLineStealer)", "value": "5aa3f39c726a0eb2cbf1ea7fa7eb5222", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671125, "uuid": "c579bf80-db65-45ad-88a2-187178155070", "comment": "Malware payload (RedLineStealer)", "value": "16359174b55cc88e9a4266f86dc5e5c9ec8247f94ea1e2d0da641bdbdc2c5636", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671125, "uuid": "77dfc0ca-5a2e-450a-bb58-88fecfde7f40", "comment": "Malware payload (RedLineStealer)", "value": "d680350cd4583614b34b307a280e6cd8ff93a8cf", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671125, "uuid": "b842f3be-2067-46bb-8529-b45bf2763747", "comment": "Malware payload (RedLineStealer)", "value": "a9bc23eb4ab60e558effcdad76d9fcc9628c9b5004567c612fc123c9ace503d2cafa8d9daec45334f9abd890a002fe07", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671125, "uuid": "a86cd599-530b-400d-846a-ed6e2cc6d38d", "value": "T16C252312ABD954B3ECB617B054FA02930B35BCA15D38537F2784B94B6CB3598A9303B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671125, "uuid": "1f9764f1-6e73-4ed7-8326-44ec44068179", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671125, "uuid": "52353600-20d3-4cd1-b80a-d02c870a9e08", "value": "24576:Hy2R3BSYU2twq1DAnki6F2p0OdGyQovTXnip+:S2lB32qVAk32S6Gy1TXip", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684671125, "uuid": "2b26a90a-fafd-4b8c-8f8f-03432c6f9609", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684671125, "uuid": "6048d37c-0a81-42b3-a0f4-18f83c82f2e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671125, "uuid": "3c52d36f-fb41-4f35-ad41-f9d55ec1552c", "value": "report795.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6df85a20-f7d0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684671008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671008, "uuid": "a11a51d5-bcea-4c65-98d0-9ccbbf54d833", "comment": "Malware payload (Amadey)", "value": "a20c48ff24ae46b67d8e77811f1abda0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671008, "uuid": "39d8a7a8-22f3-4454-8c4b-94028304a854", "comment": "Malware payload (Amadey)", "value": "165109064443b6a47403335a6d8c7b090259c14375ab137f3ffd4d1338a34634", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671008, "uuid": "39bcf1f4-c851-4ec1-a23a-70c7a528d3c8", "comment": "Malware payload (Amadey)", "value": "ce4d23efd63c72c322260e746c1cfb6cf80e0021", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671008, "uuid": "ab77768b-99aa-4344-9a36-cd6178a51b54", "comment": "Malware payload (Amadey)", "value": "026e14e373f7af1e77871adadd59aa89bad54382f1820e30f1bc520961e8ad3b67cab29a6993d0d4faa7ec951ac5299b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671008, "uuid": "eee651d4-bfee-43e5-98ae-d7b9245ac0f8", "value": "T12B252342E6E45232C9F42B740CFA02D70E317D96ADF4C39B2781A95A0DB2F85AC35776", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671008, "uuid": "760d1d97-89f6-4c7e-8c97-376747acc4f6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671008, "uuid": "a7da13b1-d21d-4d0f-a665-c9ac3576dad1", "value": "24576:XyhqasUjnF2M2OzjsOFrGgC/VB8pyOnLmJpJjBOWL:i4UjFLXwOYgsuopZBOW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684671008, "uuid": "15a8f45e-a03e-4c40-9258-1146def7e8d2", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684671008, "uuid": "5d25b82d-7fc5-4d50-b5a7-c8f03128a3ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671008, "uuid": "982e0362-2801-4155-b57a-057cf0b76025", "value": "UI256.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f6d57af-f800-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684691519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684691519, "uuid": "f31746bd-0e3c-42ae-b63e-6d213ec410b5", "comment": "Malware payload (Mirai)", "value": "09263d03b0b57e37127c004ab67da601", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684691519, "uuid": "2528932d-6844-4a3a-b5b9-856771814551", "comment": "Malware payload (Mirai)", "value": "1790d756ed58837d8af82d4463a064cb50f2e9a3742a75bffe332b0200f42151", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684691519, "uuid": "efbf9d06-e363-4d78-b24b-ef71da3096c7", "comment": "Malware payload (Mirai)", "value": "db2b185eabeb14b6798bb1a8e5df0a970cd588c0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684691519, "uuid": "e74648f4-de38-4627-89c6-5c8723281695", "comment": "Malware payload (Mirai)", "value": "67ecb15eacdcb470dab44325d1b5bc180f229a70cf394178cf3fe24e46ecfefc6603f5cf4d504f0f5d2a3958ec709652", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684691519, "uuid": "6f01bdb4-d7a3-4899-bd1f-98863702b4e5", "value": "T111734A25BE352D2BC0C4A67B21F74720F2F6639E2574C61A3C750E5EAF24B4026533B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684691519, "uuid": "a30cb2ba-ff0e-476b-9cc1-2d79af526d8f", "value": "1536:nDSSBvbIMmwcGQhq860BY5GWNslk5Zt+YY:Dnt3Pj860BYtNslUuYY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684691519, "uuid": "f5dbb796-5f90-4efe-89d1-1f4e872a5605", "value": 75280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684691519, "uuid": "3abd639d-c121-43c0-accc-5063cf09831b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684691519, "uuid": "bc88cbe6-b93e-42cc-8967-808bff0985aa", "value": "09263d03b0b57e37127c004ab67da601", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01590087-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1684680275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680275, "uuid": "861ca82b-dbd4-47f4-8eee-705ad0d7dcb0", "comment": "Malware payload (Stop)", "value": "9a8c51a212f4e459593cdd7f833d06c0", "object_relation": "md5", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680275, "uuid": "d7d476f0-728a-437d-bcd3-17db7132aa2a", "comment": "Malware payload (Stop)", "value": "17e627f0cc8314de0c16f1a7bdbd1c21e3694a73b9b81845c4ca76d47a0e04de", "object_relation": "sha256", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680275, "uuid": "ca725244-fdb0-4cbd-a2c6-19c004a90019", "comment": "Malware payload (Stop)", "value": "c7c0fb20616f7916e967bc7e09a78ea9e86ce68a", "object_relation": "sha1", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680275, "uuid": "dd75aa3b-eae1-4ac3-9f63-8db75dc82808", "comment": "Malware payload (Stop)", "value": "183f115671d93919d04c26f13438a98bd71de621fe740ab24a282f779bc13bc6c723763b28c4664c5db9be7f7b99a5d2", "object_relation": "sha3-384", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680275, "uuid": "ad1692c9-8fb2-45c6-992b-7ad35e3b19a5", "value": "T14905F1527693FB71D66586314D2AC6F821DFB8709F056BC732586F6B28712E3CA26303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680275, "uuid": "aef72831-1a73-4f3f-9df1-c55ab1728581", "value": "40be65705a95a43e6733e98c1ce5e92b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680275, "uuid": "56f4090f-4048-4358-8240-0374296c70b4", "value": "12288:X44GZxRMcH6mr0ZB2N7KKFn/Od6inHbNAphxwB+dVrv9VQOUEW+2v0on:XkZxRKmAB4GKN2d6iH2z1v9aOUqU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680275, "uuid": "1a070194-3f91-4226-8a13-5e16c0520f88", "value": 806912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680275, "uuid": "2ab8bf23-fcfb-4684-a11f-9ac21901d2d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680275, "uuid": "95cd480c-1acd-49f8-b425-e41d526f90bc", "value": "mapper918.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5913285-f7d0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684671236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671236, "uuid": "174e1946-56d7-40f9-8d1a-3a0b815f7ed2", "comment": "Malware payload (Amadey)", "value": "7c1186aa74eb71a447e9f1d5303c61a6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671236, "uuid": "6c6a247d-cbf8-46f0-82f8-804008ccfffc", "comment": "Malware payload (Amadey)", "value": "18261afb765a44b65cc0d26273e3b4393ec46d0c5989a89748e60ffbfa34ac7d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671236, "uuid": "d73192c5-4976-4603-932e-43dc0beeaef5", "comment": "Malware payload (Amadey)", "value": "72ddda1b4fbfca00aed71f1dabb684154ff70ee9", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671236, "uuid": "bf6d443b-bc59-43c7-8a59-17356c08bf8e", "comment": "Malware payload (Amadey)", "value": "11bf73d21e662e11a697bb1d0f4093d2ee75e90d04391abbeb7aaf2890bdfed0960ff799cb4a11d14ca409d4dcd01715", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671236, "uuid": "5a46c175-4190-4748-bcbc-eba506470c40", "value": "T144252302BADD04B6D9BA27B054F307C70F397CA04CB4663B22C57C5E9DB2A50997637A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671236, "uuid": "7115477a-c1f9-41ab-84a1-44decf06f40a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671236, "uuid": "ef4bc694-b50c-4809-b017-bba2e80a06fe", "value": "24576:uyF+D4Bokqi/6xgnIdscmA6/9sBPlcjOOE/UEvr6D4y:9F+D42kqiixgIOumvjOOobv84", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684671236, "uuid": "ec977c6d-a13f-41b1-bb94-5bca2ab489ac", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684671236, "uuid": "28d17418-186f-4532-82c2-9e701e5c4a25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671236, "uuid": "daca2618-9270-41f7-ae5f-f3b82810a8ee", "value": "helper832.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef4d61c8-f7c8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1684667789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667789, "uuid": "dc1f4862-49ec-4a9c-933b-6842c10649ca", "comment": "Malware payload (Stop)", "value": "be450d35056e0ad6776cb9c3eeb92162", "object_relation": "md5", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667789, "uuid": "4697b509-630b-4503-acb9-ad8446457154", "comment": "Malware payload (Stop)", "value": "18442300bc10e39c9cb9b5b32ea146be9cc09df17c945fd1ea3f9fa19795add7", "object_relation": "sha256", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667789, "uuid": "178cb0e1-ed9d-4dbd-844b-c24818f6fa00", "comment": "Malware payload (Stop)", "value": "35dc1e42e1fae083085cc08525951b208312ff35", "object_relation": "sha1", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667789, "uuid": "ddfac5fa-834d-4a96-b1ba-c1b77be52693", "comment": "Malware payload (Stop)", "value": "e76214997671555ec43b5b85e52ed5cc88bed71754fb5015bd1993f30c03a87b1c874fa7bff22e35626196a8d209b015", "object_relation": "sha3-384", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667789, "uuid": "a7f919fc-7f55-4d8b-bb17-a096cd080173", "value": "T14505E04292D3BD69E52246729E3EC2E8361EF9504F193BE722146F3B04701F2E6BB751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667789, "uuid": "0a08664c-ece5-497a-ac36-ac045fc1c339", "value": "885df6b18e739ee3563619e20c0ba91a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667789, "uuid": "fdb8e978-1091-4924-aa80-768431a4aa5b", "value": "12288:nMF5XORlMzudJvAFDTdfKcjlr1rZ6CXj2GQkJEhrKmvg/kCcZ2GD:nAXq0udJ4txKcjlr1xXjRa1dg/0D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667789, "uuid": "a104b74f-f7b8-4644-b315-78676d6b3d3a", "value": 845824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667789, "uuid": "281eb5c8-02f6-40d2-832c-aa9aee4198fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667789, "uuid": "13327d13-17fd-4172-84cf-df26859a9bb5", "value": "formatter146.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7e5fe2b-f7c8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1684667777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667777, "uuid": "608adea8-c4e1-4970-82fe-8058cb2b8a24", "comment": "Malware payload (Stop)", "value": "7dedfb03c0417469da8b2e50c7b514c2", "object_relation": "md5", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667777, "uuid": "4377b69f-f552-4360-8230-30c788621528", "comment": "Malware payload (Stop)", "value": "18b11da4f088d5ea6137b7927a2b4420b6e6c3b3cf6316d0dbc4dd6fe7308889", "object_relation": "sha256", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667777, "uuid": "772441cd-8016-449d-93b0-6b8e5e0ab7a0", "comment": "Malware payload (Stop)", "value": "793b8000997f2398b1c5d7dc6f8cac7a42ef10fa", "object_relation": "sha1", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667777, "uuid": "17f32463-00d7-4524-9be4-8bf401866672", "comment": "Malware payload (Stop)", "value": "49f43fb16c2cf7b990ea0abc1325ca03b400d9bcd1c5e6e49f3d25712be5df10bd8df534e54ebd3de6ae676ba8230d64", "object_relation": "sha3-384", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667777, "uuid": "6208cf1b-ced5-4f0d-8bc2-787a1c07901c", "value": "T15D05E00392D1ACE4F5225A728E2EC6E8761EF9614F197BEB22046BEF04711F2C573356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667777, "uuid": "b8511ed1-4410-4fea-a41e-021dbee7690d", "value": "d3185d759d0419b7cf5b47864af3fc7f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667777, "uuid": "c1b59a78-0ed0-4764-baaa-b6772153ac69", "value": "12288:Q1dvXT9ZhFnml5v+tX4OkmzogNx88niKZ+ABnrwCp/Fxgz9ijd6+:QPXT9ZnBIOkm8gNGadrwCjaxij4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667777, "uuid": "828eeda2-bff0-4a71-a847-4e3d25feb8bb", "value": 848384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667777, "uuid": "e7d193f7-6770-4d43-b970-99f48c06a862", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667777, "uuid": "62cd2762-9acd-43a5-9e54-024c91455b91", "value": "cumloader584.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cfbcf69-f7b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684658471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658471, "uuid": "cc2881e4-5c44-4b2e-b969-d8e97d2a262b", "comment": "Malware payload (RedLineStealer)", "value": "ca7ee07da19ef633aa19bca597d57e17", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658471, "uuid": "05976ea5-dd0d-4bc6-99b2-b9180dd0744d", "comment": "Malware payload (RedLineStealer)", "value": "18b72fe78795d8a3de13ac513b7bccde170fcad44bf97c62f08d1d21989ebc44", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658471, "uuid": "f9d6ed69-8e90-4142-991f-fc17ab165a27", "comment": "Malware payload (RedLineStealer)", "value": "653e036a792839477c07eb65b34439aa747ebc2a", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658471, "uuid": "2ab96c5b-bc98-4645-923d-3be0a5409f66", "comment": "Malware payload (RedLineStealer)", "value": "33fee8ed35221a54ecbbe4c2e6abf6ea57f39db7b3044236fed953e298a74f36e11bd522f643fc5ed92b996909ce6f2b", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658471, "uuid": "6e718f00-7acb-4895-816f-33bc1eb52e68", "value": "T1B7E3F824279F8934D6BB4E3DACB15CD076BCAC126952D7464ECCF0593A73B80EB116B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658471, "uuid": "a5cacf1d-27a0-491b-a789-fc9ba8c4144d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658471, "uuid": "d420cfc5-41e4-4148-a228-87fdf2aac344", "value": "3072:vV+m5cVQmRSx9WCEkEhPW67V8BjVhtZN8e8ht:vj4oihwlVht3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684658471, "uuid": "4579644a-cc3c-4335-98d7-c874c42866ea", "value": 148563, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684658471, "uuid": "783901dd-35a8-4682-92e9-c1ced2924f0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658471, "uuid": "0dd3c235-b9e5-4b9c-a4f3-1fab24d97325", "value": "preview248.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2e68d1d-f7c4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684666051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666051, "uuid": "d934c933-4641-4d52-9d9e-fd110530e614", "comment": "Malware payload (Mirai)", "value": "5da08336725915a774d874a92e3d7fe4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666051, "uuid": "b2ca81c1-4557-4110-bae8-e96f53edf326", "comment": "Malware payload (Mirai)", "value": "18c4070fb7a6b1999a04fa0361706b82594bb4ca8acfbf6b5a46950501c79615", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666051, "uuid": "6e43c8e9-96c0-4324-8bd7-08b982750b67", "comment": "Malware payload (Mirai)", "value": "7730359805d3e5f69683f7725da1d87ae181c367", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666051, "uuid": "30615e55-9a44-4ab8-a80b-5c77b3d6787c", "comment": "Malware payload (Mirai)", "value": "7d27978b14fce4b39d4ba22a1130e583cff116ed3b583e25f24d27ee53ba5230fb587897d80ebb6b1c89c83606617988", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666051, "uuid": "a4ad24bf-ae70-4320-b84f-4dece325f48f", "value": "T1BF534B0077948F0BF4AA5EF5283F17E483BEEE4016E5F1846A0FE64A8235E335559F68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666051, "uuid": "cfe40465-146e-49c3-a519-949edcb08803", "value": "768:rBFWn7icJpjqWBRunbEJn23dZk+0YGadi+Qq5wU05vlYGoWKchU5dWJ75UN6grkc:geYysnMoaAnzdkGoWKaJIkHe/V3Xnl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684666051, "uuid": "dadb39c2-0278-43db-9dba-e9409b48b582", "value": 66656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684666051, "uuid": "8c4c6b39-d98c-4dee-bf1e-b3a5b62b01fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666051, "uuid": "672f6e7f-b93a-41ec-9921-8bc162b1002c", "value": "5da08336725915a774d874a92e3d7fe4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28537169-f808-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684694943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694943, "uuid": "c3c37699-6209-4bc3-9985-6a0844af6bc8", "comment": "Malware payload", "value": "6b6fd185dcc3f74910d4e3cb1714d048", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694943, "uuid": "1e35ef07-290c-4d4b-ac32-4f110923461a", "comment": "Malware payload", "value": "192a3eec4116b5275e148275a80237627b63e135ec24d11d948c6e946f1a160e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694943, "uuid": "15f013c4-d56b-4ff8-9b6a-03711e1e1ac5", "comment": "Malware payload", "value": "90cec3789d9ab30cabfb21e2c13afb819ea90edd", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694943, "uuid": "1ef2b669-8d97-4d2c-ae04-c4677ebf3cc6", "comment": "Malware payload", "value": "c0c902a3d1e639641379501ce089e26b7da2cd53abbd33545ca49384d620db0248a893dafd830cddac648eef53e444a6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694943, "uuid": "91d3f3e7-7d93-49e2-999d-46fdbd30f19e", "value": "T160252357F3C56072EC76273084F605C32A367DA09D7163172742E8AE9EB2391D9B236B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694943, "uuid": "480ace49-2e41-4793-8d05-13ab66533b03", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694943, "uuid": "7a37c17e-9972-4c40-a22d-2abc6cc8dfc4", "value": "24576:Dy8Ar6BACimpfLIRUUYGqsAJtOZeR0bOzFlgqzDcx7vhp+nxDbUgk:W866BACfIRUCqsAZ0bOzTgy6zT6tbUg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684694943, "uuid": "c77c14ff-0a27-455e-b307-be826cab2759", "value": 1054208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684694943, "uuid": "285c6c11-924c-40ec-9e0b-c1a069293446", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694943, "uuid": "349a458d-516c-4ada-9179-7889b60e0a6d", "value": "stealer310.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb30b64b-f808-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684695217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695217, "uuid": "80746291-da73-4053-8943-5eca931897ca", "comment": "Malware payload (AgentTesla)", "value": "5c08164a01b5a7f45e341d643e9cfc47", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695217, "uuid": "aae059ac-165b-4983-9157-9c385070a6c2", "comment": "Malware payload (AgentTesla)", "value": "1935d4557872efef98cf5bad6884f47dd3f89fed690cda816dd5bda2134fd6c1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695217, "uuid": "8f982f8e-eb53-4f6d-9245-dced46e144cb", "comment": "Malware payload (AgentTesla)", "value": "877792f7638b5f20b66a9935699bc968addb3a6a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695217, "uuid": "2eb2222c-a6c6-4941-8085-0dfba59fb0ac", "comment": "Malware payload (AgentTesla)", "value": "84d84a36b40e2beb4a43c5040a7ca0a65e05e036a876355af57c1047af8ad6fc3238230012bcb837a1961cb563d7b0a0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695217, "uuid": "7cfe7b18-6208-494e-bd0f-2a077034c630", "value": "T13BB4237DB06599C7F4FE6ADFFAF2AE01BB18CC219405538C4D1772A134215E922B728E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695217, "uuid": "784cadca-1b50-4bea-a558-995b874dc100", "value": "12288:SqhWqjm80zChBh9OXp5wRlTDqmnAU4MTVPn6nITkEmx:SqU5zCzh9OXLKXnEMAnIox", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684695217, "uuid": "f363ecbc-cad5-45c7-9658-149eff10cb72", "value": 512069, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684695217, "uuid": "228b7445-a1e5-42fa-8a86-c3103d7bae33", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695217, "uuid": "4e86dfb4-d704-47d7-93d4-199f15b636f6", "value": "32332513.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad6cc980-f7c7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684667249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667249, "uuid": "78d84dab-8481-41bc-9f7b-c421c0be00d2", "comment": "Malware payload (RedLineStealer)", "value": "078d86b0a8ed4280eb38773e581158cf", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667249, "uuid": "0dcdc12d-bd60-4bff-a9a9-70ce25530718", "comment": "Malware payload (RedLineStealer)", "value": "19399f9cdef35033b8c61109574e47978c393c810b3c2a88f64fffc67dd9b50f", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667249, "uuid": "fab3ad41-1323-44c3-95d6-c4bec32e7973", "comment": "Malware payload (RedLineStealer)", "value": "358e0a2ece4cf39e35f659f22c052bcf627ef7e2", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667249, "uuid": "edce5b6d-423d-4744-b34e-c62b50c5133d", "comment": "Malware payload (RedLineStealer)", "value": "c73c8fb2d813f2ff27e90a8872799d91888a0ca7816f3e702fe142ecea780e81c60b878c01333e57ac47dccb0c26945e", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667249, "uuid": "d44c25fb-f3f8-447a-aba0-c782bab250a8", "value": "T167252357BAE84436EC761B7168F302570937BDD289B8C3073685D9961E330947A727B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667249, "uuid": "c931ee85-9ebf-4c61-bdfa-efd3d6e8731d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667249, "uuid": "e35d3d0a-c6d4-4ba5-b00d-650a5125e49b", "value": "24576:WyBi47/VWGZ2qoCOxUE9JBX4fIcYttYdyEI:lBp9lZ2qoN+oJBIX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667249, "uuid": "9a033418-1616-47a0-8276-68d5cb674236", "value": 1046016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667249, "uuid": "80bb8525-733b-4f7f-b6d9-73141f937d93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667249, "uuid": "adb687c9-098d-43cb-9bab-475c38ee4cb2", "value": "LightCheats988.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8382af73-f7ff-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684691231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684691231, "uuid": "eb815435-42f7-45e7-8110-722373e13d4f", "comment": "Malware payload (RedLineStealer)", "value": "0f49e07b5b614e3f36c7a6dbbee56ca0", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684691231, "uuid": "a9abe2a8-febf-46d7-81cc-9876e07506b1", "comment": "Malware payload (RedLineStealer)", "value": "193a82515e22141c6dc37f913733c2a7dbc855f0a6c80ca33e13a4f56eab5de7", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684691231, "uuid": "7106b2c9-ad1b-4b4c-a713-38fdc75ea4c9", "comment": "Malware payload (RedLineStealer)", "value": "7bf751266f84e235f70387b7cc83d47a3414c1e1", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684691231, "uuid": "7cca067f-4655-4138-ac13-262ae33647cc", "comment": "Malware payload (RedLineStealer)", "value": "ea40c414326974815c2d158ea3e11608b2533cc8febec6e7a97343a8374cbe882b7f4aee9d7c6cc7d6b0b53180ec4978", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684691231, "uuid": "2f9a2f8e-f733-46c9-a244-5ff0ac9a0f22", "value": "T17B252312E7F8A031C6F927B819F6079312397CB99678835F3141BE6E18F2665A43533E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684691231, "uuid": "1eb4c6ac-e6fe-4a2e-bedf-2629360b729d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684691231, "uuid": "668c9c03-b585-4cd9-96be-4e48a8bfbc92", "value": "24576:hySEvEmg8PouMQMo75WYeUSAo7DKV3f3YC8BiD5P5SBmYWL6:UDAwXDDV3f3YC8MD5P0BrM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684691231, "uuid": "d6ed1231-12e2-49f9-ae52-63a8d08434b0", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684691231, "uuid": "350a6360-1084-4d47-b23a-91febaacb37f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684691231, "uuid": "a539ccbf-e5fa-411c-8061-a378335ac015", "value": "islauncher919.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f820107b-f7d0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684671240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671240, "uuid": "878a7893-6a6d-4ee0-8932-4b566658191d", "comment": "Malware payload (Amadey)", "value": "619f13b003c96ca50550411267b7f09a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671240, "uuid": "7203665f-6a51-41f5-9dfa-50386d69d4b5", "comment": "Malware payload (Amadey)", "value": "19604ea1a2b5f4e287d68407ee7f0afc179935e52f388753bd96e9ddba0a9071", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671240, "uuid": "f5b42727-d098-43dd-94ee-b98cc3a05503", "comment": "Malware payload (Amadey)", "value": "c1fbe38532e0c6c2d8d4614f6bec1ba48cf89265", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671240, "uuid": "e74b5110-369a-4b48-8179-c6df0cb84c21", "comment": "Malware payload (Amadey)", "value": "bc15e9ee9e424bb6e04e381479d86750aa37e94fe21d1967cd771270d6a28d8072e1b22a8e845563804fd2c39a5d95e6", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671240, "uuid": "dcdd29bb-e55d-42ee-bb94-06f72c7e7de8", "value": "T1D9252302FAD95077C8B62BB04CF603D31972BDF29A78871B279899595CB3781587332B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671240, "uuid": "00f99b1b-1965-4af9-afec-d71a3b24c4b9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671240, "uuid": "3d2ebe41-7d59-49b5-a86e-d15d563f27a3", "value": "24576:Ty0+UEH3HHApGqw//pZjQyRAfNbdZir4mFpFJoTOI08:mPDH3HApGqw/vjQNl3iNPeOj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684671240, "uuid": "465716d4-9dee-498b-9bad-e3a82cb1a15a", "value": 1046528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684671240, "uuid": "77624639-fcde-4bb3-acf9-67dd248bbbe0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671240, "uuid": "5816c9db-68f8-4447-83ac-c719e3071010", "value": "installer812.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7c878f3-f7c7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684667294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667294, "uuid": "7fc5d1e9-3984-4e5b-b84b-59e82cebb495", "comment": "Malware payload (RedLineStealer)", "value": "d105473a00698b67ac490b3ceda28fcb", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667294, "uuid": "19ee1284-ccae-43ee-ae5d-8ae599cd4b0f", "comment": "Malware payload (RedLineStealer)", "value": "19644d7e8215835e478b5effefea037368b66ed06dc1c28c7393951ef9b7715d", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667294, "uuid": "b662546d-16c5-46fd-81c9-e2124aa5db61", "comment": "Malware payload (RedLineStealer)", "value": "b5b4eeb1d5dfd31908cd9cfd8eb4b0c25458076d", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667294, "uuid": "5df2385e-7d79-4b9e-ac5d-5cc4e7a5c1e6", "comment": "Malware payload (RedLineStealer)", "value": "a44d234ac39d7b6edf501198da9b35e3b9c6ada19d4b0b22c3b1fdc70c69f98d0d61608612319cceceb4f7eb2f990065", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667294, "uuid": "030b7e63-20f6-4e21-a14d-014f9bb5b9e3", "value": "T15625221766D951B5D8F04BB85DF383C30B31BC6399B496AE2B45845B0EB3388A53273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667294, "uuid": "d0fdab59-a52c-465a-94d2-3d3710ea0dc8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667294, "uuid": "3e1c41c5-db71-4fea-964f-96d887cb5a45", "value": "24576:0y+CYuSmDwJ6ZRnz+zYN0KY1+1Cgg4qYUErQSvo:D+CYu7kunt0oQsqWQSv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667294, "uuid": "25675cd3-9161-49f9-950b-deb1764c61f3", "value": 1057280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667294, "uuid": "94a141cb-99eb-4618-abbf-585278781d67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667294, "uuid": "0448fac7-4a8c-48f0-80d9-52213ef3404d", "value": "cumloader841.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c72b5d97-f7c7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684667293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667293, "uuid": "2054269f-9caf-41ad-8ab6-de11407237b2", "comment": "Malware payload (RedLineStealer)", "value": "a50097451ebe5a2f16c13e802d3489bf", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667293, "uuid": "ad50e16c-5c25-4201-a9dd-143bcc0e71ce", "comment": "Malware payload (RedLineStealer)", "value": "19803ce24f93156b5e4db8ff314c07e54bf6e3e4bb5aaac4ab19f89a75210cf2", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667293, "uuid": "94bbbe1c-bba5-428a-be67-e34771de1100", "comment": "Malware payload (RedLineStealer)", "value": "d0e4d679f6c28ebc9836356e008da0731afe4e89", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667293, "uuid": "c504527b-bb14-49bb-b9dd-b1a1fb673227", "comment": "Malware payload (RedLineStealer)", "value": "d018d6c05212a1e664def63b90b1b284819aa6e46301ed2d9311caa02eadcac7fbf4465109b3ca90f6db66ee5aac2f20", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667293, "uuid": "47b266cb-b3fb-4f6d-8084-6128874ffed6", "value": "T16C252347B6C994B3E97A337854F553E30A397C80AE24D31B67589E6E4D31700E932B3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667293, "uuid": "a06902c5-9dc7-4f0c-9a84-3f59e4380e78", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667293, "uuid": "b3bc60ac-fd66-476b-9b4b-fb9413219bc9", "value": "24576:kysOuAvdasz/kO4mAqj0+Eu7/StapRWacvnVU32Uu8J2:z3l9z/vcqgC7/StabWacv+GP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667293, "uuid": "9f31da68-ca44-4c49-b8f6-ee2d7ecb2a80", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667293, "uuid": "1037bdb6-4f70-4c42-91af-c65c369b4728", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667293, "uuid": "63740f83-e479-4e72-99b6-b888101e921d", "value": "converter422.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30901b26-f808-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684694957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694957, "uuid": "1df7d366-5563-41ed-ac80-e3127044081a", "comment": "Malware payload", "value": "a8d37dd30951ec85168f7861f4a3b18b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694957, "uuid": "5d240496-c1b3-4fbf-92bb-fdf0102d0c0b", "comment": "Malware payload", "value": "1a48fbee479604df8e4e49c1a78e9ba83bf20283ae1ce3fddf15fd8a7c0ba638", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694957, "uuid": "0958c695-26db-4d69-bdc8-8ebf4b1d35d1", "comment": "Malware payload", "value": "a1bfcc06893e81f107df66662497112f21558ecf", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694957, "uuid": "8ea62628-0302-40b6-b0bb-8e4ae5827f3b", "comment": "Malware payload", "value": "e4c69d4eddd2981e374baa8d862979b5f598edd2f6050edef011d5c543c4d48a2f05fea7674d4f88dba2cb4f3491c06e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694957, "uuid": "bf4d10d3-d376-4a84-88ee-a0703788906e", "value": "T1A9252312EAC9507AEA724B7059F916C70739FDE29EB8C27F3310F9591DB39905828732", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694957, "uuid": "01ffd1f3-8a9c-47dd-8017-eda85aae45a1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694957, "uuid": "10ffa599-35f9-4b0d-bf1b-a015caab80fe", "value": "24576:byxnOvfpQU2HABCqfaKCvul+opSnm7k8Q1Spy4j9co:OxnO+U2HABCqfI++zyk8QYp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684694957, "uuid": "66477c8b-7eb3-466b-8f72-75b97b1edd0b", "value": 1045504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684694957, "uuid": "d47fd169-7faf-4603-8045-af56e53f4cac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694957, "uuid": "60065adf-6a0f-4eba-a093-df5dd26b784d", "value": "stealer359.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4056c9a2-f7b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684658476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658476, "uuid": "3cc3357e-7974-45c1-a845-972a1353fcb3", "comment": "Malware payload (Amadey)", "value": "6b009442ee4e64f06ec82d5a8c6477f4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658476, "uuid": "a59bc3bb-f335-4a62-a945-654dd90b103b", "comment": "Malware payload (Amadey)", "value": "1a4e5aa47e166e2712636f01af882232c2c42f027f3b5aa0d3798c5da1eb2584", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658476, "uuid": "e5f2ee2b-88b2-4919-8e8d-ea8f1b4df34f", "comment": "Malware payload (Amadey)", "value": "328bf34408d08dfdef94ca53e42b7a9b961831fb", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658476, "uuid": "42b90325-14bd-467d-b3fc-ae73de162bf1", "comment": "Malware payload (Amadey)", "value": "63507b644260f7ff001df6403f5b033584366a5c2b111d8e4de4c465ab6c4fc33391eee9835ed9d9ead130c41c24197d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658476, "uuid": "13c46bfa-0daf-4896-9998-21b1a0c7388b", "value": "T11025234BB7DD0073EC756B7448F602C30F38BDE10A74C25B2695A9990CB76C89A71BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658476, "uuid": "9c9bfb59-09e7-4794-9292-4f37706bea14", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658476, "uuid": "c9b24df6-f2cf-4fba-bd5b-b195e0072fb0", "value": "24576:UyBT5CwRDUSMZuqASKL0GaHihj3QeN6OQuMTtm2SMkO:jaWASouqKXAEjlQfTu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684658476, "uuid": "36ec2c77-6d9d-4032-aaa9-70ba3adba9bb", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684658476, "uuid": "6710ee10-704a-446d-8bb7-d39d998f4036", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658476, "uuid": "b897563c-b5e2-4d7a-8aea-c055e7dc7318", "value": "registry162.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38984507-f78a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684640854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684640854, "uuid": "ad6e17a0-edbf-4af0-96e4-d8298235a8ce", "comment": "Malware payload (Mirai)", "value": "473978f68b109e4cd0006cc95f254acd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684640854, "uuid": "f0357713-c2dd-490d-a34d-70a1cdc6c92a", "comment": "Malware payload (Mirai)", "value": "1a79f1f690223855394be9e6041b6570f0cd897788845dc1deb92260c9439c22", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684640854, "uuid": "29fe05c9-4e56-4a6a-8455-8986bedc3aef", "comment": "Malware payload (Mirai)", "value": "f709c245b0e2d3e4ff9fdab0da4b31c6fa7553fe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684640854, "uuid": "a44c0e0a-3661-48e0-93fd-ec0f0b7ae230", "comment": "Malware payload (Mirai)", "value": "716398c091250f962bfb73864a856542817557fcc92250ed97e89c7ee4b29ca31bf88c9515c525a9d16dfa1eb5835162", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684640854, "uuid": "8448b30d-f093-4f29-9cbf-29c6208c3d6c", "value": "T163D32896A093B2B8D814C13931279770D92194BA9026CBD6F3EDD3B2D851FD07D4B2AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684640854, "uuid": "5a725a38-f615-433f-8d85-fc56d233d3d8", "value": "3072:+nR3Ob/Ev3DAMLcHAObLs/I5bFBLU+lGFGvcqnf2xquY:QR3E/Ev3p+bLs/wp02fp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684640854, "uuid": "352515e7-aa25-4411-89fb-338cf41ed232", "value": 140240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684640854, "uuid": "f1c117e6-4272-4028-94d8-c25cd1fd2f76", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684640854, "uuid": "c86e400b-41f9-412f-a097-d1c0eaf77a52", "value": "473978f68b109e4cd0006cc95f254acd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b6e23b6-f7ff-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684691244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684691244, "uuid": "8872812c-4a72-4cb8-a1fe-aba00155b62a", "comment": "Malware payload (RedLineStealer)", "value": "f3982e91c7d893e3dda7143ea5f82852", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684691244, "uuid": "c7433289-64c0-4cd9-bd5b-9949b73126a2", "comment": "Malware payload (RedLineStealer)", "value": "1a88313f3230e68d78934c87309af5491d6acfd6555a64978ede51c0c75721ce", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684691244, "uuid": "cf37635b-3320-43ab-9775-2d6af2a8e5d8", "comment": "Malware payload (RedLineStealer)", "value": "0f9935f3543a8b77ff840c7201a1519371fa405e", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684691244, "uuid": "1b09f867-78fe-459d-9eb3-6d4892a785a6", "comment": "Malware payload (RedLineStealer)", "value": "420e20e2c12f7cae36a6a5ed1db18d340fec4bdbcba43ac9a3aa92a056ee9d17001495f50a5bcdf07e987c29ca23cafc", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684691244, "uuid": "a19ea1a9-b743-4fb0-b275-268b91d6d002", "value": "T100252303E7C96471CEB91BB054F603A31F35BDA28EB5C30B33459A1948B2694D2B977B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684691244, "uuid": "2e1dab0e-4a9e-465a-8026-7c185d4bb9cf", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684691244, "uuid": "6a642ab7-0743-4178-9c06-411c5197f8a8", "value": "24576:4ybnNwFzYTwpppqIOoGZsBqsF56tnpSG7V1Cujd:/bNazmmpqIGXC5W9V1T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684691244, "uuid": "eaa3d01f-6e64-4f07-801b-b8546756635c", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684691244, "uuid": "f881168d-172c-47bf-997e-121e2649cab3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684691244, "uuid": "122de385-3557-4364-a6ed-24e2addcdfb4", "value": "patcher783.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b1107ef-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684680426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680426, "uuid": "28fd5ffb-a59f-420f-98e4-b83c67afc299", "comment": "Malware payload (RedLineStealer)", "value": "7354f8214c2687f52533ae1eae5b4edc", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680426, "uuid": "424c33f3-ff18-4846-b277-be673938751c", "comment": "Malware payload (RedLineStealer)", "value": "1a96ff5964ae11d6cd541b35eab5edb80b3ddfa3ea4b3fbe4cddb2cb97174f9e", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680426, "uuid": "7212f250-f35f-4485-89ae-7fc84613446f", "comment": "Malware payload (RedLineStealer)", "value": "26101cb7e7c6af68a6ae8b64bbbac81ea66d84fd", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680426, "uuid": "24e7e5c0-481a-4eba-9cbf-3a292b58b5f8", "comment": "Malware payload (RedLineStealer)", "value": "6e0cf830ff6ea7043b534c81be4a157b0f99cb07522998366cbef7536c1ed5d4fb67f169f3c653fc656545b5b2c6c7b8", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680426, "uuid": "406546a0-0ea2-4654-8424-0a4f05e036c4", "value": "T1CAE3D528279F8934D6BB493D6CB19CC076BCEC52A542D70A4ECDF1593A73B80DB116B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680426, "uuid": "202fd619-a30a-4d75-bdd0-0c371406fbc3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680426, "uuid": "a652be32-b0dd-4d14-a26d-736fc80a7fb5", "value": "3072:PV+m5chQmRSZQ1avem1eJwfUuMyNiOhjZR8e8hX:PjENURTIOhj7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680426, "uuid": "6cf68112-d0a6-4a78-878d-7e7201212e73", "value": 148602, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680426, "uuid": "b5072009-192c-4c8b-a78e-d784d62c8377", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680426, "uuid": "57f6f334-e344-49e6-bebd-70fc7f421584", "value": "242552551.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d36b6911-f7c6-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684666884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666884, "uuid": "d909ec13-0230-47cf-9b3d-cce8e4507b2e", "comment": "Malware payload", "value": "590108a2275f4f2fbc7c355ef308ca15", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666884, "uuid": "73c42d17-e0ad-4aa3-b6df-8767075e3c52", "comment": "Malware payload", "value": "1b1dec31e1ebc4d4d86ee72b573a3df3dd271d7296b40bc4a0ddfa7e1b9a496c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666884, "uuid": "a326364d-6f7e-45ce-9bea-870a9dc9c3bc", "comment": "Malware payload", "value": "9dcc64bb9496342339396f0e4b784796f7d28480", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666884, "uuid": "b08784d8-d3f5-437b-896b-fdfe05505ff1", "comment": "Malware payload", "value": "12a9aa63380e19bd94f39340edf847b2ca5b0da6f7b4c6c7351633edbe5748fab33ec77195908dbd89fa30fa61103fcf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666884, "uuid": "c041eb59-a5ac-4324-bcd2-53853b018179", "value": "T1C6131C56B9818B16C5D403BEFE1E118D3327676CE3DE72225E216F207B8757B0A3B816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666884, "uuid": "10a2baa1-e495-4673-a7a5-8024892866a6", "value": "768:ZxnLMu7MXH0gpG9bH+a28nCEBTUyfWmugY2mML7kiivQyCRJctBV4O:ZxnLMu7MXhICEBTD3CJMUiivvCRJC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684666884, "uuid": "be3b32b5-adac-431f-83d6-4777c349782d", "value": 42704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684666884, "uuid": "7dfff9d0-73d4-49ba-8159-48190553a51e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666884, "uuid": "2d2bcee9-7ae3-4d5c-bf80-2e71b5ba6916", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bea9bd81-f76f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Fabookie)", "timestamp": 1684629483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684629483, "uuid": "cf72159a-b019-42cb-b994-17da91369e6f", "comment": "Malware payload (Fabookie)", "value": "2c7fa278f42d815a58d3e05d295f348c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684629483, "uuid": "925012c7-b5d5-4ea5-8a2b-237efc18433c", "comment": "Malware payload (Fabookie)", "value": "1b208b3d04220f495f51714c22d8580859aceb25625d1129031c89bd772626fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684629483, "uuid": "690af3dd-be7e-4761-af4c-f7875e36ad8a", "comment": "Malware payload (Fabookie)", "value": "45ce446bd04a94967cf68fbb2b081e391339daff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684629483, "uuid": "ed914101-daa5-46e4-94bd-f28cb195799b", "comment": "Malware payload (Fabookie)", "value": "b9097791cc3f37d64c0eaba52c42e89a859510dd47fe6918d9d2b7dc29424c86a54a4c63f3d34840c3d9a51754181c80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684629483, "uuid": "d0e1b121-1c58-4050-8944-6a1e5c2f3bcf", "value": "T1BA844A2DFBA84476D163C57FD9B2E665D77238916F208BCB0212862F0E336D49939732", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684629483, "uuid": "aa035fbc-0c38-4bd8-bc0e-5873d4c05dfe", "value": "99782e0cdc1c7b57cdc2cde5daff70c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684629483, "uuid": "78211d03-6f79-485b-b110-60e5a5448442", "value": "6144:iq3y9wUepfcisGiKrD8bFaggXWeuCvZEOHHrpm1XUZLxEZEOHHrpm1XUZLx:iA+wUep9vuChtLpm1EwtLpm1E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684629483, "uuid": "4a953350-0b0b-457c-b865-2423e01e7429", "value": 378880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684629483, "uuid": "fc865c98-a306-4309-ba71-b5c84238825a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684629483, "uuid": "e41e9d51-8ce2-4be8-89ff-87637cb1e660", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "336585f0-f7b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684658455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658455, "uuid": "e2cbb679-dd76-4116-a0b2-5cf2d3e884f8", "comment": "Malware payload (RedLineStealer)", "value": "e7a29cad310f580e3cc424576928df73", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658455, "uuid": "f4d8ee9f-ee7b-4b73-a86b-7bb2c96a3f90", "comment": "Malware payload (RedLineStealer)", "value": "1b835f907a1b93741f11ec35942ebf6a92f1259adc278dd056c56c47a7c93358", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658455, "uuid": "432de4b6-3aa5-4e16-9e4a-249a52b15b08", "comment": "Malware payload (RedLineStealer)", "value": "e35bd81bfde4fb51740ec9af7d762facf1a21e0c", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658455, "uuid": "6079f557-ef18-4f4e-b2cf-f6437f6852b9", "comment": "Malware payload (RedLineStealer)", "value": "be77687447e2ceb27ac7f975f8b389a6aded474c6c23a0260685b8e862d2fb36457d2bde6671366da6faedaf0f020025", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658455, "uuid": "51d641db-71f8-4faf-a563-1254f158e0d4", "value": "T1D0E3E724279F8930E6BB593DACB19CC076BCEC12A952D7064ECCF1593A73B80DB116B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658455, "uuid": "09d520c9-2cc2-4679-9699-1f481c6a8e39", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658455, "uuid": "e781079e-5810-4e66-9d3a-765623806660", "value": "3072:oV+m5cRQmRSZrrFPFq8ajsiiOhEZF8e8hQ:ojUg8fKOhEP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684658455, "uuid": "7634746d-204c-46f1-8b89-6ad45ca2bbfb", "value": 148495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684658455, "uuid": "70f7a344-a266-4524-a666-b221885699ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658455, "uuid": "9f768aea-f8c7-4051-b153-b14e552b98ee", "value": "launcher352.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a39a834-f809-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684695322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695322, "uuid": "f1661823-35bd-4f1d-83d7-7e0603b454d8", "comment": "Malware payload (RedLineStealer)", "value": "a0625abe032b223d7708be0bf6ce16d5", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695322, "uuid": "16403b08-129b-4681-b3bb-94dc7b254984", "comment": "Malware payload (RedLineStealer)", "value": "1b882b1a086932c37396fc5a7040bdd58c1525249e452b5835ecefd1b2dbcd3f", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695322, "uuid": "e17c506d-d62c-4d52-a119-e92de8f4e4ae", "comment": "Malware payload (RedLineStealer)", "value": "65d3d7f750798ca96707054e3fb5e341f84a617c", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695322, "uuid": "d71487bc-4e8a-4c0b-8b38-231b65197ff3", "comment": "Malware payload (RedLineStealer)", "value": "1c0db57a8cfa11a03399a94fc8f43a75c3fe338f5283e2e11f4f6a9c038f30822489085a95fbf60f088895c962f4d0c9", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695322, "uuid": "ac042795-16ae-46c1-addd-d3776f639dfc", "value": "T133252322AAE581B2FCB5377159F10B471F30BD944C77532E33419CAA6972AC09A35F3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695322, "uuid": "17f465ec-d074-4e8a-ba78-d4d64ed1acbe", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695322, "uuid": "b1b17e2f-46e6-429e-beb9-f977e04ebaaf", "value": "24576:IyL3cDuX3U3Jq3Jx7aP8bnyasJu+d7Kyt+A:PL3F3U3Jq33a8bnyasg47F+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684695322, "uuid": "8dac909d-0ee1-46d4-be52-2e739ab3302f", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684695322, "uuid": "e9a2ed08-7f75-4e7b-9dcb-70833f424b0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695322, "uuid": "c4958d3d-ee34-47e3-ae70-1f7d560f0c7b", "value": "manager120.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae927f3f-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684680566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680566, "uuid": "e2bfde60-4c41-4525-85b1-f0954548a82b", "comment": "Malware payload (Amadey)", "value": "85b01f4b447da0e423af5963fcc7b3c7", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680566, "uuid": "908c4db7-987e-44a2-8130-37ab202d243b", "comment": "Malware payload (Amadey)", "value": "1be795539e88f469faf501ece98bf7d7252fbe19da546619f36f7a48abfd3509", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680566, "uuid": "2d38ec0e-1518-4fac-bb3b-b2e2a1b608ab", "comment": "Malware payload (Amadey)", "value": "9131b750c869488805ced9b2dba5bcd3993065ad", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680566, "uuid": "e0cee553-7f49-4e51-9e2d-a0b931b48219", "comment": "Malware payload (Amadey)", "value": "10ecf581a46a99aebfc48e9576a5229ba7408b2376a11ab8aae42a83737632f78b637ffbb08646e61a9a4c4e7ab9873b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680566, "uuid": "3300654d-2848-46e4-badf-7cbd3bfcb95d", "value": "T16825230767C58072E87A333068F653831F377E618938839B2B197A1A4E73B92B571767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680566, "uuid": "60f86020-caec-48ed-ac94-3008d621bada", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680566, "uuid": "63f12cd7-d147-4239-8932-d658ea638917", "value": "24576:dyQ0s8ko27iq6U0nS+o2DmuYe7owMSVaNVeAT3Hw3EjtKE:49kv7iqR0nS8m0mSMNoAT3qC4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680566, "uuid": "124e405c-05bd-4fcd-a386-2eca58b01b39", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680566, "uuid": "b851f553-6eaa-4fb5-84bf-b5076a2909b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680566, "uuid": "de71c7f3-8d61-495d-aa92-a26050a6d056", "value": "effects869.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "453dd24e-f7b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684658485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658485, "uuid": "5482aeea-1202-47b1-af27-4367186eed4f", "comment": "Malware payload (RedLineStealer)", "value": "2a3829c57c9531d86445a6e40ca27e25", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658485, "uuid": "7636eaed-9fc8-4043-a912-f09b5750d9b8", "comment": "Malware payload (RedLineStealer)", "value": "1c0409741175c2ab908eeced31ffcb85e5f1f765497a6623545da387176bf53d", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658485, "uuid": "2e789f27-dd15-46eb-bff8-e45b72974bad", "comment": "Malware payload (RedLineStealer)", "value": "90cc92d5dbd92ed469067d9b7b5dcff6e583f405", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658485, "uuid": "c38c9e45-a355-4081-a84d-365b95023bbe", "comment": "Malware payload (RedLineStealer)", "value": "c414a569f48d70cb34b52129197008310bbf586f1e0d167772ab0c3bc7d15bbab623a9c8d2c3c785b414aaa08fb58579", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658485, "uuid": "f0fbeaa3-7232-4279-9ca3-ce2707645c4a", "value": "T1E325230366D88176E9F6277869F306930B35BEA44C75C26723866C2F1D319E0BD7237A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658485, "uuid": "3cdfb8c4-1d2f-4e17-be89-a486ed550a5b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658485, "uuid": "5a208e81-9193-42ae-99cc-a54589dd07d3", "value": "24576:ryNLa9kadwF6VqwvbRwHZeimEgsoz1YnSr1WYuM:eVa9PwEVqYbIHmfdDr1WY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684658485, "uuid": "3ab0b00c-f86e-443e-8dbc-123a8cd91602", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684658485, "uuid": "ccdaaa96-4746-4585-9177-795be15c05df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658485, "uuid": "5378a799-ef77-4643-a6c3-b72a72fcb510", "value": "router825.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb7307c6-f7c8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1684667729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667729, "uuid": "b6c0f916-a179-4b19-8ba6-d038791abc5e", "comment": "Malware payload (Stop)", "value": "f8c3ec606609661c90b524d7e4172a6e", "object_relation": "md5", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667729, "uuid": "a58e9d67-45b8-4844-8802-23aec1e9f5b5", "comment": "Malware payload (Stop)", "value": "1c163c65c9c41543f8941a29597df12521b512988deb9b389938475e9d46beb1", "object_relation": "sha256", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667729, "uuid": "94ccc322-98b4-4724-889b-315f6e438677", "comment": "Malware payload (Stop)", "value": "066b586a23e6d57d2811f502277c329b5d222e45", "object_relation": "sha1", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667729, "uuid": "5eed7141-0285-42b6-896a-ffbd5074dab3", "comment": "Malware payload (Stop)", "value": "be498c54c28a7add2755b501c72e915b02a5aec7eb18806d525b603c5e0c41885547f38f4784acf91082ec3103e02986", "object_relation": "sha3-384", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667729, "uuid": "33d8982a-6b86-4811-98a5-f4a8dc6de75e", "value": "T16705E003A295ACA2F5164A7E8E1ECAFC765FF9518F0C2BDB62546F2B04711B3D672301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667729, "uuid": "dec697e1-fdb2-4fbb-b11f-942aa4a25318", "value": "5657feb8d89d49cf6b3c1ee152078391", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667729, "uuid": "d3716e4d-97a2-4914-9e08-e1fc32dcad2a", "value": "12288:Y6fwp1VNM6VhisgOhiWKmchvRUCCxIcHcsy++l2bRfzTQYlM9Y56EHcnjAu:PKs6fnPYWKmKveN6IzoAbRrUYQE8njR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667729, "uuid": "8ad7babc-036e-42fc-815b-17e448e6cc20", "value": 841728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667729, "uuid": "c3ef082b-7c2a-41c9-adab-7f973c2edac5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667729, "uuid": "b8d127fc-badb-4278-854f-101bb92820d6", "value": "234433512116.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "634953a4-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684680439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680439, "uuid": "15bf4f2e-c433-4f28-9c90-3eb85d8e7f87", "comment": "Malware payload (Amadey)", "value": "aec134ce4a3a523bafe062ada22a4549", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680439, "uuid": "2fa7f35a-c9c7-48f1-bdde-260087f96aae", "comment": "Malware payload (Amadey)", "value": "1cc8ced13e5122c9958b5dcc54f38cafac3e41dcd34641fcc6104a4b2d346672", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680439, "uuid": "23ca9091-07c1-49df-8363-7bb52f374794", "comment": "Malware payload (Amadey)", "value": "55879636c9843babe71237b259129dac5473bf08", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680439, "uuid": "9e2c0907-6627-4e70-a0b4-db2d409c8b6b", "comment": "Malware payload (Amadey)", "value": "be35cd442938910c89abcf21c2ad185b93f2cc90b7f56fccadadd611fd4717d6d46bff5e575e9fb20e037e8621d39517", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680439, "uuid": "ab401754-53ae-4b3e-bf83-59e97ab766b7", "value": "T11D252343BAD89272DDB5277069FA12870E39BC509938825E3255EC592D332E0F5B373B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680439, "uuid": "a9d4ee6e-e4ff-45c9-b4d1-c6576341feb1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680439, "uuid": "8a8568b0-3858-4ccc-8682-bab793af0569", "value": "24576:XywOnYnP7pR5w3qhTM/vz8/cyxsyF49jPvNRHJOdU9T/JcxX:iJYP4qh0g/cSsyMnN1JOdwT/Sx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680439, "uuid": "a7f1720d-921f-461e-a16e-bdcbf6f254c5", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680439, "uuid": "c18902fd-86f2-4d20-ba6c-b52f5eedb11a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680439, "uuid": "16904258-6293-4521-9fc7-1085ebd29aee", "value": "2467853.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b364bd62-f826-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684708062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684708062, "uuid": "994874ac-4a22-44e3-bd44-430a597fba30", "comment": "Malware payload", "value": "2afcac7aaede32980c96fda99c8c8677", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684708062, "uuid": "d384e783-dc62-4ff5-8766-d6aedfaf2884", "comment": "Malware payload", "value": "1cd60650fa3e560d8f7c80d4d059e669e64486bd3ca6daed52d8fdce14d0455b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684708062, "uuid": "9bb417d2-62c7-4b1c-bca8-9b833dab2e79", "comment": "Malware payload", "value": "436e83ce6882e798e5bb6d89a31913285886d3a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684708062, "uuid": "401a5351-f0b4-45a9-bced-6aaba7e90b9e", "comment": "Malware payload", "value": "14a32b29c6e49967e087a1ff1bb5d6486049bf9fedb2702fe445a12c91eeb3a2b53d6893670352a985a5edfcb7c7d1e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684708062, "uuid": "0eaec810-7890-4601-8dc8-41ad7cb84ad5", "value": "T1C13633CE148F59F6F99B1F7D37B28DABA590F14A6058D9008E2949A3D27AB71133C0F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684708062, "uuid": "756d5973-6d77-4666-9a40-e4320e57bdf2", "value": "9aebf3da4677af9275c461261e5abde3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684708062, "uuid": "1fc14a64-fc3a-4462-85c6-56b2f94dc86d", "value": "98304:DbcuGWyADhhIab1bvece79p6T215vhx8ovhqg4zi4RWouv60FFS7W:0dyhhIaZNeZy2Lb8Uf4G4EoE6t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684708062, "uuid": "9308f769-36a2-4bf0-909b-782521d70ee3", "value": 4865024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684708062, "uuid": "beb2e9ae-61e2-4642-a3ad-4d805d810c60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684708062, "uuid": "070393ea-6878-4d46-958e-a59c649b87f1", "value": "SecuriteInfo.com.Win64.PWSX-gen.23885.14599", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a50d0edd-f7ed-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684683556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683556, "uuid": "02bba301-b61c-4c19-9c50-722d7ce6986d", "comment": "Malware payload", "value": "ec5cdf61f137d0488c7d1e8e4c43a533", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683556, "uuid": "ada70628-7083-4490-883c-a7a6c60f0213", "comment": "Malware payload", "value": "1d12ecc2314514ea8c12d7607605f2f1339c6dcdedf1299b71b10d4f0c4b0467", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683556, "uuid": "33e972f5-d0ed-4bb6-b680-8deef1374c93", "comment": "Malware payload", "value": "4f19350c93eda06ba8f642ba2df32d957386e0fd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683556, "uuid": "a20d7593-c9b7-4f53-80c6-ad1bc3047621", "comment": "Malware payload", "value": "0030c466291111e4585132afef64a6bd770b035987243b87767a841f6e45741a207f0a71224e2acb25ea2c2ae7726a17", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684683556, "uuid": "5f1ffc83-66f9-4c83-ba4a-c6e237ee1023", "value": "T140B31B93F511D5B6F44AE73308D38B247270FAA14F53152263177BAAAE362D4386BF42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684683556, "uuid": "da6b835c-e2ee-4c51-80ab-283c0fa7ce03", "value": "3072:4wQeqacWucW0JcWcBeNX2WfKIwMI278ORF/qnFX3mzmmHqzTQKHKtW:4wQeqacWucW0JcWcBYmVM978Oap8mmHe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684683556, "uuid": "99d132f7-80ed-44b5-873b-e3ff964d7af2", "value": 109567, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684683556, "uuid": "c1a51d2d-0e25-4fac-a98e-0d78ae9b3dce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684683556, "uuid": "a0fcc79f-5e33-4c77-a562-db7df80a4ae0", "value": "ec5cdf61f137d0488c7d1e8e4c43a533", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11514fe2-f807-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684694475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694475, "uuid": "036a33f0-55c6-48e9-9ca4-3939ca6e4c61", "comment": "Malware payload", "value": "144a8b0f4148c499ba422bcfa7f1c0b4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694475, "uuid": "a987a11f-59aa-4efe-86e9-f4b5626cfd28", "comment": "Malware payload", "value": "1d36666a21257322d1f462a1c049dd6326ff8fa52537ac432c629374fcfb23c3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694475, "uuid": "e05e5c24-6d81-436d-b618-e816205ed539", "comment": "Malware payload", "value": "8d7805d1a028fc90c1306d28ca0c6aa9aceb21a8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694475, "uuid": "57d484a7-51c2-4995-9a8b-83b384a169a5", "comment": "Malware payload", "value": "c6417e7c5c1f9fe7fe196e87ce0ec4194429d164d0a6f8203f4394cea1d45b4bf76b0c56be9f6ce1342e1c4dc016e2aa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694475, "uuid": "15c96634-4c91-4590-811e-35764d469fcc", "value": "T16E6307D6F800DDBEF80AD73B4497490A7671A3E146821B36276779ABFC761D40822FC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694475, "uuid": "395a023a-2931-4e58-94d1-ec19f99f83de", "value": "1536:CDYVOPhZwFBMx8CK+5Ksj33ofjDFQbk0+Z0Z+wd:CDYVO5ZwLM1K834Ik0+2Z+wd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684694475, "uuid": "cb3d12bb-50ed-4889-ad48-9cac36ed1548", "value": 70808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684694475, "uuid": "ce9259a6-bed0-456d-89f4-09634a8d0a2b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694475, "uuid": "525a8b4a-38c0-4bd0-a2aa-b92aa9a1ebac", "value": "144a8b0f4148c499ba422bcfa7f1c0b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1433f252-f809-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684695339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695339, "uuid": "a8fe897d-bd6e-4eba-b9aa-02d1e2ca51f4", "comment": "Malware payload (RedLineStealer)", "value": "9b01716aa497e70a309e9836f00149c9", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695339, "uuid": "6cc22937-06ae-4570-bb76-7958323f9a0c", "comment": "Malware payload (RedLineStealer)", "value": "1d4c73f8c637702936fdff3c00464237de9a6f2795dc03845468e1b3f468e3ca", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695339, "uuid": "a466e78c-f69b-4815-bded-f467f67c9c2c", "comment": "Malware payload (RedLineStealer)", "value": "b11cfe6a369d35aaaf351791ea48a5940f781b09", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695339, "uuid": "2fe27b80-4baf-4409-95c0-6292e3ab4c6d", "comment": "Malware payload (RedLineStealer)", "value": "b3e8ed189dd45a143998be79055236291ce5e76b4d9b28ee5f8af5f24ffea55932e8e61360cb4aa33bb84b680a9ee422", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695339, "uuid": "4bd8f0e9-f780-4961-a4f4-46f2ba90d5cb", "value": "T17D252303BED88165DCB657B0A8F6938B0A327D72C971121B22C1FA321C735D4E6793A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695339, "uuid": "b670597b-d31e-4d97-aee7-873702a5e452", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695339, "uuid": "014f48d8-7f75-4ee8-bf91-ac43dbac6408", "value": "24576:xyR5N4EbrhHUAmqIJoeQ7fLBUp3PjgMxLrLju:krNnHUAmqR/zLOBrVxLrL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684695339, "uuid": "0024ca2d-1157-427d-a951-e30a3042328c", "value": 1046016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684695339, "uuid": "14105496-cf63-4f48-a4a7-a073a8d4ce05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695339, "uuid": "84030b71-c583-4715-9c69-7a5fcff1092c", "value": "pdf-readers934.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "741c7737-f801-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684692064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684692064, "uuid": "c8b72c9d-6b48-4582-84f0-a2980233d545", "comment": "Malware payload (Mirai)", "value": "fc7f867910903a7c84cc89060a8be9b3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684692064, "uuid": "bb20b821-7142-4a24-94dc-d694724431f6", "comment": "Malware payload (Mirai)", "value": "1e2f44efe3cb61842e228b493db5e6f46886f621c846f6b102d06b3814dbc7e3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684692064, "uuid": "c24c4c41-227f-43c9-a504-2cba690e7c11", "comment": "Malware payload (Mirai)", "value": "27c59ef8e885e12eb9986c41a8d47d2f23e6cff0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684692064, "uuid": "112032a8-c09c-4916-aa9e-47f5725343eb", "comment": "Malware payload (Mirai)", "value": "08ee25facb47655e711b3d592646e23116a2189a8b1e7913b4a457b31ba4f14b126390c75aebf29bf7c6f4b04ad7245b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684692064, "uuid": "337afe75-2475-421d-bd9d-a9d518a50709", "value": "T1F6631885B881A626C3C2467BFE5F018D332957D8D2DB33038D296B90778B85F0E67B46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684692064, "uuid": "fed98807-8696-48d6-a3fc-1edb79355c4b", "value": "1536:MuZP3cp0EsHdmL+zVWK5jcWDU31M2ZmpQ6j951IX0QsvDF:MuZiqvtZ21MCmy6jtCSDF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684692064, "uuid": "862e963a-c622-4d29-8863-4c26b18cb881", "value": 71176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684692064, "uuid": "558247ec-c422-45f5-9f02-32d3f45c379c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684692064, "uuid": "807ce6db-0ab8-4822-b4e4-77e4e7fcd220", "value": "fc7f867910903a7c84cc89060a8be9b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db3c43b4-f7c8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1684667756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667756, "uuid": "b49ab316-febd-4601-b4e6-673cd2568f8e", "comment": "Malware payload (Stop)", "value": "586753ba29361f419f1d6f442c067ae0", "object_relation": "md5", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667756, "uuid": "3691d8a8-b403-4464-b81a-c460bf9eb0e0", "comment": "Malware payload (Stop)", "value": "1e806984df9f5d8debae45e947e3f472fe4aa1b484ed794b9a2b0dd7204511a4", "object_relation": "sha256", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667756, "uuid": "c8db4c42-1be8-4029-bcec-53cff05efd39", "comment": "Malware payload (Stop)", "value": "bb0eeca99d83d08d005e72e132c3825dee193c9e", "object_relation": "sha1", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667756, "uuid": "b5acf4eb-9cd4-43f7-9d7d-7351fe9a3ff3", "comment": "Malware payload (Stop)", "value": "9d35fb1aa1088da2999b369d0dd9fe92c7f62dbcf6404f6094f32dbb513c61f73b8aa8c919384c4be15f9973fed07b84", "object_relation": "sha3-384", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667756, "uuid": "539feda3-fad7-487c-a833-005fbb070b39", "value": "T13E05E113A2D1BD61E52246729E2EE6F8721EF9614F183BD72218AFEF14701F2C172356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667756, "uuid": "2f43244a-0dbf-4bb6-a182-24092498543a", "value": "b8e0cca9c8daf9ab8d5b3be250b7f319", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667756, "uuid": "004df2b0-2eaa-472d-88e1-feedbd367e97", "value": "12288:wiJ5lBejP1oZimpJFQIXCn512yzIcrC6BvpAvpq9kxwv50s6+:wojBejNJmZy51ycZdmx+50b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667756, "uuid": "aace2334-66a8-4a12-b8e2-52fc6fbac8bc", "value": 847872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667756, "uuid": "1a656232-39f4-492b-81d9-2d7e66904a4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667756, "uuid": "49d2751d-15fe-4f79-94f8-4a7e91321a74", "value": "LightCheats609.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec838f1d-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684680670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680670, "uuid": "954e77a6-a622-4ede-b549-c92c5303eb54", "comment": "Malware payload (RedLineStealer)", "value": "92c034906d72d074b750cc3ca46e209f", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680670, "uuid": "34d2b765-d860-4a88-b0be-992e6e38c551", "comment": "Malware payload (RedLineStealer)", "value": "1ea3ca02b4a845bbc44cb1a116fca16efff370b9f30839a1f2d28e00ba228456", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680670, "uuid": "e4377765-96f5-4360-8cb3-c131b6c53ec8", "comment": "Malware payload (RedLineStealer)", "value": "f495882afa8363aa63c2cc3fd8163a314637e15f", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680670, "uuid": "e01194b2-1caf-45e5-879a-933b9cac526e", "comment": "Malware payload (RedLineStealer)", "value": "f3da811f96678493993f8fd9e029f4f282451324d8124d13130384352622a0c8381ad91f9844732f03e54fd00595a3e6", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680670, "uuid": "6f8ff300-4c32-4e8f-88e0-6bab18923e91", "value": "T14B25221FBBC9413ACCB90B7458F6A3476A32BC624DB4AB6B274466195C732C1923173F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680670, "uuid": "8e64a7f5-db6a-44e2-a3b8-b24f661eb489", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680670, "uuid": "d209561c-06c2-4970-93bb-b19f30a8d1d8", "value": "24576:dytN3Y4xfq0QMObi1MiDtzWCvrXXyqPrb7m7rerOf:4tNOMxdryAbqOC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680670, "uuid": "ba3acbc1-5b70-45f1-a416-0b305c18cb7e", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680670, "uuid": "ae7ff313-c01c-4f61-9b97-6feca980ba17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680670, "uuid": "cf13e113-07df-4e0c-abc6-523b81593037", "value": "server994.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36c16fb1-f7b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684658460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658460, "uuid": "44b3f5f7-6ef7-44e0-983c-4c86643cb406", "comment": "Malware payload (RedLineStealer)", "value": "5b325c05359acb1c5f660b3f6228b9ee", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658460, "uuid": "4763b739-a874-41e3-81fa-257734e56247", "comment": "Malware payload (RedLineStealer)", "value": "1efc11a4786d484bcf4c467aea9ad422c8a3dd2ca7350dc0c918d83c18afe144", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658460, "uuid": "716d88a8-1b67-4648-a4b4-4f9bfb096a14", "comment": "Malware payload (RedLineStealer)", "value": "b98abb8fa3a765a9a530461c2ce693af2af4a4d2", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658460, "uuid": "a8eec47a-7b07-47df-869d-8282554c7fe2", "comment": "Malware payload (RedLineStealer)", "value": "e4f1226992662a792637510a6213f538d5b0b11b055fd73b6f1a119e7fb352a214b15bff3872d4c066f3229a344af2e6", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658460, "uuid": "dc492cc7-9e99-4a30-9665-fb8809fb5bec", "value": "T127252303B9D89472D8B627B084F303D30735BCB18D3486577A4A6D6E6EF27E0697076A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658460, "uuid": "603a57f5-8153-4dd4-87f1-6347c4b306cf", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658460, "uuid": "7726c474-4683-4d76-a600-e851b5f60a7f", "value": "12288:5Mr4y90GzPgTW4N2tQAseToVjcRqa07ctjZSDF+m6BWZ7H5BUwOLFEX+8be3syTx:xytz/8PVAqVctqFN7z5BUwOCLbedUT0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684658460, "uuid": "5faf5575-7967-4f6b-b3ce-411031bcfa4b", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684658460, "uuid": "f33be582-671e-47e3-9882-b70f2c7d4776", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658460, "uuid": "1a8052cc-791b-43db-94c1-74d9b6d6d926", "value": "multiplayer647.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "319b4b18-f7b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684658452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658452, "uuid": "8a192ef2-884e-40fb-978f-909b03e55722", "comment": "Malware payload (RedLineStealer)", "value": "40c2dc8048353bec805665e51da2f68e", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658452, "uuid": "6fd0a8da-933f-4382-8b84-68407bfdc550", "comment": "Malware payload (RedLineStealer)", "value": "1f241dd1165f4b2594183eee586e32f823496a2f192e435826f351ca82a9ca11", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658452, "uuid": "2ed2f6eb-4357-4512-acb9-9e92a9c124cd", "comment": "Malware payload (RedLineStealer)", "value": "e19b837debfd5d07dc9d90c61af10f75c33b5bbc", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658452, "uuid": "64a66918-457c-483b-9665-2be5a656a164", "comment": "Malware payload (RedLineStealer)", "value": "24dddaecddd397c0a7ac45647c8ec5a9fa5623242481e3f117273fae95b41f2d8f973ecc2467d6ed929dd98324b762fe", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658452, "uuid": "3f229c1b-0bc2-42a7-b6c5-c47fd9213646", "value": "T118252322A9C98932ED752330A8F607C70B3AFC909C36532B27555D990CB79A1A773737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658452, "uuid": "0a10c3c2-903f-434a-8213-db93bc491665", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658452, "uuid": "c579fa1b-3102-4522-9616-d2068321a29c", "value": "24576:tyuEnK305YpfJJpKqDII3AgHuaERgpXzDf/7ggvgRb7u4Cp:IEEepfJJYq0WzrooXzDJgV7u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684658452, "uuid": "08abb974-42f1-4199-94a7-3f6958b1b4e8", "value": 1054208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684658452, "uuid": "4e3b2801-782f-4566-99f9-f55c4c250d2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658452, "uuid": "b11f4098-adaf-4c99-81ea-6e01b68182ac", "value": "interface218.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7684f50-f808-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684695291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695291, "uuid": "44feccc2-16b8-48ab-b79e-c72114d74e0f", "comment": "Malware payload (RedLineStealer)", "value": "837064bb93570cdaf1844726af338aa3", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695291, "uuid": "133beb9e-319e-4e73-9ea1-d5ea8fa29d8d", "comment": "Malware payload (RedLineStealer)", "value": "1f3a2858abc68862719e688881267ddca9f6fed64cb4add1729693e8531666b5", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695291, "uuid": "29996508-23f6-48f5-a51c-03ae5fe8df47", "comment": "Malware payload (RedLineStealer)", "value": "3ddb33f0c95cf8caae1c4e678da334f100c84f6d", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695291, "uuid": "af8260a8-8e46-4deb-892f-28a04a8945ff", "comment": "Malware payload (RedLineStealer)", "value": "d0de74fe1db364311403e60d1d740dc50c8edaa78f95bba83ddb24fa3ca981dc99cf496ac4bc9d607fe289f036d8e154", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695291, "uuid": "c45c93ce-e7d7-40b9-840d-34b2c26f9529", "value": "T110252303AAEC4033DCB41B747CF6168B0B31BDF69975966F22959B9F1873680A13136E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695291, "uuid": "d748ec19-31f6-4966-b9af-d2b7c489d511", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695291, "uuid": "87d620fb-37f0-4a3b-a966-8182a4e97b38", "value": "24576:+yEMYG2fqeHYQuUjqzbHoSry6IbNqSUWPrOB5WJTb:NYXjHYPUjq/HQbAXWPCB8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684695291, "uuid": "e0b1c8f1-5826-47b4-bdb9-c51f870abd43", "value": 1056256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684695291, "uuid": "cfec4b0f-22b7-4618-81c2-3e65ba7a0d41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695291, "uuid": "7044852e-c3b3-4225-a230-bd450a87a9c4", "value": "editor403.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e596625b-f7d0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684671209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671209, "uuid": "0e68fe88-e156-479f-ad93-64ff6d13e690", "comment": "Malware payload (RedLineStealer)", "value": "43f59efb7beb8fb4ff832dac2a58dfa6", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671209, "uuid": "6fb5900b-9840-4ef5-a1ab-94312f8687a7", "comment": "Malware payload (RedLineStealer)", "value": "1f72fd8ec18f504c83ade71670a6a4a8a4a0b9c55cefd34831dc84d989bc7680", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671209, "uuid": "094c2f3b-4470-485a-9764-5b7d440715df", "comment": "Malware payload (RedLineStealer)", "value": "0cffe401a7e1fbf0fd65aa7f4412e37d4c3d132d", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671209, "uuid": "9c0af614-4be2-4382-866a-74a9b659c8f0", "comment": "Malware payload (RedLineStealer)", "value": "b5b46ee3991a7902de766cb2cbdec08add3e44ecfb64d765802d579711bdd335ceae5075aabcd9108bc8e382f438bd3c", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671209, "uuid": "179a10b4-cc95-49de-a705-a59a8d2b3267", "value": "T1EA252252AAD9E0A2D9F427719CF753831B337CA1AC38822B2BC62D5A58B21C1547477F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671209, "uuid": "a8f0634a-d515-4da3-bfe4-56460fdc8f97", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671209, "uuid": "c3bd6e33-8d75-4f3d-82d7-143274575629", "value": "24576:vyBtGvQ2i4XX5rV4xEm3QeMjjsEw/RuUcr/xzQz6:6BAiySAeYj3qCxK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684671209, "uuid": "eee1e52e-9c98-47bb-a6cc-610889fab333", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684671209, "uuid": "4f9560e9-6bf3-4bdf-a66c-70db61682429", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671209, "uuid": "455f7ba2-6874-4ea5-aaf8-efc66b89fed3", "value": "999297.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57a1925b-f7a9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684654221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684654221, "uuid": "a734fdf5-d994-44a9-9da9-a1e6d7c7c306", "comment": "Malware payload (RedLineStealer)", "value": "47befb332e822183af4ee085bc652949", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684654221, "uuid": "83bca84b-136c-4b29-8ec4-ea3a180743b9", "comment": "Malware payload (RedLineStealer)", "value": "1f79ab2cc38a6f1e9393ff4dd06a6df433690311378122776375072c008eaf27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684654221, "uuid": "10c7f2b0-d2e2-4919-9177-6d27c1d476dd", "comment": "Malware payload (RedLineStealer)", "value": "5a774cdc9fc919f3104780b8dfb4ef0804b2e299", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684654221, "uuid": "d99d4f67-537e-4cd1-bffd-9d99f2721c5c", "comment": "Malware payload (RedLineStealer)", "value": "c705b2994208c6725d1b91d29628881cda8f6d4f3f8f141c9573a2e8cd040d202707ceed774424e561d29316ba8badf4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684654221, "uuid": "a76f0744-bea5-4c57-8bae-6b9cd4d01e03", "value": "T18C252301B7DD8073DCB41BB018FA536B1A727EB09D70622B3648982F1D315E4B97A7A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684654221, "uuid": "a30945fe-debd-4d7e-a3ee-d9ff02b6ccc5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684654221, "uuid": "49e1e521-529d-4ca3-8e20-8b3850a6fe86", "value": "24576:TyB+FNHQMZrJC6V1qBQN4u5lo3iPN+caqoZsI:mmNHFZrUgq64ioUgcb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684654221, "uuid": "c2f3b163-13d6-4583-962c-d64a103bb364", "value": 1054208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684654221, "uuid": "3e230da4-c8aa-43e4-b720-c5ac8be78e7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684654221, "uuid": "60728092-8640-4b70-a8c2-5da414098c50", "value": "47befb332e822183af4ee085bc652949.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c983597-f7b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684658416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658416, "uuid": "bdaae25e-1737-4253-b25e-b3df2a787e1e", "comment": "Malware payload (RedLineStealer)", "value": "85c738b7cd0240ae958d83c89af77822", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658416, "uuid": "f5c43573-51fc-4312-bdd2-769cf8f4c256", "comment": "Malware payload (RedLineStealer)", "value": "1f82d8215ce77f3f82b98bff653f05bb063437c6c8aab08285044c916ef32e92", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658416, "uuid": "c5443589-9c29-4042-8284-e4646c2ce88a", "comment": "Malware payload (RedLineStealer)", "value": "84e4acb965f74022c52ec61590b83e9115302014", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658416, "uuid": "2abeadb6-a2fa-4334-899c-449eb813b3e3", "comment": "Malware payload (RedLineStealer)", "value": "4a6cb7cb67c3bf9b1de066229ec516ad4ccc6ffea2d06e4037edb4a8c5b89ef84f11dc97f7e4f41847b809eace5af798", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658416, "uuid": "57a53715-33aa-46ac-aa05-b8093df9dad7", "value": "T18D252303BAD04033C5356F71A5FB6A831F38BD52DA74D71A278AA92E5C7398488713B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658416, "uuid": "207c6f98-6623-417d-978e-15ead869225a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658416, "uuid": "461de3ca-533e-4544-8bac-ba036b7f08a2", "value": "24576:rywXWKpqsd8qTRFa0njZgIguAZmU90rsu:eTKksd8qlUGmzhh04", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684658416, "uuid": "7ba8f424-7899-4dc4-98d1-8b30608dd6dd", "value": 1046016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684658416, "uuid": "6fcb1be6-fb1a-4e2f-b78f-3c329f9b5c7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658416, "uuid": "4941d8b0-0d75-4c6c-b3ad-9a2958ac317b", "value": "bils748.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5d17601-f7a8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684653922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684653922, "uuid": "431395f3-9956-4da9-9aee-3945694b53de", "comment": "Malware payload (Amadey)", "value": "038011b7905f3e76e716e8419a71c449", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684653922, "uuid": "971d8f19-90e2-4a44-9e0f-b0cb5fb215b6", "comment": "Malware payload (Amadey)", "value": "1f94732ba4e2d0f1bac134b1ff0bbfc8b1d19b637fda11b3998eba3eb50672ee", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684653922, "uuid": "fd4330d4-bbb3-4ffa-b432-a987172c1262", "comment": "Malware payload (Amadey)", "value": "2ce18622741ecfa3726859e9dcc1b40eb7716b72", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684653922, "uuid": "090b3abd-409a-47f6-8e01-0bb005eafc40", "comment": "Malware payload (Amadey)", "value": "c221474b5ebc8ecbefd31fcbb0bb7d92468965c2b457aebc689f6ceed037d78f32010c5742f04af58619d61c77058ac3", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684653922, "uuid": "aba8446f-6e32-4831-9849-dec9844f71d9", "value": "T196252311AFC89435D8B41F3090FB0387273A7FF18D39451B3A16AD5A2C726999A3673B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684653922, "uuid": "e6ccf0c2-c984-4de4-a04a-2af9da24acf1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684653922, "uuid": "f4654c57-7a6e-4daf-903a-665aa554f13b", "value": "24576:my5ftAmQHeJdqcNFgylX26u6MhL3B3eswVJs6Ck:1DAmQHeJdqnyVxupTnn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684653922, "uuid": "1de19930-da5d-4960-8ad9-eddc91264000", "value": 1046016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684653922, "uuid": "90ddf77c-b870-4759-ae96-60e8373d9401", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684653922, "uuid": "7ffd7a17-cd83-4c7a-996a-2321064c2a97", "value": "038011b7905f3e76e716e8419a71c449.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bde70e48-f7e5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684680162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680162, "uuid": "ac37b273-e7db-4c14-9ada-63e15f446abe", "comment": "Malware payload (RedLineStealer)", "value": "aa11978545250a2ae6714185978a696a", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680162, "uuid": "4cf151a9-647e-4329-9546-50094f23fac4", "comment": "Malware payload (RedLineStealer)", "value": "1f9d33eaf461731f634e09f5038ade8fe229e250fa7fc41cd2dd11b4cb4ad73f", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680162, "uuid": "2e87c40d-36f6-49be-94f5-becb3964bd88", "comment": "Malware payload (RedLineStealer)", "value": "79d90e35f80b25558d3dba4645b689d98f9022ca", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680162, "uuid": "04556973-0b27-4cc2-ade7-e2ee14b48043", "comment": "Malware payload (RedLineStealer)", "value": "f391e827b1bb4a4f0021b2a8e0304a122c5f54cdde2000a9e2f44d96513a81b8d540d7d02f76e0eb52b3bc5058c8a59e", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680162, "uuid": "14595447-748b-4a10-a64b-84af5b8dbbba", "value": "T17E252307ABC8D172ECB26B3495F714C70B32BD74CAB4827A2A11D58E5CB3591AA31773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680162, "uuid": "2c8061e2-0911-4477-8afa-d01423c85fd1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680162, "uuid": "d599c438-097b-4d9f-9371-b21fbc5ebbd5", "value": "24576:JyWExDMwelHfTEqSXdOuqZWXVezaTY1tK4lahgOhqhrxo:8vxgwelHfTEqSXqZWktKIy6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680162, "uuid": "5964605d-5d57-40e9-83c1-c06f045aeefe", "value": 1046016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680162, "uuid": "eee1edb0-84d6-4d83-9567-e019d5e9ee31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680162, "uuid": "9187b297-5e85-4131-bf0e-f0ff8fb4b766", "value": "router529.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "593b25c4-f7b2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684658089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658089, "uuid": "ea9b9f92-608f-4931-a155-2247746e7ac4", "comment": "Malware payload (RedLineStealer)", "value": "26343b98b853cc4cee84d91b812078c5", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658089, "uuid": "998ac68a-02e0-48ef-92c8-f88e0bd5dbc2", "comment": "Malware payload (RedLineStealer)", "value": "1fba179b4f5fc8d20f4a5a27f544199b9039c27989b861edf7dd530ee9874b54", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658089, "uuid": "572ff97e-ded2-4c39-b66d-ece8bd84cb06", "comment": "Malware payload (RedLineStealer)", "value": "2b9c4a731685f9977329c96f1e718b2c2e85d7cc", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658089, "uuid": "8367669d-cd54-4933-9f40-7c0d811e0c2b", "comment": "Malware payload (RedLineStealer)", "value": "1d72398338c5a5b1b464faa1c2bd06735ee2a840888c1b48e1616a36a76747c016de6739edebb9129a73d49e905598ba", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658089, "uuid": "a9160ba1-8886-45a8-a640-666b0a48d8ed", "value": "T1CC252306B6E89071CCAA6B7498FF02530E37FEE04838C37B27988D959D716A09935777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658089, "uuid": "63dd6b37-507c-4486-aafc-88401dca24dc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658089, "uuid": "3df3dfef-7510-4fce-939b-0516c443a0d9", "value": "24576:CybchFqN0HasEq8TWq53fJ++dfqe7o6DjRr4QXSgg:pbch0VHqWWqxaODjV4l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684658089, "uuid": "98be332f-d041-4c3a-9876-759fec423b3a", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684658089, "uuid": "97fbf557-6784-4427-ba50-8c7cdd76bb38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658089, "uuid": "dd60f73b-92b5-4c53-afc3-24a9e476aec2", "value": "scanner.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e2d561f-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684680484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680484, "uuid": "e54d535a-1b0a-4301-9c4b-1b2919feab47", "comment": "Malware payload", "value": "8911d1005401dc96fc544dc3cb09a0cf", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680484, "uuid": "ba187d1f-ad24-456d-b984-e45e1f39e84f", "comment": "Malware payload", "value": "1fc026e77cb43c78f03df68f02d4e703075815737f87e5d0ba5f92ed341d8807", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680484, "uuid": "610c17f9-e9b3-46c7-970d-f83396b0388b", "comment": "Malware payload", "value": "63e7c84a1b02d6056924112dd79da0559e203a06", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680484, "uuid": "26b04247-64ed-48c9-9d26-3b6a60ef114f", "comment": "Malware payload", "value": "721b0e406eb6004df4eaf70fde0028e06a90d5505f6f84c10359ea21181a0be5510bb34e2a78a22c50ed42f956db70d0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680484, "uuid": "bec84671-20f2-4548-b822-63ab1457f9f3", "value": "T1FBE49E2AC8E2D0B0FBF8C4B6CA7D4AD120780A6F00BE33774553ABF1E5712597597662", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680484, "uuid": "c5ba0c79-5e9e-49bf-9d77-0ccba10e15ce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680484, "uuid": "a2d009e7-c2bb-45e1-a145-9ca658e3a910", "value": "12288:VSCOOG8eRibYEA+4pO4VBSt3I92EulzQ/lZ3i04JiZKxNDoNbyTivcjtEaCbG92J:QCXYEopBLD+yFVQO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680484, "uuid": "0f157a14-7974-43e9-acf6-8674e831fecd", "value": 667136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680484, "uuid": "b49c61c2-3177-424f-b897-bedf0397de3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680484, "uuid": "3435e480-ebd7-4af5-bf34-b190f2685b4e", "value": "AI388.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9da4349d-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684680537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680537, "uuid": "82a80529-5dc3-4aac-ae96-1cbde2c7765d", "comment": "Malware payload (Amadey)", "value": "82c237fd4ee7ab1305c0946cb70f16c4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680537, "uuid": "f86aa69a-2ad8-4b6b-8670-0d77ee8df861", "comment": "Malware payload (Amadey)", "value": "1fc999143b9d7c98ae94c8a1cfc64fd28345247f9745d803d8d245fda3129525", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680537, "uuid": "b47df87c-1952-4433-82ac-814cd49887e7", "comment": "Malware payload (Amadey)", "value": "a0a16b60e3dc181ddb4457d5b7d29c6094944188", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680537, "uuid": "5f1ec4e1-d795-4274-8132-6ccee7597589", "comment": "Malware payload (Amadey)", "value": "2d58b51cbf19b9bbb6df0fdbe2cdd737607544018aefe72e86484804ef0ed890e791f7632ac442bd74bbf0d6257dd000", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680537, "uuid": "cafee068-efb8-4b68-9e5d-8727db84fad5", "value": "T1712523929EE90073D9F6437098F647830B72B8A18DB9574B23499D8E4C72EC59D3372B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680537, "uuid": "785f855c-f1cb-4d2f-987e-c19993c7f76a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680537, "uuid": "2fdc7b1e-877c-40bf-9aa8-b4daf7f8d64b", "value": "24576:+y9SkcWbCF+iLqH1u7DxED/hy8juAr4LQgyVRROcDrxLNS:N98W+4iLqVuJEDpXjuF0gyXROcDn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680537, "uuid": "76aaeed0-ecd6-427c-93c1-70ba59d98f67", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680537, "uuid": "b934d235-a3b4-4262-a96b-ccf837794961", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680537, "uuid": "ad5836ba-18cc-4ab9-8949-1dfed95eec8c", "value": "controller766.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a675171c-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684680552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680552, "uuid": "df6e6990-345e-4593-b983-9fc8f873d6ab", "comment": "Malware payload (Amadey)", "value": "5100dd50b3c907be41a69ed96b1c8512", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680552, "uuid": "e093569e-8393-4f3d-a483-3e6c4e874677", "comment": "Malware payload (Amadey)", "value": "1fd9d2ec1ddef2047850a16bf0603fdc5c6514595047a93e8a070e7563dce2c8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680552, "uuid": "779fe23d-692a-4004-8266-8dc8d25df45b", "comment": "Malware payload (Amadey)", "value": "5767de6c82ea05d5185b9aded1d510aa59de48b5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680552, "uuid": "ec212927-8f32-407c-aee3-74429a1b64a4", "comment": "Malware payload (Amadey)", "value": "a035f1eb275af6e4cada23796fa388339a92e6f955053cc1b6c09b30ebbd2443ced5e5c480b7f7f8f4a32b675623acc9", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680552, "uuid": "c11dd07e-2d96-46b6-aa55-531bcd760547", "value": "T18B25230BFAC89037D8A52BB068F753870A317DB15EB0577B2B41AD1B0C73982A573766", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680552, "uuid": "fa6ac290-878c-4038-ad7d-524c188261c0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680552, "uuid": "fbae6603-5e9f-490b-bd6d-339716dca261", "value": "24576:LyXLjYVupD1bQFH6sBq6X4r0bkSFaU647k9k:+XLjMu5Z6H6sBq69r6Kk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680552, "uuid": "3993238b-44a1-4387-b175-e894fc860d0e", "value": 1046528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680552, "uuid": "afb747bf-1bd1-4d7e-b84f-9719839252b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680552, "uuid": "f3f29f43-e209-48d2-978a-f47587971bc1", "value": "discord_token559.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58cdf07c-f7a9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684654222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684654222, "uuid": "fb2c91e7-8a14-4050-8ee6-4adc662eda42", "comment": "Malware payload (RedLineStealer)", "value": "9eb3d21dc2042401cc9aa6ae8aeafe7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684654222, "uuid": "af5827d3-eb4a-4605-aaeb-77cb432ed5a7", "comment": "Malware payload (RedLineStealer)", "value": "1fe4e3816036b4cb60795b97c6b105f55d81906520c6c122fac2f8e551b34d83", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684654222, "uuid": "5174ff50-68cf-4421-a99e-6e37b0770235", "comment": "Malware payload (RedLineStealer)", "value": "553a8f02721c10b2bad54c90d8897e912f715e57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684654222, "uuid": "faeaaadf-ffdf-49c8-bd09-6f83f1d58ee7", "comment": "Malware payload (RedLineStealer)", "value": "1f22eeaacafcbc9a491dfaae03ec97c9ba834c5ec329c4f8ba8d470e9073de4159d8cca8de80a3f3e36c3fcc9f50838b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684654222, "uuid": "a49d2647-0a40-4b89-b240-d4f10cd83567", "value": "T175252393B9C99036D8716B3078FA42D30B75FD312AA5876B2389F84F5C326C4E4717A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684654222, "uuid": "1539ce5a-982e-488e-ac3e-d603dc2e7206", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684654222, "uuid": "15d0ab6a-83aa-4d13-8844-13e64c72e79f", "value": "24576:+yodfeEaWoULvHnaeqMUoECGGAC7dUMS9F5eHnls5d0Voxb6m2:NOeZWJ/jqYECfAYwFynls8Vox", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684654222, "uuid": "f28b29c8-b013-419c-abad-4c55cb85f530", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684654222, "uuid": "b4ba372f-9bcd-4a61-a24c-62722ebf304c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684654222, "uuid": "080d46f9-a6d1-4d81-a1c3-51f0f237d0c4", "value": "9eb3d21dc2042401cc9aa6ae8aeafe7b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d12814c-f7c8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1684667598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667598, "uuid": "f96e8f41-b90e-4a74-96fa-9d24edc3147a", "comment": "Malware payload (Stop)", "value": "8ecee84b6646e1e79554f126e40feec8", "object_relation": "md5", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667598, "uuid": "95b8a663-36e2-4f40-9bd5-ae5264072c71", "comment": "Malware payload (Stop)", "value": "1fe581e23ffc44ac1a550c3a05818f1d81e88c24f96dc8369fd020361175f5d5", "object_relation": "sha256", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667598, "uuid": "c6a09f45-ec2c-4d5d-aacf-da36c06edfaa", "comment": "Malware payload (Stop)", "value": "d6dc35b2f20bcec1c8916cb932583c048a80dd8c", "object_relation": "sha1", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667598, "uuid": "2a59281e-c932-41d2-ad2b-82fcf91c1f2f", "comment": "Malware payload (Stop)", "value": "554f00dcd50ce782eb6c0b928ec6f1d02f7ebed6a70d6542c398ac04003068fab865f021a1c6d416c68fd2781aeecde3", "object_relation": "sha3-384", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667598, "uuid": "1e5adae1-3e3d-4a4b-9053-f4ec9f043614", "value": "T1570501326191D8F1F6294731CC19CAF466EEB951BF151BC733C82B6B19312E2CA7AB41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667598, "uuid": "0a85c404-9d0e-43f9-acf8-a78466fe36fe", "value": "bb27c4958c76443fcfe46f9765d838a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667598, "uuid": "c0ea589c-4efc-455b-9205-c7ddae47fa73", "value": "12288:Mcqut1GUl31XJ/GnhBRtwQMEH6ZSTT6b2AO/4DLdxuJPvBEoV:Mc7ZDXJ/Gnh7C166ZSTO6uOPvBEoV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667598, "uuid": "d913cf08-874c-40a6-8356-2d200cd5dad9", "value": 806400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667598, "uuid": "a28056c7-da92-4f0e-a50b-2f2eb5e45e27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667598, "uuid": "1fdbecbe-76df-4427-a1f4-00220b6a66be", "value": "extractor666.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62b211ed-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684680438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680438, "uuid": "439c353b-29fe-4f23-8b27-9df9a94bfd48", "comment": "Malware payload (RedLineStealer)", "value": "255f3e74dd25b70d846db61d7c043738", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680438, "uuid": "41e35808-507d-457c-acb0-8509319b5e63", "comment": "Malware payload (RedLineStealer)", "value": "2006cded63414e3b4d32ab761bae64470dff6201af9c163a708b851c1e7d1d6c", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680438, "uuid": "52ea6fb8-2120-42a1-afed-472937665997", "comment": "Malware payload (RedLineStealer)", "value": "0544f6e1b63b5ddb3125b409625d53d75288265f", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680438, "uuid": "5809a9bb-984e-49a4-88bc-f4045e32ca61", "comment": "Malware payload (RedLineStealer)", "value": "12a0efd41bd43e846a6dcfa45907c53b849db0e9883a99cae99efa856040b6839204cf3243c45e40b6e26f65205052c6", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680438, "uuid": "19dd3d2e-00ae-431c-81d3-4dcfe1e14394", "value": "T14F252303A6E85276DE76137049FA13531A32BDA04A39C35F6645D82E4CF31D8EE7236B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680438, "uuid": "424c93f5-8e9f-464e-810c-ab7aad01a5da", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680438, "uuid": "f1bfc2db-7ad3-4cc3-8e16-3f3d0f211ceb", "value": "24576:Ly4/pjzmqq/KTY/YAfyfKXaZ5kwL2j5Bf9+:+Wjzmqq/qYHyfKqZCZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680438, "uuid": "6c2fcb8c-ca2c-4b27-b230-1d0f2b193958", "value": 1046016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680438, "uuid": "4f6652c4-3347-40f8-ade3-0d2b7315b49c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680438, "uuid": "94cd9f36-a767-470a-b46e-3795c1a9d042", "value": "2467615.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc4f9f49-f7c5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684666442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666442, "uuid": "057ab5b4-ae62-4135-8015-5ed8077d468c", "comment": "Malware payload (Mirai)", "value": "7a41cd2d4528b15c60eef1286fdd510b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666442, "uuid": "6f73f547-b570-42db-8710-fc97d317ed52", "comment": "Malware payload (Mirai)", "value": "205964ae28f8397a59dc82ffe143957861092edc5c18b4da1896b3c8c32aca4c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666442, "uuid": "bb2a720a-e258-46e3-b5bf-0b2cfc8b04ee", "comment": "Malware payload (Mirai)", "value": "3b4533abd70cd184bb7bc8aae5030f9020ea56d6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666442, "uuid": "76a6f55c-f1f5-4dfe-9ca1-7502252ff3a2", "comment": "Malware payload (Mirai)", "value": "012b46af4dd1882cb29545832714deb42f8cf17780a10df3071b39496602cf251c2637e405bba1220182366a94e35a5d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666442, "uuid": "fed3a504-f2dd-40d4-b564-f1471017dde6", "value": "T135F2F171B449A522DBD04CB3E72F4B0125106CBEBE922132BBD4557839C98072CF689F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666442, "uuid": "9fbafe68-1443-461a-b79f-d39974879555", "value": "768:9fcd8mf94eX2omK0b7DEsA7oEOkMfqOhbXnaSviki3U4:9fcd8q94fomjb7gyESf3hbXnaSvikg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684666442, "uuid": "11fabfe6-1488-45a2-9424-d8007c235d6c", "value": 35964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684666442, "uuid": "a9e3d466-994e-40bc-afab-15b40255f673", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666442, "uuid": "952f0797-9662-4655-a13f-46b13f45ba23", "value": "7a41cd2d4528b15c60eef1286fdd510b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfa94e9d-f7b1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684657831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684657831, "uuid": "f683e5b3-3d43-4c0f-9f72-aa439f2e827c", "comment": "Malware payload (RedLineStealer)", "value": "3ddd00a3c40cb88598985acd84168611", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684657831, "uuid": "eca13b42-d816-436e-90fc-0b184b53bda6", "comment": "Malware payload (RedLineStealer)", "value": "2080521277cf0b8082ff6fd1378bdb2316e46501ecf7fa6e951aa7843cacf62b", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684657831, "uuid": "75223cf3-7a32-4b8a-a912-b2110abd6e1c", "comment": "Malware payload (RedLineStealer)", "value": "1eb886d9df022f87d400dc30da2a91cee6242e23", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684657831, "uuid": "5fde3366-fe98-4bc2-88a3-f703ca52b183", "comment": "Malware payload (RedLineStealer)", "value": "6852187bdb2be566b3cd80c60904e72fcc6bc668105304e6b5deed8b3b1ff258e3a44db1ea8aacdc3496586ce02b65e5", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684657831, "uuid": "8fd487bc-1d0e-4ec7-b106-d568d732aa0b", "value": "T1A7252343F6C8E463DD712B7198FA53A31B32FDE199B9524A23905E191C335A0E93273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684657831, "uuid": "86a0ce78-78b8-401d-8aff-df66d5a12ab8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684657831, "uuid": "46d7e2eb-aac1-4763-acf6-db8bb7a6e42f", "value": "24576:4y3aJ1MQOlgHh48qZudr6xJ+QAG6d1863DZMklo8C9R:/SMQBHh48q4doUd1VD3loB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684657831, "uuid": "3152a668-263b-4782-983d-e250329cef19", "value": 1046016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684657831, "uuid": "86868bd6-73f9-410e-a9df-42eaf8d32062", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684657831, "uuid": "799a11d9-9cc0-4f0e-bd27-10a13b2876b6", "value": "Unlock.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e73c655-f7b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684658393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658393, "uuid": "90370f11-05e9-4186-9fef-ff74cc3b89ae", "comment": "Malware payload (Amadey)", "value": "08f1c03b6dce74b5f78b6a1a9173376a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658393, "uuid": "a4672fce-bf3e-499a-a01f-f07c52e05466", "comment": "Malware payload (Amadey)", "value": "20bc198f991891e85f87e094bc451f9db4b81d9d4eb54a3160ac55e338664be0", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658393, "uuid": "ae29bf50-3015-4484-9364-cbed4394074a", "comment": "Malware payload (Amadey)", "value": "d15b888437d44808d34e603bda5e455b534df7c7", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658393, "uuid": "25be579b-7f2e-4f8e-8d66-8b4c52be019f", "comment": "Malware payload (Amadey)", "value": "0cbc7594749fe97ee3274d269f92f8abec0dd6f75885a49be09fb7931e25e4c1b805dea3d9397729ff117ad84b673b13", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658393, "uuid": "283a41dd-552f-4f8b-92a9-8a601fef9632", "value": "T132252317A2FD50B6DAF6277494FF47430F39BD508D34D36B5752AA4A1C72A80A2303AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658393, "uuid": "8436369f-8c80-4d93-9bce-8f0ef8e217cf", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658393, "uuid": "c6fdac76-557a-4d35-a657-4adf8fe3a08d", "value": "24576:ry1HMugWHaBEu3PHCVWf5JiDKSbBmBRpJM:eFO7EACV65JnsOR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684658393, "uuid": "105b78f0-144b-4725-80b7-19fe965a1dd8", "value": 1056256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684658393, "uuid": "d643974b-e4e3-4560-9435-016b2169aaab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658393, "uuid": "9fb8ec07-81ba-4f1f-af76-b8784d703bad", "value": "526634.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c49fe20e-f808-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684695206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695206, "uuid": "f7bb9121-0846-44bd-b582-2b037bca42cd", "comment": "Malware payload (RedLineStealer)", "value": "612f037739209ed00357fac9d08a6246", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695206, "uuid": "62c9b1bd-086e-4a79-9140-a7bf3768e81c", "comment": "Malware payload (RedLineStealer)", "value": "215f36dd040ccc7e4338b9e6f78fb336fa6d7e28cb0dc80513e8806fb90bd276", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695206, "uuid": "5dd93a08-ed8e-4717-9d4f-740b760ebf40", "comment": "Malware payload (RedLineStealer)", "value": "dffe0b2b07f532345a8e841e176f2c354eb29ca9", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695206, "uuid": "1a18a058-6acc-412b-87a9-fbb4ba078267", "comment": "Malware payload (RedLineStealer)", "value": "bfcf8f6da977816746ba5d090215258d9e2cdcf3f8a5344e1a6f48eacf92d2f1279ddda1c10a6473c41843a72ad19a83", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695206, "uuid": "71ed7c2a-98f6-47be-a1fc-a82cea0aca81", "value": "T1A3252312AAEAD172D5771B744CF602C30E37BAA2DA58435F33458E8B0CB3695A43176F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695206, "uuid": "d75ec49b-4192-4f17-bddb-d470ba5ccb3e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695206, "uuid": "161aabed-437e-4669-84a8-0c794a519a36", "value": "24576:FyR9FPPAWs4oYKHPPfIiFpuoyr0pmN1Bi2u:gRHH1spTHPPfVyoOJB1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684695206, "uuid": "e9acd3d0-a71d-4fc6-af13-cee3196376b8", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684695206, "uuid": "7e10e666-27bc-4136-b5d4-9150a01f0043", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695206, "uuid": "44fee434-95a1-450c-af19-b3af9cda5e82", "value": "2454677.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90cb9a09-f7c3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684665483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684665483, "uuid": "dda33fbb-8396-4431-ba4b-23c500ca532a", "comment": "Malware payload (Mirai)", "value": "8760b39d475d9af71c2db90c6d7ef17f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684665483, "uuid": "74de3239-a7ab-4d20-9a96-3e960cf65488", "comment": "Malware payload (Mirai)", "value": "21b1ea73407e3fc02d5fdf20db137b71c6a9caceaf5e13ff30bb8e0220242caf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684665483, "uuid": "4c139767-7b9b-4cb2-84b4-9e243351a458", "comment": "Malware payload (Mirai)", "value": "e852ff8bb688edcb2367614cc745f19733dd958a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684665483, "uuid": "74e1dec8-144b-4539-a22e-bd5278682ff5", "comment": "Malware payload (Mirai)", "value": "2176d2e6446dd1c77bfe257dbbfe9575ced455a7f109ee5ef62d6bf1a5ba8167777c87cb720f870e1b130f8157e41bca", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684665483, "uuid": "812c5c55-08e9-450d-8d97-9b99ad8ce3a7", "value": "T13C537C66D0B85DA4D49849B07618CDB49787A404AAD33FF1C687CF694807AECF109BFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684665483, "uuid": "35840db5-56f7-4823-ae32-89ee4b9374d0", "value": "768:6/BAQypMIae3xOqiwBAVmFEHzFMPBaEDiPV44g5N2tS7yTtTL5Qjiv0QD6in3kWB:6/2HmIaeIyehgTESOT8YUh/2VoCkG9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684665483, "uuid": "d17f57ba-0c1b-448a-9f1d-c0b41c291d08", "value": 63844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684665483, "uuid": "42f3dbc2-e3b0-4766-bc08-3b4acdf7197c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684665483, "uuid": "11a68419-411a-4010-9cc1-9e078818fbd6", "value": "8760b39d475d9af71c2db90c6d7ef17f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23056157-f7ef-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684684197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684684197, "uuid": "e65e36cb-45e1-4ea6-8d28-e11b46c31f7a", "comment": "Malware payload (Mirai)", "value": "a7628c93ec42d88fc331064b412ccecd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684684197, "uuid": "bd370532-f8c6-4c31-be19-b7168c0c867a", "comment": "Malware payload (Mirai)", "value": "21eeefbc8f8d31429c8353f2932fd1c332e2b27c856d3980c063515381f479dc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684684197, "uuid": "9a36cbe1-e411-4da4-bc0c-9a6b00e3a60a", "comment": "Malware payload (Mirai)", "value": "be873e8b33ec55006634f147f43436c60a9d0b19", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684684197, "uuid": "e8fb63fb-f22d-41dc-ae1b-417bb96e073f", "comment": "Malware payload (Mirai)", "value": "d5d8f2b8463f876e21512a5ba6ec852e88bc7a8105116a5a1508b410dc7220fe9f556541e67443cd400d2e45cfac9819", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684684197, "uuid": "2086d0a4-c209-4795-9fad-5082eedcd1bd", "value": "T1A183D606BB510FF7DC6FCD370AE91702348C594A22A97B367634D828F65B24B59E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684684197, "uuid": "9e72ff67-f933-4e04-8944-5d29810de288", "value": "1536:iVLyu95KX8kj752dCexuV/8UZlDwfkJ4MYfWa:iVLyMglFezxu5VD1eT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684684197, "uuid": "84998670-6a59-49a2-9bf8-85e733c5744f", "value": 84780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684684197, "uuid": "2b55eece-f77e-4099-9a01-cfbaf2d4d802", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684684197, "uuid": "c1ba621d-0fee-4b3c-a45d-6045382fea5a", "value": "a7628c93ec42d88fc331064b412ccecd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84037693-f7c6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684666750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666750, "uuid": "220122f0-919b-43a5-adb9-31c10ff81eda", "comment": "Malware payload (RedLineStealer)", "value": "3738469a024030a9123818a4c3aa6150", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666750, "uuid": "66e17b51-7135-470d-ba60-2742b73686fd", "comment": "Malware payload (RedLineStealer)", "value": "221275bf216ce1f4f6fa81248f3818559ce50a2f5759ef2629192e3c80a27701", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666750, "uuid": "d16f810d-5730-4941-bd94-eb3409b38d58", "comment": "Malware payload (RedLineStealer)", "value": "5343399da0dede2744c52b13f818a554258d5ba4", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666750, "uuid": "b9e652ae-bbdc-444a-89a8-a5979275dd09", "comment": "Malware payload (RedLineStealer)", "value": "feaad6a2df88977ee821446a910fcbfed6efbdeaab5a137cf9899565768d1e1f9f0d9173f7fcc889d64581b01c2d3612", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666750, "uuid": "013586b2-ba11-4593-b161-cb2b6f06a9a1", "value": "T179252303AFE89133D9761B765CF303570636BCA48C24931B2B95AA4A4D73B406A7277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666750, "uuid": "2a7502b2-6413-4d9d-81d4-21d9316c7fca", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666750, "uuid": "219f2392-dbf9-47fe-a9a3-18776fe7ae7a", "value": "24576:PykKKL+F+4quLqjORW2JtdGtpyWwTpOsXk9k92NFJ0g:ajF9JLqqRH0tY3OsXPYK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684666750, "uuid": "d8353f89-5bc5-46b0-915c-7d2d1cae04e8", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684666750, "uuid": "497174a8-dfe7-4598-a612-d6578e991fc5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666750, "uuid": "343cf535-2823-422b-87cd-b1282b05f221", "value": "player135.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60f54f5a-f813-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684699763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684699763, "uuid": "81a6d2c5-415e-4d96-96bc-027c31e21e4d", "comment": "Malware payload", "value": "cc20a54b21aac972382d5ad53f67e91b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684699763, "uuid": "cca9863c-2881-4663-899c-f7562d262a36", "comment": "Malware payload", "value": "223f3184613545c3afee56ade4e84e731b7cca237acfab14dbdd58cc8deb48f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684699763, "uuid": "ba3d1c82-e44b-48c4-9309-4adbefed1e11", "comment": "Malware payload", "value": "855421ce1addf6efc28f31818d39b2a061655900", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684699763, "uuid": "f23cddde-2ba4-45a2-9102-d048290a1d6a", "comment": "Malware payload", "value": "5f9b5a66c782554cb4a594a4e7ee23474d9369ee29050b338f478b1e19bb066acd9be5e859312b925b1b69743d69d6d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684699763, "uuid": "c800b427-6371-4e5c-86aa-d750635ede6f", "value": "T16C165C54FB43A0F0D6530EB0915FE63BDA206E198030EEBBEF89EB08F473B556558256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684699763, "uuid": "3ca5ec4d-6fb9-4309-aab3-bb5365f0bc1b", "value": "0dba8faa26a8f13535abbdedc90e7fa9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684699763, "uuid": "6a189a74-a69b-4230-89bf-2b612284c457", "value": "98304:2RF+GA7R+afsMveTDN6US+8B4JZZACYrsa:XGANzmTDN6UOBIZACYrs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684699763, "uuid": "123a67f7-d68a-4bf6-b5d9-5c8c873f25b9", "value": 4076544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684699763, "uuid": "ce9140b0-a5b6-4af1-8fa7-bc5c01d7c534", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684699763, "uuid": "a82f38cb-3ab3-4203-a0f5-e81dd5e08189", "value": "xmrig32.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb827d58-f7c7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684667273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667273, "uuid": "80f29d49-0a29-4445-b0df-becdb01b0a72", "comment": "Malware payload (RedLineStealer)", "value": "74dfcd01acd619b79b713c411843ec91", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667273, "uuid": "c5dd54a8-fedd-4568-91f7-d268d78fa5d1", "comment": "Malware payload (RedLineStealer)", "value": "229ddb1ece4c2b2b1321b07430a2bdc484496930ef46b39c7b21a7de73b16a28", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667273, "uuid": "1096d5dc-89ef-4f8d-958f-41678b1bac91", "comment": "Malware payload (RedLineStealer)", "value": "6bc7011c0b1397392c8cc1c203d8e567087d93e4", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667273, "uuid": "b1a3f74a-307f-4cbd-94bd-d61a822af937", "comment": "Malware payload (RedLineStealer)", "value": "8ad5cc1ac0d7e30fee0ee8c4f5e7af879a68d3b2c932852461385007a9e01eaad9b364dc036b5c55397741d4ae364222", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667273, "uuid": "b7e4c19d-d4a4-4773-8415-3de791a8579c", "value": "T160252242A6E59177CEB09BB049F586871B32BD664C78832B3745BC435DB36D2E83072B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667273, "uuid": "33e7495a-c6d3-4190-9b6e-c1ee01b6bebb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667273, "uuid": "71d261d5-5949-4efd-8b5a-cbfea1563550", "value": "24576:LyY3XrjUrKPzijJnB0FlzCAtIbl7AmRlU7tQ7OXdxG/D:+Y3XXgKPz+e6blncGOU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667273, "uuid": "fa62fc97-b057-4a25-aea9-e5d9c6af0ad7", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667273, "uuid": "2c71f2df-0569-4788-bcc1-b129de8c269e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667273, "uuid": "3ba5890d-d139-4b65-ac97-c10d1e8f6c00", "value": "calculator688.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e7f7d0c-f7d0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684671036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671036, "uuid": "8f977ff7-d415-40f0-b5a5-75294e0e2e44", "comment": "Malware payload (RedLineStealer)", "value": "fb2298b925fa88daa72ee76912f89d33", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671036, "uuid": "1f048e6e-ffed-4430-88e0-b7cf60872633", "comment": "Malware payload (RedLineStealer)", "value": "22f51947ad4c3ac34cda67f582b99d3abfdeeef2c0b457833de1ad5e5f62d742", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671036, "uuid": "ec31aede-984e-42a6-8907-fdbb30d8b62a", "comment": "Malware payload (RedLineStealer)", "value": "08a2934451cd1e78eb44680b4d482496f7df9037", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671036, "uuid": "0f871a6d-6525-4c31-bc5b-4ca2b9c1701a", "comment": "Malware payload (RedLineStealer)", "value": "0830520c27a99fc109e5245cda83594de9c43d8f5c82030485b03abb1bdcf6647720c5147996e27c7a7a0fc2cc28cfd3", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671036, "uuid": "65d64b05-85c7-4155-aa80-1057f947847b", "value": "T19825230BB6EC44B2DD7257708CF246D30B76BCA099B9A31B378A958E9C739406433767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671036, "uuid": "47551711-3a09-4a3a-a009-9dd494333b8a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671036, "uuid": "fb408e3f-595b-4ec6-8f9e-7a5b2886355a", "value": "24576:WyPu0BQVpPeqxaI39V89lUdLPlZd5U474E:lPu0BQ6qwI3rklUdhLKA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684671036, "uuid": "8cf6ce90-2b82-4d0f-8283-6e09ac090d88", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684671036, "uuid": "624afd70-3eb3-4cf7-b093-7081c3c4a5e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671036, "uuid": "921c77f3-1b2e-4606-a63c-e3ce23339fd3", "value": "downloader231.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "008b16f7-f7b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684658369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658369, "uuid": "b1177c18-0512-4f05-9c46-e89e348e422b", "comment": "Malware payload (Amadey)", "value": "d87c05886bb1cb5b87f2221f24075f73", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658369, "uuid": "d1d3846e-b07d-40cc-a2f9-f4e8e01f309c", "comment": "Malware payload (Amadey)", "value": "23aec7aaa813c3afa590f9c4033e03147c02c9f5dc48e2ba7d9c0082e8379d9e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658369, "uuid": "4d514c62-fa40-4fbc-91f1-131dce366321", "comment": "Malware payload (Amadey)", "value": "cc067c543e6809372eabd622e86abcdb4ddbdecd", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658369, "uuid": "e24f7dac-6e2a-4acf-b7dc-8fb6869a65a0", "comment": "Malware payload (Amadey)", "value": "3e281dfbf3c50315d132dfc8d4e3dcd09fc9f9f6daa30aeb6f7bfbc7c5040d8939c295e22ea85764a6b4d8d9c5bc3c78", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658369, "uuid": "6eca8cc3-ec8d-44c4-87b6-4478cd18a3ab", "value": "T1FF252317B7E54127C8F667B04DF103D30E33BC926638AB7B334A699918B26587A71327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658369, "uuid": "aef94b5f-19af-473e-97d7-b8319b288902", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658369, "uuid": "f0a3728f-5811-46c2-9a66-7ccb14dc4b98", "value": "24576:Lyss4WAoiKObJtYA9aqezU5cagJcY43RLisrLgKBM:+sxfN/9Qze6JB4NgI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684658369, "uuid": "a2be0a77-eb13-42be-92d8-41b98aef16a2", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684658369, "uuid": "2feecb4d-9bcc-4138-8ab5-243e4897af14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658369, "uuid": "6eade99b-991a-4dd1-8fc9-a4bfdad80fde", "value": "1212324396.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "375987d0-f7b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684658461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658461, "uuid": "c9fc489a-7fd8-4f4d-b8bf-64f27162fba6", "comment": "Malware payload (Amadey)", "value": "1909548486c95d24a862abb8cec3ef76", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658461, "uuid": "7a2b732f-be09-4cef-aa5b-df1d460709a7", "comment": "Malware payload (Amadey)", "value": "23fef05ccef754503e399980a0581ac6095eab45d3020754753caa63563032b0", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658461, "uuid": "cc9cdf23-fe47-4949-ada1-4cbb74848afe", "comment": "Malware payload (Amadey)", "value": "9658d3428d1f8e0394f8316c02c28dd25fca0651", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658461, "uuid": "463dab2f-e280-4461-8e59-d3c4ae8fa8ba", "comment": "Malware payload (Amadey)", "value": "662450baff8d5205f7adba7493b2d131cf39083295f875e71f8c3c0ddaf264e02d529d5273a8b99896e84a48ecbe83d8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658461, "uuid": "58ef9b15-341a-462f-816d-13cfbb1c945d", "value": "T190252312E6E84873C8FA2B7058F905530B32BDA65EB4E36A7347986B1CB1381E475737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658461, "uuid": "c3ddf887-e9bc-494a-8aef-8c248d292a51", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658461, "uuid": "d79ebb3f-335b-414b-85b3-daf8bd76feed", "value": "24576:Ly9WzX7+aujNKUYenl0wQt1M2BACyoSgBxkWUBJo:+w/EKUYenHQXHB1Sa2BJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684658461, "uuid": "e7407ca2-ccef-4427-8a12-8a65d966a618", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684658461, "uuid": "1544c453-6d57-4103-8f8c-93a542f814f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658461, "uuid": "c5fbec76-87f3-42fb-965e-2208426cbaa8", "value": "networking543.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecbad377-f7eb-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684682817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684682817, "uuid": "8bf982b9-a9b2-47b8-9fde-e92d133dca57", "comment": "Malware payload", "value": "3056cda4f2f089be83067b1d991a0853", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684682817, "uuid": "0e09ea2e-1f00-4193-a7c5-9fbba79c6ef1", "comment": "Malware payload", "value": "2416490e925a94c2e69f82a341bc66c9221560f87c0a5430fdcd170c3c0ba73e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684682817, "uuid": "69751c50-6189-495d-a21f-88264efb0be3", "comment": "Malware payload", "value": "1fb0a3f4fc4e99cf48d75c1fb7fd9b75ba9f73c7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684682817, "uuid": "fd75f7c4-88bd-4f72-8cfb-bbf002b9423f", "comment": "Malware payload", "value": "ea59012e9d83b3e08f1accd3b5cfdacecedf462ed2be16c26e859e29530eb89ef9cf58ff2260ce6bd0990952019553b1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684682817, "uuid": "8d3e73cf-61b7-4f1f-bfc8-36ce04693bd7", "value": "T16DA35B53532D0A87C98B9AF02DFB27F187AAECA012B25644950EBFC41773BB41056F5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684682817, "uuid": "2731dddc-0208-4349-bbdb-db0b013dd842", "value": "1536:DEg/+165BDtuS5Xap3SQuqomJd28C40W2tdnAJfmsCskFw3DW:DXa65GSA6q7JduomDski3DW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684682817, "uuid": "28b6118e-f9d7-4f0d-b85f-5686b0b70139", "value": 103588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684682817, "uuid": "768b602c-2169-4537-9ad6-7500d00e9ac7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684682817, "uuid": "79b3f853-aae6-45f8-a760-db779f1000b6", "value": "3056cda4f2f089be83067b1d991a0853", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "567d627d-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684680418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680418, "uuid": "ad795766-c992-4b86-be30-fae1fc541eb8", "comment": "Malware payload (RedLineStealer)", "value": "d0ac986eebdeb472af1085a9964892b6", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680418, "uuid": "20446299-e77b-4444-8b3c-d29beb7e1bc6", "comment": "Malware payload (RedLineStealer)", "value": "2455132ad678b3162881b7f06237f41ab6d9c53bb41cb89a4a025c09ece6411c", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680418, "uuid": "2f00a500-8e74-4693-a002-532168782be2", "comment": "Malware payload (RedLineStealer)", "value": "2865f5eecc35a1070c1e4982db6dd1cee9ebe135", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680418, "uuid": "685c8a43-5ebd-4d4d-90ff-14fed0ffc055", "comment": "Malware payload (RedLineStealer)", "value": "997cf345e80d4dfcc08e847db4b6ca8a649271b3ad709f60d32628961c0e847530154848db23a3a998a378acaa6a4ca3", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680418, "uuid": "827bdb40-8409-4934-a5a4-8741034dd5cf", "value": "T1D6252206BADD6072CEB05B3055F543D70734BEB69EB4826F2300AC5E4D33A99A53673A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680418, "uuid": "260f14f5-f572-4757-9822-016219d45f98", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680418, "uuid": "c8955051-20ac-4f8a-bb7c-bed98583fdae", "value": "24576:gyTZyKf+dscH/KoqCYWPOaRqNTJ/S4/j1At7U9wQQcZ:ndyY+dscH/KoqCXPOaQhs4r1t3Qc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680418, "uuid": "a8089dd8-5950-42ed-b1ef-2e16e6590e5f", "value": 1046528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680418, "uuid": "ad18a9ca-4f93-40b4-bb01-44a987b94485", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680418, "uuid": "1e45203a-591b-4dc0-a294-a5dd8c5bd372", "value": "234433512632.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e454fbb-f808-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684694926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694926, "uuid": "999ebd76-71f1-4e44-a18e-30c1830580fa", "comment": "Malware payload (RedLineStealer)", "value": "2a996eea7abec113029d58045ba89a24", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694926, "uuid": "fff86e7d-6781-4f1b-84bb-5c5b886d9cf5", "comment": "Malware payload (RedLineStealer)", "value": "245d034a92fa36ff90522fc5f789331ab4bfa2d0ef20412e98a04f8a6dc7cd77", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694926, "uuid": "04f2ff50-46db-480b-a357-a05924743b60", "comment": "Malware payload (RedLineStealer)", "value": "370fe03ae78453d3a9493592867acb12db89bfeb", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694926, "uuid": "417b4140-255c-4922-8866-76392b637c24", "comment": "Malware payload (RedLineStealer)", "value": "bfc5da1d0e266b6b13a00cf20157a882a8eb71657a6caeb53fe39f8b978c30057754d1f736ffe31d92792b9649339cd6", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694926, "uuid": "04952def-6065-459c-927a-81e1541c0807", "value": "T16CE3D624279F8930D6BB4E3D6CB19CC076BCEC12A542D74A4ECCF5593A73B809B116B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694926, "uuid": "b22d10f5-b825-4ceb-b532-6ab30f1b8215", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694926, "uuid": "ea788fd5-8923-4dc1-9020-f08a20f8d2c3", "value": "3072:2V+m5cNQmRSxWWAcP+DDXedh7Z58e8hk:2jwCUudh7z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684694926, "uuid": "1adfee06-0f76-45f9-b05a-d482cfd61228", "value": 148811, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684694926, "uuid": "e4475b57-fa2d-4dec-8c46-b9af9e8a496f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694926, "uuid": "697b15f2-8032-439a-9893-aac50db3d572", "value": "readme301.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec65ad32-f7e0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684678092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684678092, "uuid": "75f706a9-c3e7-4dfd-9446-dc0553422e89", "comment": "Malware payload (Amadey)", "value": "636c34eeb36a3cc091d77855134c5d55", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684678092, "uuid": "2bdccfc7-e488-4905-8c2d-dd3515dc6ca9", "comment": "Malware payload (Amadey)", "value": "24b7beeb21d95b9e8c3a067a904d58fc763a4db8f09931d381d845b8a20e5a13", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684678092, "uuid": "446212e5-f015-44f2-a51c-11a8aa138de7", "comment": "Malware payload (Amadey)", "value": "a0b2b1be809f9e85bc416801cf9677684c5a299f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684678092, "uuid": "6d3f1973-5653-454a-abc2-3d4319ad2674", "comment": "Malware payload (Amadey)", "value": "a698c144654bce7f91e68cc170e61a7e809cb0784e05186ca4f34f6cb368e35dd86f3dfcc51d0ff3ff3d9756d936a68e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684678092, "uuid": "f5b91054-a917-4fe0-8d40-858914f2b4be", "value": "T1D4252306BBED9422DC75137099F607D30E3AFDB48970871FA3A2990F5833A90A971767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684678092, "uuid": "8cebb5c9-b69f-4a42-b9d7-d37cadcbc56c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684678092, "uuid": "693f1627-bde8-4e3b-97c4-b1e7dc87d121", "value": "24576:6yEdlBw8fcMAUxqgI3LOOtw3EQ7p+oL8pXQSfSxH2W2QyQlKy:BE/2rMAUxqgI3LOOtw3E6WpXlfSIW2Q1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684678092, "uuid": "1f7443c4-a764-482f-a680-cb025da4ff60", "value": 1044480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684678092, "uuid": "821ed0f8-f662-4402-82b6-f089a477f7ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684678092, "uuid": "7dd1fd26-9204-4415-9083-2044965e3b3f", "value": "636c34eeb36a3cc091d77855134c5d55.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e8b25a9-f7f4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684686498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686498, "uuid": "b6078785-90a2-488e-aa77-025e531d2c5a", "comment": "Malware payload (Mirai)", "value": "eefa75627adfa9eb29cadf04f5049b65", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686498, "uuid": "c1c25434-c871-490d-ab74-74fa4c51a8ca", "comment": "Malware payload (Mirai)", "value": "24c6e7a2dffbc8eb113a28057ab6fd61c17ed4aa1e07c6674cc9e82f8a904a56", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686498, "uuid": "2d40cd87-7872-4a92-8305-15918e6ee64d", "comment": "Malware payload (Mirai)", "value": "93a487a1a588bf320fd2d189a76bd935c503284c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686498, "uuid": "850182be-b6a8-4d35-abab-92b1e6b1865f", "comment": "Malware payload (Mirai)", "value": "cc3940cb490711daa527394eba068a7b600e36e7f38a5b993badf3a9c576ee013991216bad62969c97110f73ed3f0b54", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684686498, "uuid": "b3e62a72-6563-4531-b3b3-dd1a90177348", "value": "T10363F856F8818B22C5C5027AF92E118E332357FCE3DEB2129E146F20778696B0E7BD55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684686498, "uuid": "4f9f3dbd-c2b8-4bd5-a765-e60bf56a8f97", "value": "1536:NlneyKvSEkSYUde5d3W5BkOyaaagzlIQiRQNh+y3Pf5VYoxu:VKqEpJUGuaDQNh+y3PfDBxu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684686498, "uuid": "cd369ad9-2226-4401-a7c1-69eb537af3b2", "value": 70968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684686498, "uuid": "1d08880c-a084-4fd4-bee6-391d4e43e281", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684686498, "uuid": "e870d566-91c8-48e7-a95b-ad2bc35cee72", "value": "eefa75627adfa9eb29cadf04f5049b65", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96b0eacc-f7c8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1684667641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667641, "uuid": "c83ab821-e0f6-4c5a-9cff-c3e2d2ad7f6b", "comment": "Malware payload (Stop)", "value": "2447ca3d420385fbb67c3c33196b3d65", "object_relation": "md5", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667641, "uuid": "e74908f5-5d2f-44d9-813c-518486725065", "comment": "Malware payload (Stop)", "value": "251ee3a528ff1960e2948203117af8a82fcd501c0a6a190068c9601482310b65", "object_relation": "sha256", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667641, "uuid": "029fb306-605a-4171-b3a9-c224471b0841", "comment": "Malware payload (Stop)", "value": "cf75bf93d948eb3d9be9e39807901e7a8a989081", "object_relation": "sha1", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667641, "uuid": "e1a8c276-11c1-4b55-9da2-8110081cd03c", "comment": "Malware payload (Stop)", "value": "1dcb97789091575638185132e4db064d548c16a085afcd7815a4db54c280d7cd8ea0f823a897ab3ce49851fa32b50558", "object_relation": "sha3-384", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667641, "uuid": "6943ae92-8f95-4dff-8f30-c0ec29dec1d9", "value": "T1E70501526693FF71E56687754D29C1F426EEB8228F192BCB33446F6B19311E3CA72302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667641, "uuid": "22975eb2-f6d2-41e3-9906-86a0e5bfbb2b", "value": "c37a1f908dc8ba7c67223959bc2021cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667641, "uuid": "5fe28ea7-9348-482a-8217-b9cf3252ae83", "value": "24576:a7uS6Grpec0X7QSBt3srUN+saWRJ0NB5akt:aqS3QFH3mUnRaNBI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667641, "uuid": "baa86222-f72a-4eac-b0a8-2ff19bfe7b0e", "value": 807424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667641, "uuid": "26e2d450-1eae-4657-8856-e248ab47957f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667641, "uuid": "c33667d8-4589-4539-944f-58a5e227c69c", "value": "noname401.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "556db2b7-f800-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684691583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684691583, "uuid": "595d8e00-4889-4491-809f-a8eaee5b6404", "comment": "Malware payload", "value": "cd7186fd8ab1f32590908b5456be3c63", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684691583, "uuid": "b93aeafa-baeb-4ec2-b983-2a652bdc8da0", "comment": "Malware payload", "value": "252451ab82b50ee462ab7c1d1072ea269cc36219ca006df2f73cf08b4cf8511f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684691583, "uuid": "0ad30efe-b5bc-4a84-82f2-02ca1c32a065", "comment": "Malware payload", "value": "e6e64be8fc1c39bba34d12149fa1b53ba1859bda", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684691583, "uuid": "c13a4847-d4c4-4516-947d-c3220e574126", "comment": "Malware payload", "value": "39f9a8fef19da8136b22bd03595d4599d729c7c0520a455ccc585d2004a96ced5a627b8998cc3a5d5ddf4ee2a4f314ba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684691583, "uuid": "9d9dcd8b-a9c5-4abc-a084-4be14aae1f81", "value": "T15B835A22BA361E23C0D5A07721F78721B1F053CE25A8C62E7D721E9EFF255406547AF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684691583, "uuid": "c4ce0953-470b-4c71-a43c-d67a9b6f068e", "value": "1536:uxRW+cIh//3XqkQlIyxvj3GA4QvLhkqVT5BgUOthowbZn2de:qZx+FmajVNBgVowbZn2c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684691583, "uuid": "22b0f03b-d08d-4418-946a-c1d0d482ec68", "value": 83976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684691583, "uuid": "917a1ad4-f5ef-45cf-9e66-3e0412470df5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684691583, "uuid": "112bf9ad-4cbb-47f8-bfff-ba3359bb3b4e", "value": "cd7186fd8ab1f32590908b5456be3c63", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25662e8b-f7c6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684666592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666592, "uuid": "75a3633d-a31b-41c3-bd94-83e0ef837200", "comment": "Malware payload (RedLineStealer)", "value": "215fa94e5ba73b452e48bfccc9ec00f6", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666592, "uuid": "c9413a99-26f7-47d5-80b5-dc5ae3abf021", "comment": "Malware payload (RedLineStealer)", "value": "257a4335a40e13b1ce67ef559961a04336949519fc137176fc261da4b98fa4b7", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666592, "uuid": "5d651abc-5ead-49e4-bb7c-3a5c3b3b162f", "comment": "Malware payload (RedLineStealer)", "value": "cee13677fa11edc026209fb1eda183f8f03c29fa", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666592, "uuid": "eb788b16-41d4-475c-9e7a-96e37bb3b68e", "comment": "Malware payload (RedLineStealer)", "value": "720d3aa3de791409d9cab11b4a6ffee307dc7f989359e91339b2cb90b05dd14bbbff9c3719dcada901463b9c49494911", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666592, "uuid": "8d7c288d-e124-4059-8cee-c9dc82cd13da", "value": "T119252303FAC984B2DDB52B7088F71A970B367D616D7492573752EE5A0C33600B8727A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666592, "uuid": "e035b90e-d6af-4436-be28-57f353feffba", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666592, "uuid": "4f5a7cd4-477e-49f0-bbe1-1951545e1576", "value": "24576:3ygMesABvDIVEgqtaRbcNcVhKILjSNT1MemhD5wh:C9nAFI6gqIxJZSNTSemhDS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684666592, "uuid": "d434c478-e37c-4cac-8fb8-27179b0efad5", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684666592, "uuid": "16c082a5-c232-45ad-b555-a7b437d4b0b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666592, "uuid": "52bbf6bd-0d15-47db-938b-110a541fc0ec", "value": "graphics272.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "131c3590-f7b2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684657971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684657971, "uuid": "69a93f39-c404-434a-b133-27697d9981fd", "comment": "Malware payload (Amadey)", "value": "ee311ceef176de209007b573997beb72", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684657971, "uuid": "a2315c42-38ef-450a-9e6f-524e8c64505c", "comment": "Malware payload (Amadey)", "value": "261504913abf233cb435c0a6753b3f2928223384c014fdd42129b143361553c7", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684657971, "uuid": "85b38477-2448-42fa-9601-17ebce5e5f39", "comment": "Malware payload (Amadey)", "value": "817c79c463f7cd1dd675b34d74cb87c0d7ee61d2", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684657971, "uuid": "ef0b409c-1acb-48c3-818d-4bef9e43dcf3", "comment": "Malware payload (Amadey)", "value": "150f166aa80caa6e1079212ee9fdd4787eb0519b33cc0b4ad27be528f4f65e3a5fb9b42279071c7045592732b617111a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684657971, "uuid": "bb9fb14c-ede5-4d3b-854f-04cee948c57c", "value": "T1A82523476AD90462E9B55B3014F643C31E767CA6693CCB7A3782A81A4DB23CCE671373", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684657971, "uuid": "18f5b7ac-8dbd-4055-a3c9-6ed2a9268d85", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684657971, "uuid": "914f2dfb-a3e4-453f-ae21-a44d42c8ad3f", "value": "12288:5MrBy90Pj8WuY+VBYPw+MmNCvR7pXob5CTsvEY/Uva89PCn/wUrrH6p9hwppTE4B:wygZw+lgdX6f8O3/D/88TEWwR1o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684657971, "uuid": "6f36b0b2-0fda-462e-9433-308352a23f0c", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684657971, "uuid": "9fabf454-cc64-4170-9672-e3b8e94239c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684657971, "uuid": "850f5e01-4393-464d-875c-4c695ab5d90c", "value": "monitor.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f20d0a8c-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684680679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680679, "uuid": "e487caa4-3b90-4dee-9dbd-3d25999bb15c", "comment": "Malware payload (Amadey)", "value": "ccfafcbd7d0a18373e85248e25c571fd", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680679, "uuid": "b72f5e33-4f22-4eda-a748-bfb0457cb628", "comment": "Malware payload (Amadey)", "value": "2620fdd7502676b4a0ad434986d73dafc5baf40e3a9dfa4dda688f99ea1463a7", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680679, "uuid": "49ca27c9-6a07-4ddd-b5c5-d657d8819e49", "comment": "Malware payload (Amadey)", "value": "6611982665996c254eb43e58d8eb4eb6847f35af", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680679, "uuid": "ca0bc015-08cc-4549-92cf-2dffe4930320", "comment": "Malware payload (Amadey)", "value": "3fc2f11a02ca259ad82a4efbac619c3f7fb0dc49243c305bd0e2453fcc8da443570b1766bc1629aa373a2d045f98cdf5", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680679, "uuid": "57742206-48bb-4c72-a480-8dad34bf9752", "value": "T1E8252353BFC46072DEB127315CB60A630E76BD604CB8136F7689EC591CB3AC56936722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680679, "uuid": "725a0d61-18ed-4828-9f8a-39f01d95fcc8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680679, "uuid": "9ce8059b-929a-4ed3-ad04-cfa3bfe02582", "value": "24576:4yMMLtj3Tf9U5Vq3TgUPqfLyW1LEpsXiZllfUvp:/MMZbBU5Vq3TFPqznLkJllfo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680679, "uuid": "9d58eb81-a533-439e-9bac-b946bfc71ee8", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680679, "uuid": "51ec9cb9-4e9f-424e-b5dd-a738a36f3b6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680679, "uuid": "10c4e7ee-10fe-48c9-9a7f-feb7eb50b34d", "value": "token692.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea4e37b2-f7c7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684667351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667351, "uuid": "2df32e1c-be91-4eb6-9cb7-c0ae8694bef9", "comment": "Malware payload (Amadey)", "value": "ce09cc28b213aa103ab526a1e4a5c1a3", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667351, "uuid": "9916de48-b076-4397-b410-b5ef9c8f0d4c", "comment": "Malware payload (Amadey)", "value": "262fbd5238672171301f5af0d89115a160f1c061483bc2b9639b74826b92aca6", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667351, "uuid": "af709704-c464-4a1d-8423-bda3271e38c2", "comment": "Malware payload (Amadey)", "value": "77106ceeeebeb77ffcae9b549a7ba330c1b291ab", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667351, "uuid": "df81216e-42f5-4c42-a81b-67ecdc15f8b9", "comment": "Malware payload (Amadey)", "value": "7fd0e123986f47c80cccf9f89dbd47c1cf1f9e93d58a7cb144b491f947a6f54e1ed95c3ecc17cc645d7443a6721f6246", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667351, "uuid": "7aa9ae97-cc28-4e12-93f3-9b9604f9e0c1", "value": "T199252352F3DD98B7CCB66B7084F703930734BE665A79834B7244A96E4C33245A672363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667351, "uuid": "d4a441f0-bb4b-48a1-be1c-fb92945049a0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667351, "uuid": "0f14075c-ce9f-477b-b18f-696d88c91179", "value": "24576:jyHUMn333iH4lAqE1R36IRW44Qd8NYpZVz:20Mn3niH4lAqE1lLRWhTNS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667351, "uuid": "f196d5ed-9799-4787-8572-6599300ac800", "value": 1046528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667351, "uuid": "2a4678dd-5db7-4f7c-a2cf-00fe93a0a41a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667351, "uuid": "35473dac-d818-4652-9773-410dc67c7bb5", "value": "logger572.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb6e3394-f808-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684695298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695298, "uuid": "679af8b1-5bfc-43c2-b3e4-8edb03ba84e4", "comment": "Malware payload", "value": "53f6a913787d5180ed69964b0e27a65a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695298, "uuid": "0aa81bcb-5816-4e01-85d5-5ec9f181587e", "comment": "Malware payload", "value": "26778a0b359f6f1d27b60982aea8062e2b1f8e4af065ad5769e4aeed9e0b61c4", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695298, "uuid": "8d4040ed-704b-43b3-afb9-4faced6b30d4", "comment": "Malware payload", "value": "83f8aeb8ab6ca9fd27371490f984d9174596d074", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695298, "uuid": "bf8aba12-3d71-4125-add9-76e9c8bedf93", "comment": "Malware payload", "value": "22de813a705ed6d262a497dbebbdf370ad8974bfcb8968c9062f057094c0c4bc89667aca3d9d20d9fa062c5fd93691a0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695298, "uuid": "6f855bae-245f-44f1-8130-cb9e816ef887", "value": "T10A130180DC92EAD73745E57FCBB3A81130E92EB79C86711C17AC22EC802739CB1B8565", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695298, "uuid": "3f71b618-97ce-4a2e-bec5-d2aa8a29a0ec", "value": "768:V2m/tiRQU+ZUqYupRmaXsaKRcuGa8Ar2eiqQ4ZZoKjQpVb3xuOWPAuqrQIU:V2m/taQU+qsRHoRcugAieRZRQpVTYlAw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684695298, "uuid": "bec9fa65-5dd1-4c4c-afb7-9bc82d73c6e9", "value": 43499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684695298, "uuid": "dbdb0e09-8ad6-4281-bb1b-f387af6f5312", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695298, "uuid": "51a94a26-0e53-43c5-ad54-6ebc7663500d", "value": "formatter252.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03b28d2e-f7b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684658375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658375, "uuid": "b68dd3f7-7f24-4774-80f8-ec7deb2e1edd", "comment": "Malware payload (RedLineStealer)", "value": "74964c89b9f11e4b56c4e1048c7d1ce8", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658375, "uuid": "b5ff4d35-b932-45dc-8c49-73c90ac2133d", "comment": "Malware payload (RedLineStealer)", "value": "26b000b3c716d7d642b64269f1c231c132617554899d2bc742a16c5f1e2aedda", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658375, "uuid": "6f85b384-b6a6-469f-ab7d-14ba5e9c54b8", "comment": "Malware payload (RedLineStealer)", "value": "d8afe57d3ceef0ac503387ff6203eb81d73c6494", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658375, "uuid": "bf72e220-d763-40ff-8457-54625a806634", "comment": "Malware payload (RedLineStealer)", "value": "f1517704388783c6a9e4016d3132f91e4aefc009cf089f3d07c642d624e02ea47ff7d232ba580b4b12f1a43cf4d17fae", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658375, "uuid": "3bf4a83a-1f98-4f1c-92f5-8dd2ce75cba5", "value": "T109252396B5E85031EEF557B058F702831A37BCB5A9B886171B85FD2A4C32F94613233B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658375, "uuid": "cd91fbcb-7c92-4992-bb30-394a32fb4118", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658375, "uuid": "8d2d21dc-2c1c-45e7-9b47-f09bdd1ca946", "value": "24576:hyQMa+PvoHh4mLl7AQFg/STY3RdK+FPFt40TH4T6CpMmMcg:UQncoB4+AQSJR3FNvTH4T5pTMc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684658375, "uuid": "ea87925d-1664-4a9b-9529-abcd288306c6", "value": 1056256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684658375, "uuid": "f73579e0-664b-41c7-bd90-fc7fc51e1720", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658375, "uuid": "11bb2150-4a21-411e-8274-2828388dfbe2", "value": "242552619.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d39338a5-f7c8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1684667743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667743, "uuid": "ef1f0ac3-32fb-4e44-a44f-bb54f7824686", "comment": "Malware payload (Stop)", "value": "bdeeab4391d0a8c4267cb8ba10e1f8d6", "object_relation": "md5", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667743, "uuid": "25d24b58-10c6-4e86-8872-81b12560e7fd", "comment": "Malware payload (Stop)", "value": "26b3be5bb284467b876c6fc017b9a8e7b7c99dd667c82aeac71e2cbd0f7027ed", "object_relation": "sha256", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667743, "uuid": "e8d62077-246a-4651-b588-e95979a3c7b4", "comment": "Malware payload (Stop)", "value": "4ce8ab5543306456adc9c33334049ae5f82e168f", "object_relation": "sha1", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667743, "uuid": "caa4adbd-87a2-4ded-85a3-561a3aacbcc5", "comment": "Malware payload (Stop)", "value": "3879f74404498f24f5f9a0ed8364b8c23717065664d69ea202272d29f2341fbfbd9b19e509b465699f04463a53a31735", "object_relation": "sha3-384", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667743, "uuid": "e0cb71e6-a7df-48d6-8be5-d2ec8b7cb7ef", "value": "T1D405D00352D1BF66E5260E739E2E82F8F7EEB551EF092BD762085A2B14712B2D573301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667743, "uuid": "76b5a282-28ce-49d9-b494-22735331c65c", "value": "c3945e210b1009128598ead2a7524d0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667743, "uuid": "369c3aeb-fb3c-4d30-8d94-eabd2907b3de", "value": "12288:yvXzISEWjh9Novj9nNzCwIPihYXVuWZOdndXZBW3G6RgAh5zM4E8UF2:2XiAh9SxnRC93BIrXZE26RgAr44E8UM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667743, "uuid": "b88a1d78-7e75-4060-8754-920893866e20", "value": 841216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667743, "uuid": "70e856ab-1265-4e06-9d1b-dc7bd413bf88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667743, "uuid": "c551f7e3-496c-4acb-8a6a-fd8134fc5c0a", "value": "35677224.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da73cd6a-f7c8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1684667754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667754, "uuid": "3f09aeec-1334-4a71-a203-c904f72f38e3", "comment": "Malware payload (Stop)", "value": "468c135f7de5879b9505c5fd2229c3b7", "object_relation": "md5", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667754, "uuid": "8eab5823-3c85-4ff7-a942-2b28f9d4f99d", "comment": "Malware payload (Stop)", "value": "26c09c2ce6e36cdd056342ad6db20fb45f006d685ce0311f0e691c4a2ad16cef", "object_relation": "sha256", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667754, "uuid": "1cea7e7a-7e91-4c11-bf92-96e7d0e9ed9c", "comment": "Malware payload (Stop)", "value": "d5f79f078e87b63765aab8ad84c519a5fe24f43b", "object_relation": "sha1", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667754, "uuid": "6da84f18-9f98-49fd-bdbd-fe44b0637089", "comment": "Malware payload (Stop)", "value": "c6bd3608d7a139bec9ba75d3eeb249ba3c53d495268bc19410253b3ffbf59ef4443b02e4b2a6c86aa9c0a9db98aea8d1", "object_relation": "sha3-384", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667754, "uuid": "7d053e04-9263-42b2-83d6-b6fcb2fb336d", "value": "T1B205E18392D1BC61E91657728D6EC6F8761EF9608F0937AB62086FEF14381E2C573316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667754, "uuid": "dcde1f2a-ad71-4f10-821e-1dc9f6740bdf", "value": "b8e0cca9c8daf9ab8d5b3be250b7f319", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667754, "uuid": "5b2d910e-8470-46c9-9f3f-9612e9d43247", "value": "12288:n4ByPCe0nTaY685nnLmpfaBAMvi3KAniZ63wV2Kr0iJ0SqvxxvvPYy6+M:niOCe0TaYjnL2au3v3wjzJ0SwxU9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667754, "uuid": "a472a46d-7160-4c02-a1ea-e95c0a571435", "value": 848384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667754, "uuid": "c3768fa5-7f51-4a26-bd20-a65fa1527cd0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667754, "uuid": "dae94c79-5265-4470-a860-0503d9abe9ab", "value": "LightCheats434.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0001db3a-f7c8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684667388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667388, "uuid": "d0489e7c-7ef9-429b-a25b-382d96a46d3c", "comment": "Malware payload (RedLineStealer)", "value": "ec34332569ce471c090f947c3926c46f", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667388, "uuid": "cd313b71-cf94-40a9-b944-634804654c96", "comment": "Malware payload (RedLineStealer)", "value": "2753db6f0f73fcff8995fd066a6955c65da4b45574cb9fc273a32d4198e61dca", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667388, "uuid": "76092206-795b-4b11-ae25-c127b50e6437", "comment": "Malware payload (RedLineStealer)", "value": "53d6bfb7b547854bb408346d6539296f68f25c49", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667388, "uuid": "f132dd83-32b9-4ec5-b3cd-d3a4c334e388", "comment": "Malware payload (RedLineStealer)", "value": "6c7d9a92c9e6025ccb0be080f69f7abdfc674c41c369d030726b455b9af959f85af377e8e26d62c154a805415efeb2d8", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667388, "uuid": "6fd45c17-e447-4b95-840d-a3e809af5ef0", "value": "T1D2252302BAED55B2EDFA17F458F202530B76BDB18C3811A73684689A8D73791E970337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667388, "uuid": "2db692c8-c5cc-498f-9172-ccdd5992791a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667388, "uuid": "a2497cfd-b2af-461f-a320-4aecd5c29c66", "value": "24576:vy4RjoRhSqhMK+ar9YZYgOotuXg1r3MYKPz9MbfQV:64eRhSqhMKLInMXu73uaQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667388, "uuid": "0fb46add-a3e5-4e84-9441-fcbced5f4e44", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667388, "uuid": "59ca899f-6a11-4582-8312-8475b38ee342", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667388, "uuid": "709b2599-3544-4450-8053-6106114c708b", "value": "readme904.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc879be9-f7d0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684671194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671194, "uuid": "b6bc7aae-1e2c-4803-93aa-76bb4d438f34", "comment": "Malware payload (RedLineStealer)", "value": "ddb4c48250d6f2efa830d872e8d076b9", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671194, "uuid": "3be6a39c-0ef4-45f4-bad8-e0f7a3f05e58", "comment": "Malware payload (RedLineStealer)", "value": "2788fa7db05d64a654738d842cda511f7bd5f8ea170c204b4a89cf3d267d3d95", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671194, "uuid": "51d92e09-90b6-47c5-9b17-ac2cba1c67d2", "comment": "Malware payload (RedLineStealer)", "value": "d76c66b1f23a7ed6193e395bd0e9ec6105518a96", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671194, "uuid": "1ac40995-01d1-4ab3-b431-cddf73ce7cb8", "comment": "Malware payload (RedLineStealer)", "value": "d937a47f74caf1c21497cf4df469f3e616d6f377e7a84dcde79009c3791c1de95848dfa5bbd3d725bbf2e795a477f2d8", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671194, "uuid": "2989b3a6-64ab-4f5a-9245-33eda8a525ec", "value": "T190252303ABD850B3D9B473715BFB22930F36FD6149259B6E36821D7A0CA19406D72B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671194, "uuid": "0ccc064b-c3a9-4c6e-8aa5-1800d1624de1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671194, "uuid": "2b87c2b1-319f-4e6b-b8c8-7832756e3737", "value": "24576:OyNTAwcNgI5NqjquJK/W0h89dWyU0AFZtpAGjw3EE5zZPP1W:d92NDjq26K/HadBj4pAUw3fhZ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684671194, "uuid": "f2d1f6cc-39dd-4dc2-9fe4-2eb6a1d64dc4", "value": 1046016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684671194, "uuid": "8807ef22-5682-4c25-ba40-b5aacf9b9d94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671194, "uuid": "95fd189b-0efc-4c53-82ca-0c23d6d93156", "value": "2332324745.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3c34aa5-f7ed-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684683581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683581, "uuid": "acf55d73-a607-4800-88c6-d2c2263ddb8f", "comment": "Malware payload (Mirai)", "value": "05370104c1d1d6e100dd31af7bf30f4b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683581, "uuid": "80f9bfd1-8908-4d31-94f7-fd6ddc0246c7", "comment": "Malware payload (Mirai)", "value": "27f81f13257536f6e32fd567d1ad3d3b4c6c22b8871540653f04384716292cfb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683581, "uuid": "e4a9cc3e-94a9-4c7a-801d-c5df1f993a81", "comment": "Malware payload (Mirai)", "value": "ba00159c7c19bff1292d675f0ee0d67ca74b180c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683581, "uuid": "5d20674a-16f8-4388-be5e-0c065688ad45", "comment": "Malware payload (Mirai)", "value": "903a9b4b43c8366bbf71469a2bc374baf5bcbac18920be866250dc7e632fc2d6aecf4e1ede11471e3a28440ab5834659", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684683581, "uuid": "961a4499-fce1-464f-aba1-e82130b45d60", "value": "T1C2534B02B31C0E07D0A31AB0253F5BD197BEEAD022F4F684655F979996B5E361182FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684683581, "uuid": "405d93a2-d930-41d3-8919-508be6073421", "value": "768:SEE5hjcoCkhVRGfRnbmX7/mG1nhG9UmtTy5EMyZ/J9iSzEv2xRgN0L6FV+tg6wWM:+5HAdOmGyZtTAdMiSgOxRgN+e+aTWlO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684683581, "uuid": "0edbb612-46cd-4767-99ee-ed89793949f1", "value": 62996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684683581, "uuid": "cdfda9a5-c860-41b8-abc9-4e12d5764a62", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684683581, "uuid": "6e4ef667-4b82-45e9-9b09-a24d05249329", "value": "05370104c1d1d6e100dd31af7bf30f4b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cb0eaeb-f7c7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684667194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667194, "uuid": "5ba3b2b5-07ac-41d9-a596-9c6e8bb6766d", "comment": "Malware payload (Amadey)", "value": "0ecba06ba71cef013e8933974e74c37d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667194, "uuid": "68746da5-3101-41f9-9e24-b8a490c3cda5", "comment": "Malware payload (Amadey)", "value": "282e5e79be433b2a05e70d34a3c31a6292392a9ba95145efa8b93c7ad2868d23", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667194, "uuid": "3d8a4f9e-1ff5-46e5-a5bb-a3a1b470f3b0", "comment": "Malware payload (Amadey)", "value": "46fb6bb2c11bf8213e7f5369b9b96fec1ec2884e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667194, "uuid": "0384a770-b0a6-47ba-bfa7-e2b3a5cae240", "comment": "Malware payload (Amadey)", "value": "1bb1f1703f566917830c0f9cda6878091359cc0b8e94301bce77bb80825007cb042009f5efdf9ca8042a8c2da66cc96f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667194, "uuid": "b83bafef-e03d-40ae-84bc-c57277e73767", "value": "T1CB252313BBED5436EA351B712CF202C30B797DE2D878832137A5A96B0D726846472B73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667194, "uuid": "066f1554-ab5f-4144-b0a5-a4efb75a7320", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667194, "uuid": "3a2081f6-597a-40ed-9567-a5658cfe37e3", "value": "24576:myqYbcxDn2Y11Fq4P6mepArdM3JEp3SbeR8iaiE:1qYbVY7Fq4CgW5zc8i9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667194, "uuid": "002d9534-6d54-4d14-93b3-9d649b817100", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667194, "uuid": "7ea29d6e-442a-432f-8fd2-8ece5e0e1fcd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667194, "uuid": "2b3c9c7b-b0f1-4c38-b2e6-8bb326459fda", "value": "2332324495.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "196482c8-f807-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684694489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694489, "uuid": "181aa5ef-f1b3-4ed4-a68e-a80bf438aadc", "comment": "Malware payload (Mirai)", "value": "979435cb33615fa5352942e49321e369", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694489, "uuid": "7cbcd2cc-970e-4891-93fb-e951df75ee22", "comment": "Malware payload (Mirai)", "value": "2830a6170598f22bbf83b10971b6c6f09368298b35751e07488475507bc8cb55", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694489, "uuid": "95f52f8c-9006-41eb-bd76-e1ff62af678d", "comment": "Malware payload (Mirai)", "value": "779ba0be6d6fa101265acd6d2764ae26de4a06c1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694489, "uuid": "b550e3a4-48a6-4ae7-94d0-1deaa25e4323", "comment": "Malware payload (Mirai)", "value": "3d8c7a4a8c07b6b622458f5fde58c3a19618ec6dc99fccd8f0f774a7bab5f9c797290a7a56b99baf3a218bf34bc6bd7f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694489, "uuid": "e4ee18ad-477e-43a0-87f4-905b026e8dc8", "value": "T15A534965F8819A13C6C51277FB5E468D3B2613E8D2EE72039E256F2037C391B0E2BD55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694489, "uuid": "ed7ca0ec-1de8-4b6d-9e9d-5c30bc21e30d", "value": "768:+3wssubxgGrA8/RdJsR5uGoCaR+2ewRryHMbtthLmpF50Q6MVlOLckwPxpl8EOLW:rssubxn30uzM2eyVbtba0VMLVvayva", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684694489, "uuid": "d4804d07-ab34-4d17-98ff-4d3cacda22ae", "value": 63664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684694489, "uuid": "271136c0-c795-4cf9-98c9-bf390b09bc06", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694489, "uuid": "a946f17d-b7ee-4fd7-bfd4-0443191c8564", "value": "979435cb33615fa5352942e49321e369", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62181649-f7a9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684654238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684654238, "uuid": "5c2c60e3-2d02-4a5b-b2ee-e12fcf643a54", "comment": "Malware payload (RedLineStealer)", "value": "6d320c13fc1842eae443462e46fc46ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684654238, "uuid": "9b8f3e4d-1e03-462c-9595-6cdafd9c4c37", "comment": "Malware payload (RedLineStealer)", "value": "2840cf91d5a8784745bc4413941969a4cee60c11fc4df04c258263ce79bfc081", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684654238, "uuid": "7cec418d-edd4-40d5-a2f0-1780cf856d19", "comment": "Malware payload (RedLineStealer)", "value": "56ac825bdd911101da7a165b8d34cb7fc8113c39", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684654238, "uuid": "1974d657-2386-4e39-83ae-53f14b48da41", "comment": "Malware payload (RedLineStealer)", "value": "a5b0c80cb97e460cb661e86779a42baa3d0bf1fdfe30bfbd25ed59cc9313cbac4da8661ae246015ba014586288b1a797", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684654238, "uuid": "3ad93e82-d708-41b1-85df-9150445d1b50", "value": "T1D62523439BDC5433D4B6773024FB07D31B35FEA18A308B672249A85B0972684A9B6B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684654238, "uuid": "4df4c61c-d580-4545-8e7a-dd0c103db66e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684654238, "uuid": "3c669f9e-0fe8-4300-be4f-cf2d909dd0de", "value": "24576:byKajBRipI8GceVXuyOqc29A9wFfpYSLxE9MEpQPEK/5:OKwRi6PVOqBA28CxUK/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684654238, "uuid": "f2b9f383-cf68-4b15-b723-1d821ecbc79d", "value": 1045504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684654238, "uuid": "65b2cf36-3be8-480a-982e-62ee2d15e9ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684654238, "uuid": "f20da901-9c5b-41df-bdc4-6c9a9b0dade6", "value": "6d320c13fc1842eae443462e46fc46ec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd69cb3e-f7c8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1684667813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667813, "uuid": "694e5770-1c69-4585-96fa-743f5ef41874", "comment": "Malware payload (Stop)", "value": "00c295fb977ad69670f477ab8ae5e16e", "object_relation": "md5", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667813, "uuid": "a16edf00-f2da-4fe1-b6b9-0802beaa8c1a", "comment": "Malware payload (Stop)", "value": "289f168d1ddce89a04c5a7a316a09895c5aa51d0a28cbf4807124217558619fa", "object_relation": "sha256", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667813, "uuid": "7b3af1c8-a087-421f-99df-b88d2730fd86", "comment": "Malware payload (Stop)", "value": "0fdb87ba2599cc31389bb1c784d7ea72bcb40818", "object_relation": "sha1", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667813, "uuid": "2da1afc5-0ef4-41ca-901a-76e5c40dd7ea", "comment": "Malware payload (Stop)", "value": "2c195b0a985fd9884c818f10f02d778453dd5539cf6522e3c4b07a86fd530219d4ab5b9a07e36084bd49913cc36f6162", "object_relation": "sha3-384", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667813, "uuid": "505d71a7-7974-41e0-93e8-c2ecec6d6a71", "value": "T169050281A693EA75E96746718D39C2F4122EF8655F152FC723062F3B19721E2CAFB301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667813, "uuid": "12fca8f9-d215-4bce-a71f-40c96a6af43c", "value": "dc368f441a884fce22ecc585e2bd5326", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667813, "uuid": "d8dce350-1e62-42be-afa6-0657b3ea8f3e", "value": "24576:YkRoTyxITCf6E1PaEJHhAwDfprHV3UiQ4C5nO:Yk2Tr80EfAwLrkiF8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667813, "uuid": "7563ca8e-93c3-4639-b30c-ee13d81414cc", "value": 812544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667813, "uuid": "997423f1-4a09-439b-8930-615d08fb05a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667813, "uuid": "d2700124-cb2f-4262-857b-2edb0a2bc231", "value": "pdf-readers722.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d91063d-f829-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684709126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684709126, "uuid": "721fddd5-4a91-4db4-801b-491520303370", "comment": "Malware payload (AgentTesla)", "value": "ac23a0048ca9e25149a3651cf9688e31", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684709126, "uuid": "6244c70d-1e4d-4c98-97a5-7cf96e5c2f0b", "comment": "Malware payload (AgentTesla)", "value": "29f2cb40f49d921306012930991a3e95de4257ff280f91ece81a5eb6f29d4025", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684709126, "uuid": "cedd7649-f88e-4e4c-9d1e-4f8722cf8815", "comment": "Malware payload (AgentTesla)", "value": "71f01d13a497444a798c4a3d8ffa273b09a2c24c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684709126, "uuid": "d2f95608-9c33-4608-9fd2-2c9d8d0bef10", "comment": "Malware payload (AgentTesla)", "value": "48ef5b0bc265b1e26ffc7c6c18e7fc30576646a91b4cf9b9dd6b9648d34911b5a33201ca92c230a21f246d8ffb5ea8b2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684709126, "uuid": "049e7ae8-2c72-4ab2-bf1d-967591b99d93", "value": "T148E4BF5032649B92E7B987FA4135091007B939A63C3FE3289EDF60CA7A63F461A54F17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684709126, "uuid": "0acc9ec5-c330-4860-89e6-12d7abcb6bf9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684709126, "uuid": "d2842aa9-eafc-4e36-9793-6bab29e9c948", "value": "12288:9sQINcXtwoFKhZljrfrHQx+P88WNmFlj+n5SRkEUAYwR:OBwkZlffrwxA88rNA5S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684709126, "uuid": "ab65262a-f8e2-4f99-8a33-30befbfdc7ae", "value": 701952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684709126, "uuid": "417b8052-16ad-426f-a973-cd0ffe182c28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684709126, "uuid": "905aeff7-ed4f-4bfb-af0e-92793c0035ac", "value": "ac23a0048ca9e25149a3651cf9688e31", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96dbbe13-f7c3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684665494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684665494, "uuid": "0da3e9e6-15b9-427b-ad70-269e1705a4a5", "comment": "Malware payload (Mirai)", "value": "7d279dd8e60655566cf1380116e093ed", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684665494, "uuid": "976ce858-9744-406d-8f97-a44c9384fcbd", "comment": "Malware payload (Mirai)", "value": "2a3b2b0a110e9d82dc35519ca02bdd55bc5f35eb93665000b7bdde96eb95bb35", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684665494, "uuid": "36b9eeef-45ae-4515-803e-fcbf054d532f", "comment": "Malware payload (Mirai)", "value": "ebd6604c4f73a729d20357b76cb4a892b883a433", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684665494, "uuid": "e531181f-ae51-4938-972c-40bee876c581", "comment": "Malware payload (Mirai)", "value": "0db358b93f595cf26ee3612f810937da8bace63fdae9fba4e663f0b23748e88ac9aae87eaaf2484859d958e0df0373e3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684665494, "uuid": "38e4eb64-32d5-42df-9519-08d7a6b253c7", "value": "T1A2632A99B401AEBCF99BEAF941120A0DF421E25560930F27B72BFE937D710E1DD06D4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684665494, "uuid": "013023cc-2367-40d5-94e8-34a914bb1cef", "value": "1536:1Tg9OuTO+YbA+Xcp2rOpxya1W27DPtIKHz8tp:uy+YbAEccrIx5wqISw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684665494, "uuid": "66e13857-c4c6-492e-a013-b99383884e88", "value": 67216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684665494, "uuid": "0b68dd6c-4210-4907-8107-6f58f6dd4268", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684665494, "uuid": "927e07a0-30fe-4e74-9057-ef07c5838967", "value": "7d279dd8e60655566cf1380116e093ed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a338b3b-f76e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1684628858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684628858, "uuid": "800cd43b-9a50-4e25-a90e-6bb87a8b3a1b", "comment": "Malware payload (GCleaner)", "value": "9aa8a1a8c021ba9518de5db51a5c356c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684628858, "uuid": "810dd486-5b0a-4e83-adea-2251e3394761", "comment": "Malware payload (GCleaner)", "value": "2ae6838c037be2085eae1df88aa6e366bcf69b3a10491313b52fe7c610c5c411", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684628858, "uuid": "00b7a30c-d8fc-46fc-ae0c-b953d56487ef", "comment": "Malware payload (GCleaner)", "value": "a325a5447ac52c612d203ea0f792394603653d1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684628858, "uuid": "cc5caa95-c7d0-4659-9226-8214498d6b0d", "comment": "Malware payload (GCleaner)", "value": "bb771b791459706c052321cae67981a3fce3622d3e2b06233ba98f5a5fea0c252e2f0229086c281628446557fa2d9a4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684628858, "uuid": "167ce4b2-7b12-4d17-b564-12dc0f043858", "value": "T15A953333D789893CF593C57B4D254919F9323E124CB837A83BA97EEE1B372522809365", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684628858, "uuid": "c0cbf667-ec86-4b49-8e40-14794acd9d67", "value": "e92b45c54aa05ec107d5ef90662e6b33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684628858, "uuid": "716e6ae5-dc59-461f-95f4-9588eea7138d", "value": "49152:iiAatlF6SI5526P8L4UHWleqjslcgwlUwxI1pFJs8wuT:iiAklF6H552fsVlTjslc/+wwpAK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684628858, "uuid": "b1ba4379-df03-41db-b7b0-2b579c9cec08", "value": 1989874, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684628858, "uuid": "dd138568-addf-472f-b2d4-c1651f6dc137", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684628858, "uuid": "c49fecc4-c500-4bc1-a376-00c19eed14be", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45ff90fa-f7e5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684679961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684679961, "uuid": "f5db195a-cfb2-4ac7-89d4-3a80c2f1d38d", "comment": "Malware payload (RedLineStealer)", "value": "6d2967bc7b414fa2123072e8489febc9", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684679961, "uuid": "e6e44ba4-3aaf-456c-a8ad-82771bac394d", "comment": "Malware payload (RedLineStealer)", "value": "2b2d3e5068a807eead0e3c5b2eddf61b8b3692705939817151d907748204d7b7", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684679961, "uuid": "3bfc87a9-a20a-4058-8ca0-c36f131124a0", "comment": "Malware payload (RedLineStealer)", "value": "d5dafc54af40e2129804009445c2b71ec5b07dbf", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684679961, "uuid": "4dc226fe-cb47-48cf-a943-35f3f3220c68", "comment": "Malware payload (RedLineStealer)", "value": "4b4bc8aa741e9d5af5e8394e5f2301572242b74c8546b20fbf32b89a19dfe93ab042ba1f0e28490649a2d938dc4de78c", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684679961, "uuid": "5b953c84-2ba1-4e9c-ae62-daca1b9aed6a", "value": "T1E62523436AD954B3E8B427B058F306930B34F9908DB9936E3780B59F9EB29D06971373", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684679961, "uuid": "bb0e7608-a645-4b9c-85a4-1c4978772e7a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684679961, "uuid": "a0adff48-d11b-4b54-b569-7202e27fc6d0", "value": "24576:zyxG8vAcdT79q+EwsekWjG21pIw9cUeFYf7RIoFabY:Goqh79q+EZekWK21l9mARIo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684679961, "uuid": "7f0ab99f-a278-487b-937f-f20dd291e4bd", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684679961, "uuid": "22632c9d-2a53-4891-bde8-a19c39156e9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684679961, "uuid": "703083ab-ff67-4b88-8bb6-9ca70a63cc77", "value": "526561.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12a6ec05-f79c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Fabookie)", "timestamp": 1684648521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684648521, "uuid": "33e3474a-b01b-4531-b1f2-e5dee503f42a", "comment": "Malware payload (Fabookie)", "value": "f7f9e101d55de528903e5214db5abe48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684648521, "uuid": "8e170510-8880-47e7-84bf-98be71925a48", "comment": "Malware payload (Fabookie)", "value": "2b8975d530e037d398ef15d6e53345672e2c23c8ed99d9efb4a75503353b39f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684648521, "uuid": "b2e7412b-5df7-4e55-b509-c727f29d97d0", "comment": "Malware payload (Fabookie)", "value": "70d276e53fb4bf479cf7c229a1ada9f72ccc344e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684648521, "uuid": "3cb6e068-3c87-4880-a295-43e1a58bb560", "comment": "Malware payload (Fabookie)", "value": "000f689d5cbce85e9d4e0715840cbd92e447a7ab9e11454f787fb907ed53f24c6583c4a7726d8d2516dc0584f0e9dbad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684648521, "uuid": "418fdeb6-b0bc-472d-b56c-ab8688824624", "value": "T18DD4DF81B39095D9C8B88430C693CA71CA317C64DB28569BB7D4BB6F2F32AF16537316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684648521, "uuid": "5c116b10-55ac-4d63-8ca4-fa72b87b1cf7", "value": "4673ad56625d375f2efee239af061364", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684648521, "uuid": "03a35b6f-b7d1-4850-8485-03c486296538", "value": "12288:G72WP3/jlx8Xr3lRkRc4YFwjsWOfRg6gtPbcTTn7qxerx7:qP3/fWr3/kRc4l6g6gtPbcHn7q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684648521, "uuid": "06bf72cc-c2d9-4c9c-86f8-5b3188e4f9a1", "value": 606208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684648521, "uuid": "d869bfc2-1d34-4852-b5a0-05905e54714a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684648521, "uuid": "6f820d61-3154-484b-9d92-25d09fdfbfda", "value": "2B8975D530E037D398EF15D6E53345672E2C23C8ED99D.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f2870d8-f7b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684658421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658421, "uuid": "00aa8375-07c4-41af-9885-59644c9b83ce", "comment": "Malware payload (Amadey)", "value": "ee9615d7cc5014a7d0ae5b500bc3f91a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658421, "uuid": "7fa6989e-07a8-4bf0-8757-09033e758e49", "comment": "Malware payload (Amadey)", "value": "2bdf8792b7da9a3ca0e0ed486a50d702c42e6674dd4e78d4dd37a8fab4e7abe0", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658421, "uuid": "f95bcce3-d198-469d-8917-15f87d1f8ab8", "comment": "Malware payload (Amadey)", "value": "a428722ecff02d71755cb0125da9950629771686", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658421, "uuid": "5430a805-430b-46a8-811d-8035abf6bbf8", "comment": "Malware payload (Amadey)", "value": "02de73f47d197f2f27b4638a55329ee839d2af0f39dc1372f48593eb7435a46c3efc2ee396cf8c09fb032817a3ee1950", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658421, "uuid": "eaded554-12ce-402b-8f63-fec37b6de39a", "value": "T157252352E7D884B2D8E16B7098F503D71B35BCAA99F44B63178558460C723E8EAB133F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658421, "uuid": "71a1ae83-a414-4be8-9d83-58400fe5f3d6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658421, "uuid": "8081addb-8cdf-4b33-b100-892fea3a5af3", "value": "24576:KyfBcTVzqTB4Kp4NSOLiyGPZUUHBBspv:RfkM2NSBZUUhBsp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684658421, "uuid": "3d0ea775-6f6e-45ed-8f74-8256dd36c2ef", "value": 1056256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684658421, "uuid": "5b0779c4-f3d6-4047-9e03-0e1d53035d70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658421, "uuid": "27be32ff-6253-4b8e-959e-8d2483832479", "value": "client767.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1ff35c6-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684680545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680545, "uuid": "a32dca8c-51c3-4783-a399-e242209ce6da", "comment": "Malware payload (RedLineStealer)", "value": "91b465db2595924490222deede322f17", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680545, "uuid": "2a2a5e6a-62ec-4865-9840-de670e453b3f", "comment": "Malware payload (RedLineStealer)", "value": "2beaea10e58a9e53221242c7ede1fd227b2e3895f5d126752feb570b139dea52", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680545, "uuid": "599d8dd3-02d4-4f07-9df5-b6a1c8f03b28", "comment": "Malware payload (RedLineStealer)", "value": "2d43dca07e7162dde68140efc1ff4f7e46b98a3b", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680545, "uuid": "812424ad-e98a-4d3a-8d32-182f6d6d431a", "comment": "Malware payload (RedLineStealer)", "value": "0b5a4df41591ebb1d6edad7aa943035fa3df38c9da58558fd453005cd591e63c0326ecda3f7656baebd79fd7ddd8af86", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680545, "uuid": "e68666dc-da20-4901-9521-d5ec1fb5d32a", "value": "T109252302E5DD4472FEB5273149FB13832F35BE509978C32B638A696E1CB36C29572362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680545, "uuid": "d94d2fec-1a9b-45fd-8ea5-4c3651cfee32", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680545, "uuid": "4a0c23df-4ff8-4131-af47-53a45d42b14e", "value": "24576:5ypSmIk4rOtmlo27Ps274H8C0+usfo0TLpLqS:spSeP27Pse4Hv6shTLp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680545, "uuid": "6ce2ecab-371a-47a8-9860-48cc78dd8026", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680545, "uuid": "b5a1e620-db56-4778-8e87-ebd8c5028a99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680545, "uuid": "a1042890-ddec-4446-a422-8dddab93a493", "value": "cumloader138.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "099982af-f7b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684658385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658385, "uuid": "b61bb465-25f5-46a4-9dc6-e2898fdf52a4", "comment": "Malware payload (RedLineStealer)", "value": "162cb39af6e1077e01ae32a57e404970", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658385, "uuid": "f11e2f7f-003e-4731-b809-3520ba0c1ec4", "comment": "Malware payload (RedLineStealer)", "value": "2c53b7f0c722186a31df931c0f8beb25f0c50f7bcb2ffaa5d46bdee112ce7198", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658385, "uuid": "dd4f20ab-7966-4919-bded-310016e54aeb", "comment": "Malware payload (RedLineStealer)", "value": "5b7b384768c2b2a36b14685b6307fb17f9109d88", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658385, "uuid": "9f501d88-b8a3-46ba-9007-ceaf44e819b3", "comment": "Malware payload (RedLineStealer)", "value": "de8891d89a646f6d8ef6a84d5a7567b08b6604d4c3ee019b9ee2e4eb9ba6b4b6634e162f20fd7243f5980157d0270014", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658385, "uuid": "f0ca3d60-3fe4-47cb-b317-8d84e38fc762", "value": "T1BCE3D624279F8930D6BB4E3D6CB19CC076BCEC12A542D74A4ECCF5593A73B809B116B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658385, "uuid": "4d465a31-7b58-4699-9364-4dcfa3460dcc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658385, "uuid": "6326b093-1cd5-4a00-88fb-78c306dbeb96", "value": "3072:2V+m5cNQmRSxWWAcP+DDXedh7Z58e8hk:2jwCUudh7z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684658385, "uuid": "d3a36c2b-4b86-4021-a6c3-5e0df43fa76a", "value": 148727, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684658385, "uuid": "9ce67dfa-933e-4296-b388-b848368e53e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658385, "uuid": "29af28f0-d280-4a4c-b5bc-d1c5e1fd1357", "value": "274722476.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8959332-f7a7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684653632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684653632, "uuid": "2ce68bab-57e9-4272-95f0-f85fced9d696", "comment": "Malware payload (Amadey)", "value": "ca4fa8901c03e9627fd160c0670f6209", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684653632, "uuid": "f1e68294-3b1b-4ba6-803d-920e7bc9f0c7", "comment": "Malware payload (Amadey)", "value": "2c87c3e54bc56e5ffe9485d08c491eb939ab48a634649fcb57439eae91c08a8e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684653632, "uuid": "8f9541b9-60d1-4d02-8482-c07c831fab66", "comment": "Malware payload (Amadey)", "value": "860491d26fb3f7f0ec7a43f7955919ca92323874", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684653632, "uuid": "ec504317-1ca5-42e8-af74-06f168377b3f", "comment": "Malware payload (Amadey)", "value": "71ca4ccb280cc161e693b825a4f55c8ea11bd150ad331a2900a8f9fb3e9c4657f6b107e0fecc531ede11a087f2f6b959", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684653632, "uuid": "cacebc2a-e6b3-4d59-93d5-621809889732", "value": "T10C252312AED89054EDB52730A4FE43D70B32BC665E3467AB3355EC291E735809832B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684653632, "uuid": "73d33fec-e243-4cc6-a2fd-7bec3b08b69a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684653632, "uuid": "b29e4687-0ee9-4c31-a5c0-164be11de637", "value": "24576:ayARW6AcRYR5wrBCZqoCB08qyG/uLdTQuF4qJolZx0ZQIqsybTLsIx:hAwcRg5w4ZqoCB0lz/2drF4PEZQIqsaT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684653632, "uuid": "18f0ea80-70c9-4c88-b5e8-24accf91fc7d", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684653632, "uuid": "9480256a-51d7-45d6-b3f0-3ec3edec5e68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684653632, "uuid": "34cd80ef-91e0-4c5a-9315-05019764e335", "value": "ca4fa8901c03e9627fd160c0670f6209.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df3be0f6-f7c7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684667333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667333, "uuid": "343bf03d-4348-47b9-9d82-1f5a6f3ec938", "comment": "Malware payload (RedLineStealer)", "value": "848f18368e6b7ef7516c2d7f78d4493b", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667333, "uuid": "455b3168-0608-4052-b4eb-c90e2b983dd2", "comment": "Malware payload (RedLineStealer)", "value": "2cf5d8905600b1e26198ffbe96fcd9764d176d5a1bd898f2589cf635b05fb2ab", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667333, "uuid": "f29690ad-006c-455b-b55a-94d5983a0c77", "comment": "Malware payload (RedLineStealer)", "value": "fb18cff03a70adefbad616f5404eb71eef3ce7cc", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667333, "uuid": "3244bb5b-9237-419e-8f2b-bdc89b8960f2", "comment": "Malware payload (RedLineStealer)", "value": "6eeaca8c53a4985ab4595caeb9945f18544971798c4590e94438b45cf957b1522bfd2e30c75de0400be78ff86f985cc5", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667333, "uuid": "5d617e15-789a-4acc-b2d1-51d23f27b7d6", "value": "T1D5252326BBCC40B7EDB0277068F622C31A357EA64D78D19F2796481D18B3D45B63237A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667333, "uuid": "a5344070-fc5f-4260-9c25-aa795bfb510f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667333, "uuid": "9926c219-09c8-464f-baee-669bd25ea64f", "value": "24576:my+3Y3iEYUhOnq9JfSuufw5/vhEDzXF87:1+3Y3i1UhKqPImvhEDzX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667333, "uuid": "8258ae49-6c95-478c-9e00-d75670363534", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667333, "uuid": "9d2c5a02-b13d-4ea8-836d-9c2175b5f1a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667333, "uuid": "b6d3acaa-ac45-41b0-8550-aefe5f89e1d0", "value": "graphics342.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "893c401b-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684680503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680503, "uuid": "fa42fede-8bf1-4492-b20e-a35632f89f69", "comment": "Malware payload (RedLineStealer)", "value": "4beb6350fc9af200a652d968905aa893", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680503, "uuid": "d1c3fca8-fde3-4233-83f5-34b25d4a73a2", "comment": "Malware payload (RedLineStealer)", "value": "2d36f01776d1341dbeacfddbc76f0e7503cce34784533b3d35e3748478eb6fd1", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680503, "uuid": "be50ef01-acb5-4a51-933e-5ab11c1a7ba5", "comment": "Malware payload (RedLineStealer)", "value": "fb196dced163123a730abcbf4f307874f5ea33cf", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680503, "uuid": "92c64b09-d766-4f8e-8a7f-3c0f24dade93", "comment": "Malware payload (RedLineStealer)", "value": "80ba5832567600ce91e86dc04944676dc6609a8306e4ab08874167cc61eefe1ae15e175f72f0566d25f262747a4f7583", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680503, "uuid": "fb3c5577-a25d-4908-8ebf-442e6a478483", "value": "T11725234B6BDD4022DDB0477045FB23E31639BC909C39839B3651B96A4EB21D9F53A33A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680503, "uuid": "2b0a8d7e-11ee-4f57-a751-aa8eddd33157", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680503, "uuid": "629e3445-544f-4931-9008-ee8601466a22", "value": "24576:RyjX8QqZGZha2D42jIrv0oNqJnrz/N7scqeciAYLYC:EjsQqZ1KfjaqV3/N/Gl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680503, "uuid": "95e3cd34-b60a-4a35-af68-8290f71e6dbb", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680503, "uuid": "cbf09631-d988-4c28-a2d6-7bf9b571a8e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680503, "uuid": "deb72ed6-ca51-4f06-b1ca-4e4835a478a1", "value": "Temp635.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "476f90a9-f7b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684658488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658488, "uuid": "986b315b-6478-4f3d-8224-2b6d1c203465", "comment": "Malware payload (RedLineStealer)", "value": "c7226bf439429e538d5ddf8bd10a5a83", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658488, "uuid": "0719c0c7-caad-42b9-a4a0-0cef041f2fb2", "comment": "Malware payload (RedLineStealer)", "value": "2d3e7a574b3c30336d9ded12eb236bf5c7e978b6c5c5fa378ea93f9be18238fd", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658488, "uuid": "9ef4a235-c1b6-44ec-aef0-4686212c3cf5", "comment": "Malware payload (RedLineStealer)", "value": "8332d99f7a76b4edd717aba24a373e0445f488bd", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658488, "uuid": "3d357150-d54e-4aa7-9233-3f757f18042d", "comment": "Malware payload (RedLineStealer)", "value": "1436cdb845b84b71ba90ae9c64a49fdc43d7667fad517fda3582afa7220d2e2d3398d3865c18676cec7cf1bd0870f056", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658488, "uuid": "94664415-de77-4dbf-958d-85c845b9064c", "value": "T197252313ABCA417ACCF123B15AF712871E35FCA12938531B26D2F99E4DB22C49635772", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658488, "uuid": "05eafa66-7139-4be5-bb8d-b19e39f0896a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658488, "uuid": "0a737c1a-cc95-4b82-b434-28a23e92f2b2", "value": "24576:nyEPPdLwiPq1C2XtFi7wMLRTMMRNxDVu:yIdLvPq1C2XtFirLhMMT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684658488, "uuid": "5308b3d2-175c-4a89-9ce5-412145892197", "value": 1044480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684658488, "uuid": "d67baf19-3a0e-4aa4-aaef-abd504fdf536", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658488, "uuid": "981cdcf0-e69b-487a-a9af-29e1d8b99d3b", "value": "start493.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af31ae80-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684680567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680567, "uuid": "deee1bfd-2788-47dd-babf-58e412d554a5", "comment": "Malware payload (Amadey)", "value": "4b3e44b602ae08df703d909c19e02877", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680567, "uuid": "22134c48-4a55-4841-ac3a-166cb8735d51", "comment": "Malware payload (Amadey)", "value": "2e227aa4adc1f1786e57b7b5e45c136961449bb97c1dad4a0c12a2ea8160598b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680567, "uuid": "08932271-418f-44fc-aaaf-285a5481bfb6", "comment": "Malware payload (Amadey)", "value": "191245908345c3c3d9544f3048bd188b6e318f42", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680567, "uuid": "6301527b-6387-4f3a-9b13-5cd690a71bdd", "comment": "Malware payload (Amadey)", "value": "a051644949be0083dd5f9e0dd0883f0311aad8a007e7807771a80c9ca077a42f4f0f1ae2c9eba88c256daa995d601325", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680567, "uuid": "06dde26d-f42f-41d3-a826-af68978812b4", "value": "T15B252303ABD85477ECF567B49CFA03530A3BFCB28DB0535B2B5568665DB2080A93173A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680567, "uuid": "d7b2016d-0031-4c52-98f5-89a5d01b6f56", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680567, "uuid": "006e1854-4874-4e20-91f9-d806a8c3ee05", "value": "24576:lyZAEn0txPHIUnqYE5R3lI0rwtQ5nUvZ5u26wmATBJdq:AZhiPHIUnqYEHV1+d5u26G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680567, "uuid": "49035924-5331-4ca7-9441-ef8f9c0f7257", "value": 1046528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680567, "uuid": "03b98490-9641-468e-a893-31aa8532a2e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680567, "uuid": "cd75873c-3c1c-4c82-b32d-7d22ad61ca9e", "value": "encrypt251.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b210161-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1684680291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680291, "uuid": "491cde14-146a-4dcd-908d-d601ac778a75", "comment": "Malware payload (Stop)", "value": "6d6e7ca05fbec44feedcd93818e8aad3", "object_relation": "md5", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680291, "uuid": "00be6ace-61a0-4d8a-b247-43bc93b20243", "comment": "Malware payload (Stop)", "value": "2e2b34e40c63e0406314e9d937f9a8c6fc941437e6c8e76acea51dd1f7ac9b6f", "object_relation": "sha256", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680291, "uuid": "d9ff132f-2356-45ad-ae4c-c15cec5b1fc2", "comment": "Malware payload (Stop)", "value": "0cb2fdba65456007f680b923dddf64fc1c4978a4", "object_relation": "sha1", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680291, "uuid": "29f30f1e-ab43-467f-ae2c-ad7e6860c65e", "comment": "Malware payload (Stop)", "value": "0cd1d9666f9155c7734036a2a4d7f6226c862234d3ada1475facc0c27d35cad01a1a1e3fbab471f2b64a05736b27b316", "object_relation": "sha3-384", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680291, "uuid": "217101d9-b995-4f06-a415-bc859f6799ff", "value": "T1BC05F122A293FB67E525C671492AD5F871DEF8604F191BCB22582B3B18712E3CA72741", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680291, "uuid": "40ad3485-439c-4f57-8f63-97e7786dc9b8", "value": "40be65705a95a43e6733e98c1ce5e92b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680291, "uuid": "44402dc2-effd-4267-ae6d-7e008426976f", "value": "12288:QLBG/AFZEV/SX3dzpzBZaMXOOZAjqcQWT/mXHK/P55G3t:QYCEJg1hTauOOSqc7TX/PXG9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680291, "uuid": "d5215526-d00f-4dd5-a8c4-706568d3b7af", "value": 806912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680291, "uuid": "35123321-a37c-4f79-84cf-964baf51d364", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680291, "uuid": "9a7481e0-c127-477c-bf8a-889a7adc4c98", "value": "writer444.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0864fe4-f7f4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684686582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686582, "uuid": "c4063ad1-7745-4499-9ee5-10ef767fab94", "comment": "Malware payload (Mirai)", "value": "5779e87961b0450c0a9722e2a1f5d1af", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686582, "uuid": "7b0be2d6-d2a7-4ebc-864f-fdf0ea96a382", "comment": "Malware payload (Mirai)", "value": "2e4b772c83b3d09fa9971ba8844694cf2fcb9592ebc0a5fcfd0902bad05e68c0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686582, "uuid": "e2ae01b4-694c-447e-a90a-efd9d46403a3", "comment": "Malware payload (Mirai)", "value": "cb93304066cbc0a33f918c1a7bab331b86471228", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686582, "uuid": "bfd9f2f9-fa14-4299-ad83-660ffef792f3", "comment": "Malware payload (Mirai)", "value": "e21d1a4b2c755a2bfcee9277ef5eb9871260d1247b701f48a70429496c73f6978e356fee7c4997b1ceee27e482daa1a3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684686582, "uuid": "2433b366-0d59-4598-8f68-9285770962af", "value": "T105434850F8819623C6D0127BF66E42CD3B2613E8E2DF7307AD269F21378692B0D67E55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684686582, "uuid": "a4b21c94-82d6-47e1-a928-091c3c5182d4", "value": "1536:JLj27cI9clVbwtCEK3Kn/txnMBuHnT4OvvMx6:JLj3l2tGOTBMx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684686582, "uuid": "c9b6ba1e-ca66-4ba3-9003-4890e76cef51", "value": 60164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684686582, "uuid": "42e8b620-ea65-4636-a55f-25a982fd9811", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684686582, "uuid": "1a106774-782e-4970-82ed-d0e1880c0ac3", "value": "5779e87961b0450c0a9722e2a1f5d1af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcbb3193-f807-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684694763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694763, "uuid": "765d8c22-d4d1-4ba7-84dc-422f4292ccd2", "comment": "Malware payload", "value": "696a8a2ade2d6b5401778c5308dbd7dd", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694763, "uuid": "f669bd25-5fa9-4ed2-a397-2c3af90cc7c5", "comment": "Malware payload", "value": "2f13ba873f7c0d0b79560abcec873aca2e2317ee50deb828e9b10712f60b5201", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694763, "uuid": "e30e1fa6-8564-4aa3-b153-d96f4a756c9a", "comment": "Malware payload", "value": "e8179874421e15fbc896ba1e85c1866b65e68952", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694763, "uuid": "75831376-1386-4811-a7da-3e844fe5b2da", "comment": "Malware payload", "value": "e47e54083841d5c5986f0a6907da608d13910058ea884a2b82b747f22d5158d265e151798e91f22219c6bd7f2c3a5923", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694763, "uuid": "429b0681-6d0b-44df-b38e-070224ef7c38", "value": "T127252346A7C050B2FCB153B0A4F5039B0A36BEB29DB4036FB755591A1C72AD0DA3937B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694763, "uuid": "8985b46e-cefc-40f0-b4b5-f6dbc4ffb731", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694763, "uuid": "25034e4c-db78-40a9-bb5e-2c5006440947", "value": "24576:vyRJXsIYgcx4McuOKRKlok1kiur/NpPFsmHnOmx6lh:63pcCMcuvRKl91kiupBSEnOmx6l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684694763, "uuid": "29e4b974-b95a-42f3-bfa9-bd602969e6a2", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684694763, "uuid": "34c53878-274c-4c93-bd9e-39eda08bb8ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694763, "uuid": "5853e584-e6c9-4e2a-9f50-94215e43a0cb", "value": "adapter683.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9aa4363c-f7c8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1684667647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667647, "uuid": "1f890350-1c84-492b-8f75-3c532cdcc377", "comment": "Malware payload (Smoke Loader)", "value": "494d1a36832a50fa1cf1791ffa2e4751", "object_relation": "md5", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667647, "uuid": "710bbdf0-1d22-4a82-8aea-aa7d0f5fad12", "comment": "Malware payload (Smoke Loader)", "value": "2f6a7ddbcd10b2d62926b97c90a2e412db72c738396b58ffd5a4e9f2613623f7", "object_relation": "sha256", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667647, "uuid": "f21567a4-69db-429f-b538-7d067475e2a1", "comment": "Malware payload (Smoke Loader)", "value": "d170d506af6839fd14e4edc7c215fc0c9ac8ca2e", "object_relation": "sha1", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667647, "uuid": "d454bbf1-b831-4d24-be18-b6f9dd4ab3d5", "comment": "Malware payload (Smoke Loader)", "value": "c69656a4c2afa11ca10a637207e923a14ff6a5ac688398a61f99e4799988fb2d6c25e87fe0003d31f3c47bf3623db3e7", "object_relation": "sha3-384", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667647, "uuid": "455fd77e-28ec-45eb-9f0c-544b3b2f192e", "value": "T1D8548D226691EC71F566C632CD39C6FAA63EB8617F5566CB23442F6F18311E2C63E301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667647, "uuid": "c162f483-5357-4d9a-ad6f-ea832028ba15", "value": "bb27c4958c76443fcfe46f9765d838a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667647, "uuid": "0bf87daa-e1c2-4284-9557-980258aa2a5b", "value": "3072:IrBvVYxT2XOkUfaebdhjBGm23tqYptyo3toX+PLsBXpo6tLfSufIfU2qeTdCkkS:GFVYJRkUxBRBGLQNKtouPALBfP2nTA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667647, "uuid": "47e1ece4-56db-4404-9a95-02a0f0114386", "value": 294400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667647, "uuid": "f742bdb5-87eb-487f-b9b2-a55099270c62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667647, "uuid": "6d310572-f855-4293-9a61-93247884bb5a", "value": "renderer292.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "982e64b3-f7c7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684667214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667214, "uuid": "961b9bb0-f6ce-46e0-869b-c1fe885b6719", "comment": "Malware payload (RedLineStealer)", "value": "131f5ceb2532220f7ef1941c03d70107", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667214, "uuid": "efd452a6-bf3f-404b-829e-ea67e77706cd", "comment": "Malware payload (RedLineStealer)", "value": "2fc78afbb2e60d4a90a708722ebe3089dab08738075a5f3b659a9aedea5aff20", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667214, "uuid": "cf7ac80d-7fb5-4c1c-8718-9f728c663436", "comment": "Malware payload (RedLineStealer)", "value": "19b38b3eda860e5016b185ef40db46358add40fa", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667214, "uuid": "2c88ea24-839b-4c0a-92b6-620e0989c8b0", "comment": "Malware payload (RedLineStealer)", "value": "62f55cb4a6975080a9070a579f9dd9622b3a38a2b5b0dbe66e63dced46fca666bd3cb6785c36b4a61ba132c695de226f", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667214, "uuid": "7a7b7ec4-e258-4c01-a87f-ceaadec5554f", "value": "T145252313BBDC8272E875173168F712A72732FC608459826B3A05A65ADD32BD4A53337F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667214, "uuid": "8f780177-ebf5-48dd-8236-cae0dd7b33e0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667214, "uuid": "366f4054-92ce-49f5-9b66-f36b038fb8e5", "value": "24576:6yjjjG7ClsEV/6XqpCeVaOrQ0Tw+TB8kqunvyzg6H:Bj38EUXqpCsakwbkqKvy86", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667214, "uuid": "539d5509-0e9b-45c3-aab9-61d0ed849874", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667214, "uuid": "0d72c11d-6640-4909-98bc-599c2c55ef94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667214, "uuid": "7cb8e7f0-e9a5-4b78-884b-ae6807f5ed45", "value": "32332615.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93435c4d-f7c7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684667205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667205, "uuid": "ee38a65d-8160-4eb6-9c02-3b4ec0fd2ed0", "comment": "Malware payload (Amadey)", "value": "1ad4133b57bb5756cb338e0f5a2b4b93", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667205, "uuid": "637a5aca-0a06-4873-8479-fdec48b9b34c", "comment": "Malware payload (Amadey)", "value": "302b86190b1383c463732b68729cef4f803000d12c47022d0ec9df893868be4a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667205, "uuid": "6b8bcfc0-b99e-44d9-b33f-743cedea0649", "comment": "Malware payload (Amadey)", "value": "a5d89000c6088b24473b1a3b35d05609b7b6193d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667205, "uuid": "f748ec35-da59-491f-bce4-7ca92ab4b18d", "comment": "Malware payload (Amadey)", "value": "ff2b295605c646e05e54f14b8a7b6a928e3103bd516f4661944b8c6df21e46a1d7af02b27f3c81542bd26ebbb33967d1", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667205, "uuid": "77ca25ed-3fcb-4e6d-b7c2-cff80dfb3be5", "value": "T1FC252213ABC88166D8B5237069F207C31A39BD96ECB4822B3705AD4F5D376D88D72367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667205, "uuid": "e8cf0742-9333-412a-8021-2070bd8572c7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667205, "uuid": "3cbd8805-be02-42f6-a89e-89e34476a118", "value": "24576:WytkstVEI7K79oyjgiX20rqNOGQwTBqT4SxPaBBmDd79o4ub5:ltbtVpg9oyjgim0rq/h9iHxSBSW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667205, "uuid": "45d6b276-ae28-47a6-b10e-51c46cae9f9e", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667205, "uuid": "09d2b98a-73f1-4245-ac0d-a6a42d907770", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667205, "uuid": "47d255d2-2bb6-426c-8c16-1c3cd8ef0673", "value": "2467380.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4f7df6a-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684680684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680684, "uuid": "9ca907e3-778d-4bc7-b601-e11cdbc5be20", "comment": "Malware payload (RedLineStealer)", "value": "2284a7c0415702ba9559b543020dd71e", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680684, "uuid": "601b55ad-fe05-4150-8996-d8fdc84415e6", "comment": "Malware payload (RedLineStealer)", "value": "315b9b8d61c2ac60e29f1e684f0de650b73b356b9cf91b16a957107ae1df824c", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680684, "uuid": "849853ef-87d8-4f19-a3a9-a9d3251ac34a", "comment": "Malware payload (RedLineStealer)", "value": "590325ec45d5a376037635c0ef10a84c3e449924", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680684, "uuid": "83f76794-f3c1-486e-83b8-8a618ef0617f", "comment": "Malware payload (RedLineStealer)", "value": "41afddedc7a4677a502277e3512dc3bd75fb0465deffda6e0319f576b494f2862d81082d25e2441f80f1758d0a33f2c0", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680684, "uuid": "653a03b0-028c-48c4-85f5-81a8f353006d", "value": "T1E225238AA7DC8033ECB86BB150FB12971A357CE25D74636B2386591A0C736C56C7137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680684, "uuid": "b2aab888-dec8-4912-b570-2c91d4ed4ecf", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680684, "uuid": "0e5d5874-e7b2-4274-b6ec-645850161ace", "value": "24576:fySHR6EA+PyYZRjrt7rI1Jb/oC7xLEIZ8xpm1BBiWdmBka:qMfyYZRp+Bl7lV8xpSBBq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680684, "uuid": "2c4e8016-c1de-4c07-835b-4c39f4217e89", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680684, "uuid": "1542bb73-1e0b-4592-b15c-f5145d13520c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680684, "uuid": "57af5578-b22b-40fc-9916-eaa8b2dbe1fc", "value": "translator497.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27e5f82f-f7b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684658435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658435, "uuid": "88600bd7-6bfc-4fb8-869c-b515ee9e34b0", "comment": "Malware payload (RedLineStealer)", "value": "552ed6456aea6828295b463180350fb3", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658435, "uuid": "f5544603-8218-4954-8801-903ddc62960c", "comment": "Malware payload (RedLineStealer)", "value": "31e45207c89d074cce3ff58bbf8abd011f777760fdb4594180a8e6f3c7d1753e", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658435, "uuid": "ec9638ea-8d6e-4cf0-bf33-2376972e00f2", "comment": "Malware payload (RedLineStealer)", "value": "6fc2e7d5475255d8ffde32af30910312047c3b9f", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658435, "uuid": "75257b33-19f4-40b4-8d61-1acc672ab3df", "comment": "Malware payload (RedLineStealer)", "value": "89df33e5a0ff961f25b3c0ce8030461566604e3a84779bc328cd4f59711eaecfab73742cddccceb91ac9d5280709e19f", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658435, "uuid": "e002e0c9-a96d-44b3-be66-818d4a6565a6", "value": "T1C2252383EAC4487AFDBD3FB540F602830B317EA04679562F37499B8788B259455373B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658435, "uuid": "e6b216c0-d60c-448a-8e23-c6d6bc5d3bb0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658435, "uuid": "0d03b526-f6d3-4bc4-943e-a71af6ec9b44", "value": "24576:Yymr/1cWUe06bvcsaqIKeW9L0qpGWNmjLtvfIvIoVc9:fM/aNcvcsaqIDWp0RxjBHIwS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684658435, "uuid": "c35f92cf-5974-4cee-bcc2-cc598abe093b", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684658435, "uuid": "37449644-ae9d-42e4-9e34-89c3dfed2670", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658435, "uuid": "39ab18dc-6a31-4bf6-aef2-674e4ffbae27", "value": "engine396.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cc30bd7-f771-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684630097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684630097, "uuid": "4d46e2de-e850-474d-b783-cf218a354869", "comment": "Malware payload (RedLineStealer)", "value": "92daaea5cfb1d13ade9ceb3dda97afba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684630097, "uuid": "442bb5e0-8406-406b-96e4-6bdc90f6291f", "comment": "Malware payload (RedLineStealer)", "value": "321ae80740d78f6853cc76a43c721ead6511cdb01d434bd7f705fc40bb02b4f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684630097, "uuid": "4fcba27d-c089-448b-bc54-cf9ef3dc0557", "comment": "Malware payload (RedLineStealer)", "value": "de304256b631015b12194e6a4dd9b594deef9988", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684630097, "uuid": "d150a5ff-0332-44bd-a7a7-46d25fe7b776", "comment": "Malware payload (RedLineStealer)", "value": "f1aba2a53736193c6ce337a0a80cd84cad0749411c28a79ae2783b45beef99f0bd0735e020dd19373054395971cf2fa5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684630097, "uuid": "d4810e95-5a1b-4384-8975-c66b0af22ce0", "value": "T1A7252362D7D961A3D6712BB00DF903E70B31BDE16A70831F3345AE5A4C226D195B6337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684630097, "uuid": "e7ba57f1-d6bf-4070-8c5f-baa3f8d0b274", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684630097, "uuid": "841d47c6-9129-4e7d-aef5-5b6a2d28397d", "value": "24576:LycfEBj2jRkrhgve40IE5q7qcH+zL6nbZVzr09QfvO:+Zj8RkrhgvZw5q77+zGbLf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684630097, "uuid": "2dc79dc7-590a-4b26-8231-d6a5fc6e2671", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684630097, "uuid": "5cac75e2-030d-489c-9296-030b86ca79ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684630097, "uuid": "3de32259-aa4d-42f2-b8f4-7048c469c45f", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6da7a5a-f7d0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684671211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671211, "uuid": "fefdfc0a-b926-4800-8e84-a747c2f1f48f", "comment": "Malware payload (RedLineStealer)", "value": "fffea5c2987a92279eb2e3b4fe7bb296", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671211, "uuid": "450c4666-65b9-4ed0-8199-0c11cf7b3aaa", "comment": "Malware payload (RedLineStealer)", "value": "32499716be4b005ba37b2050fb213e55ac944310523cd104f5c0150ca2eae78c", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671211, "uuid": "4be5f9a7-6e7d-464c-abd5-ad0dfbf7d3ae", "comment": "Malware payload (RedLineStealer)", "value": "99a547313d5f6add371fe1f8716286870c583609", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671211, "uuid": "3e56b846-a1be-495d-807e-69aa51afbfe1", "comment": "Malware payload (RedLineStealer)", "value": "b3f3d1b97f894c392f8cc72813c030f2a2f54c8b32bced016a5a6d9ee6e158a30f9104610a7e0e2f9ed01076c183bf9d", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671211, "uuid": "64b0babf-f79e-4c93-b97a-60640b1320d9", "value": "T19E252387BAD0903BD9F027B014F703C32A367C734978525B37D9AA5A1CB2696A53437A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671211, "uuid": "0568029e-6b26-4eed-b8ad-a814da6c6df9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671211, "uuid": "ff7db50c-aa6d-46fc-8fd4-6e4b849aab5c", "value": "24576:1yk+T8IM9mnIM79xkEbfAZmymzYlGATnXqz76:Qk+T8IGAxxbfAAyGATnXqz7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684671211, "uuid": "466b16f6-45ea-446e-a671-4d121aefa4a7", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684671211, "uuid": "6e96e511-b649-4ced-aca0-4a989a7e6617", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671211, "uuid": "5f5bf749-f296-4571-9c10-bfcade500392", "value": "AI624.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae8595ef-f7ed-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1684683572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683572, "uuid": "65fe2558-9c49-4e77-8f9b-9e352c0a59dd", "comment": "Malware payload (Gafgyt)", "value": "81d6b2fa373ce55146a6e51ca0b9c8fc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683572, "uuid": "b2bb3f90-dfff-4301-a45a-c832d10e61f3", "comment": "Malware payload (Gafgyt)", "value": "327baca96bc6775c0a757af2e175554a7edb2162d451a020df5bcb60ae8e350e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683572, "uuid": "8ccc8963-088a-4185-a479-4c20ce7b809e", "comment": "Malware payload (Gafgyt)", "value": "084989e27829a6e81b55c1bacd0a5cc8c9ae478f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683572, "uuid": "26052ddb-5513-4589-af9d-ed074a3f17be", "comment": "Malware payload (Gafgyt)", "value": "e61fc6b046f768a1c555dcd8ba47e05f7f3c23e997b9e35356bc9df18964442ffc447e0d0f41b1a91c9c86b2cf4b066f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684683572, "uuid": "f2912596-0f65-4994-aba0-5d9501bb3b48", "value": "T149831A46D3A2C5B3C4831BF605E7D72B0231F9164B2A9F0AE36DAEF47B12584719A317", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684683572, "uuid": "1fe52c16-fd14-4816-8d12-4675b6788da7", "value": "1536:L3oLQ5TCzSVYERb1aGy8gwi5veMbBZzp6+m5CsNFPVYLf0:D8Q5Tv+U5aH8VkWMfp7mwsN1VYLf0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684683572, "uuid": "e3d3a5b7-74aa-4756-9ae0-d0b03a41fcff", "value": 87461, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684683572, "uuid": "f039ac44-8bb9-4a00-a7b6-09259af43c62", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684683572, "uuid": "13cc4fa4-7831-4ef6-90f8-e0a1a8fcc696", "value": "81d6b2fa373ce55146a6e51ca0b9c8fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ea8edd1-f808-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684694927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694927, "uuid": "336fa912-8c94-492e-9033-47286857d1d0", "comment": "Malware payload", "value": "52ca7e5b7bd871056b88dd69cc64e025", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694927, "uuid": "efce2822-e9b3-4243-bd9a-7a455c2583fc", "comment": "Malware payload", "value": "339f295a76b1dba49782c01baa54ac1af7986cf00a380133a4cf4b88c0e81abb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694927, "uuid": "411563bc-8fc8-47b5-bb25-88dbd847e689", "comment": "Malware payload", "value": "eb16b07a7b0677d319321abf387a92ecb2f94576", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694927, "uuid": "eb0c6a17-911a-423a-b8cc-7f9070f1a803", "comment": "Malware payload", "value": "5130061f5b5f0a133b7fc0539bf60b922233e0fd3b1b09c7658eb071d1b8f817bad5acc3019901840ee4bfa1fd907494", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694927, "uuid": "0093c14f-2127-45b6-8e5d-cb35d37053df", "value": "T169335B89FB83D4F5EC570570107ABF335A32E0FA2169E782C3B5A531AC62511E61BB9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694927, "uuid": "c3f8dbfd-f21d-4230-8f8b-c3d13bbe6898", "value": "1536:JNmze6wzYgbIuVlO5p068lpEUmC2spNs4nQ5FMrQ:JNmi6UppVC0HlzmzEa4n2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684694927, "uuid": "ad86717c-4cb0-467e-b374-28303937fb64", "value": 54164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684694927, "uuid": "12059715-aa7a-498f-97f7-1ab34f58f21f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694927, "uuid": "0e5c9722-8556-4871-b67e-ae0e15276821", "value": "52ca7e5b7bd871056b88dd69cc64e025", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7487e68-f807-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684694807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694807, "uuid": "547010c8-0e43-4540-bdf3-ced7ff85a3d5", "comment": "Malware payload", "value": "b07b05482d03f0ca5e46c58b06e56a09", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694807, "uuid": "9f9f0c26-27d1-47a8-a449-171b642828f4", "comment": "Malware payload", "value": "33e5dc0a4c22d70da5d74e872469e168ba9aa7dd5e220fc866615c2d6d33364e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694807, "uuid": "8ab7be25-4d02-42e6-b886-1812c2ac39a1", "comment": "Malware payload", "value": "d0fcc0deec6c52c2f260ddab5bd0b73229ff715a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694807, "uuid": "207659cf-9551-4c2e-a9fa-fbd5981c7abb", "comment": "Malware payload", "value": "f23bb8e7edce2e22fc6c124ab6b57434b0e955a130e3dec53f589b37b0e76d7f055505089d7188563e15beb6747bc4e6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694807, "uuid": "1b12be87-7f52-4de3-9ad8-33c55902e79e", "value": "T1542523A3BEE880B6DD7527706DF207970732FC61CE74822B66967D4B0D72A405870B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694807, "uuid": "ada298ea-1a7b-48ae-be54-fcd751caa083", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694807, "uuid": "1c172585-4664-4983-a724-773e7f81114e", "value": "24576:NycFljhvfvAnAqColJFEFj2LHruudGn7vxgald:ocLjxfonAqB0FMLivxga", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684694807, "uuid": "e72adfb1-8e99-425a-94c5-6c55275df192", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684694807, "uuid": "344fd689-9503-4910-95b2-b26c3398ccb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694807, "uuid": "4ae8bd27-9208-49a2-9405-8357a4995d78", "value": "debugger281.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b4575a7-f7b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684658441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658441, "uuid": "289f7922-019f-4c22-9d77-1507560585db", "comment": "Malware payload (Amadey)", "value": "ece4919b9e222b9039bc6bc8706b095c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658441, "uuid": "f80aa0f5-f3cd-4ea0-a109-fd8b82b2165c", "comment": "Malware payload (Amadey)", "value": "342b7e552bae8c24724b801fc3b03886915fd3bedcd218a182497e46f013f92d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658441, "uuid": "f814ec5f-c27d-4e81-aff5-721b74f15485", "comment": "Malware payload (Amadey)", "value": "c48a4b86d6c0c4728480baeec0df65d8480d76b5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658441, "uuid": "3199a1c7-f8df-420e-b4b9-cad0f8e81e7c", "comment": "Malware payload (Amadey)", "value": "892e17f238170f55154892e2a0507a9d11b5aa0a6037c2a5c7986a7dab14b64e29538a947fb2d32981041d937aabfa41", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658441, "uuid": "af79d760-6fa8-40ac-aee7-17a3d241a673", "value": "T1C7252313ABC89037D9F217B178FA03430F35BCB58D3453EA3345994A59B3A4AA971B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658441, "uuid": "de3fe34b-00c6-40ba-9c40-6f416398f5e9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658441, "uuid": "ddb69dd7-dd48-4976-9817-be7267ec511e", "value": "24576:bys1XUZeG3+fOvTWSq+vvO9rxqZmdAEntqtC6IeIZy51:Os1kgI+MzqECxqx4ogu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684658441, "uuid": "e2889aba-c589-4a7c-932d-700b2d5161ac", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684658441, "uuid": "cd5dc9a8-9f89-4435-b6f9-9ef20f8d8442", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658441, "uuid": "bf1ce44c-c1ae-4980-9c88-a6bfea886c66", "value": "gameplay296.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07b92b13-f816-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684700902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684700902, "uuid": "f0004e17-a189-4c4e-97d4-bed976c6e1b0", "comment": "Malware payload", "value": "fe64a4a3ffd4fe9f675a04e55ef77252", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684700902, "uuid": "1283469c-ec6d-4449-a948-8e4ab8e22ca5", "comment": "Malware payload", "value": "349f8ef1c2d0b0151a17569fa1b732382f42bbcd0d3d2a08314a0384a59dc40e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684700902, "uuid": "c88a99be-23b7-429a-a6f2-4228a5da8940", "comment": "Malware payload", "value": "d3919a449ca79ebe5c60752efd39badcddf84c74", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684700902, "uuid": "de1b02ee-be8f-4d6d-ae4a-97b941fa186a", "comment": "Malware payload", "value": "038e609a52304cd9606f33b318dcd54c5a254e2993b2a171f5e8da8d3a0b18ca3cc60ab260209c803aca5fcdd08a3600", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684700902, "uuid": "118b02d1-3342-46da-80e9-c560f786f5a5", "value": "T1F7F2E1012D40ABA6CD3F84FF22256BB4FCB34A539AC7D86B6D41497144065FD2D97AF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684700902, "uuid": "01abdd83-3364-4c32-9722-d1255f554eea", "value": "768:CbbguzC/+sRJUsDgj2gi6VzqN3QmsA1YNlW69yptJgGlzDpUYsa:CgSEjG2B6Vzq1YC6slVqY1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684700902, "uuid": "06b88573-a1b1-4006-ae79-e9860caa9f24", "value": 37524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684700902, "uuid": "ba09fa05-8037-49ec-9d12-bb1659bd5dd2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684700902, "uuid": "15545cb8-66a9-4d76-902d-915363d90ddf", "value": "SecuriteInfo.com.Heur.20230521202727054861559", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18228a34-f809-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684695346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695346, "uuid": "878ef092-1ef0-414e-a1d0-d282eeb8e9ab", "comment": "Malware payload (Amadey)", "value": "95cb2d18264d39db0d7cebcfcd3f9bb3", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695346, "uuid": "dede05a3-004b-40b1-9b14-afc116319a9e", "comment": "Malware payload (Amadey)", "value": "34baefb6a151ca76a6e24d0c9bc7c42d01c80937c07551d0e02645cf5496d690", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695346, "uuid": "9e0326b9-6be5-418c-97ac-3f935db3caa1", "comment": "Malware payload (Amadey)", "value": "bfb19b46419575f9f41acb68bd382ac384736be3", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695346, "uuid": "6b9bd2ee-ab43-4e0d-92e6-ec71f85c66bf", "comment": "Malware payload (Amadey)", "value": "41c6fea29832ac35608b888a28aa25932148c582cce3dd683772e31a21b44264bd099f69200b5788aefd280dbb2c4ec0", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695346, "uuid": "474c9391-62c3-4ae2-89cf-302b855c79cf", "value": "T1A6252303EAE85036EC75173054FF16972B363C22D930A6277BC49E6A0DB2954AB7133B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695346, "uuid": "547ca9c4-12db-44d4-96d2-df1def2fc583", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695346, "uuid": "3ab04682-ef86-4dcf-8e26-024dcc3bb5dd", "value": "24576:1y3DM+txhqaDoHi9hH3AKsXnE/FCa4HThb8zpZv/vD:Q3FtxhqyKi9hX9+naFQTGpp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684695346, "uuid": "e60020ae-6a73-496e-8600-51f5efb2f450", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684695346, "uuid": "ed789f9a-4ecf-4261-bbf4-a690eb338fa2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695346, "uuid": "f1a12bd7-2690-4e3c-95df-38cb14c93664", "value": "preview810.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e80cc816-f808-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684695265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695265, "uuid": "81bb1edd-8a42-48d3-a5ef-ad5a60be7e50", "comment": "Malware payload (RedLineStealer)", "value": "34db2d5021300988827115ab3dcd0f12", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695265, "uuid": "67020ced-642d-4a2b-ab9f-1e74c16afc4e", "comment": "Malware payload (RedLineStealer)", "value": "34cf9ff2df7df33f733ec7aec528fcf0c1af8967e0b0761d8d6b4c10b4371bb8", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695265, "uuid": "b4c390c4-3b69-4cac-a44f-60a1777adbcc", "comment": "Malware payload (RedLineStealer)", "value": "1113618669f936308a567c8f3049a1837e5308c1", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695265, "uuid": "41512839-fe5a-4291-927c-4f5a2ff07981", "comment": "Malware payload (RedLineStealer)", "value": "4a85dc83231548de5ef4ffa0bbe928cc7ad8bb1c52557b919f527fcf2ef1e01f08b988ebe852565e4b0006723fd9de9d", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695265, "uuid": "4ad8670b-2bbf-444d-997d-ca7e048dd41b", "value": "T172252342EBF92171E8F55B7058FA16C30734FEA0987893276796BC9A1CB1480A877737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695265, "uuid": "5363eea1-0d7c-4ed6-b1d6-13cf16789042", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695265, "uuid": "de5908e9-84e7-4e9c-b314-0b75b3f68ce5", "value": "24576:xy67R6JjMoUhWoqv7Kv0Rv+fwu4o7bBGDrhg5cfCS3w:kjJjMoUUoqv7KvBV7kq5cK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684695265, "uuid": "a07aabb1-4716-4eb6-bb88-7d3bc2827c52", "value": 1046016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684695265, "uuid": "1550ed4a-6901-4eed-8b45-e8e138fcc3f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695265, "uuid": "0bc4e9ba-7150-410c-9ee0-f6af6ea475f5", "value": "app919.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b536e58-f7f4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684686439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686439, "uuid": "63b83647-5142-4d4a-ab3c-48d71c7efb93", "comment": "Malware payload (Mirai)", "value": "307b75340aa299a96e31f7edb5f8939f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686439, "uuid": "9940c41f-ced2-47a0-8a51-5dda51652e5b", "comment": "Malware payload (Mirai)", "value": "355ef5304b0814c10a62644e8044f9cb54f983a42260c97b3296eddf1aece78a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686439, "uuid": "bf7df376-1ad8-4078-b545-4a0e304a70c1", "comment": "Malware payload (Mirai)", "value": "cc3648af7222ea6e7dd3025888595029886bb9fd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686439, "uuid": "abf18b17-eebc-49c1-9db0-ce1c3262abd4", "comment": "Malware payload (Mirai)", "value": "736d5259489332748ff525055dc4fdfaebf346a39c6fc6e1a0fad473da4a131d54efa31b83375898e781c953b8780292", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684686439, "uuid": "45cedcd6-5f61-463a-9d6c-0acc11f31474", "value": "T16B433951F8819623C6D0127BF66E428D3B2613E8E2DF73079D269F20378A92B0D77E55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684686439, "uuid": "0026a74b-c3cd-4f74-b5b2-b3cee79b9e36", "value": "1536:xLjm7cQ9ctVzYlaUKrqqi1xXU5OfnT4yvvExH:xLjXRQ1mmTVExH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684686439, "uuid": "e93ffe38-00bc-4ebf-b065-5261299bcd3a", "value": 60156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684686439, "uuid": "d0947310-c0f0-4354-887c-96f66aaafd88", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684686439, "uuid": "30ac5553-1cb7-48cf-860c-d2a5d5be8d53", "value": "307b75340aa299a96e31f7edb5f8939f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f06ad88-f7b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684658394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658394, "uuid": "7d208def-b214-4afa-9659-520be39209e4", "comment": "Malware payload (RedLineStealer)", "value": "092c1338b251c8631d0086247a2f8287", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658394, "uuid": "67271e24-6967-432d-a825-82e873a3eb7f", "comment": "Malware payload (RedLineStealer)", "value": "3595e92c4dfe4afbe4579e594c1b19562285c5cc1a911b2f86bdd44bb9988feb", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658394, "uuid": "03aec8bb-e0c3-4e29-8a29-55975532caf5", "comment": "Malware payload (RedLineStealer)", "value": "fe5023d520e7d79862dcd6f9c580ffe4bd193860", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658394, "uuid": "48152ab2-2048-4cb1-a9e1-594e37bab883", "comment": "Malware payload (RedLineStealer)", "value": "a519ab9c5b6974ca829bbaba15acbba7902eb1f4f01a31e2283ccf2980f8b7abad92e7dfffcb6f3d59f86544b3697281", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658394, "uuid": "1047446a-15ce-4d7a-9b3b-5876b2a38a40", "value": "T10D252302F7D09D76D4B0573038FA42931732FC644A39977E738A648D5DB2A91AA3633B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658394, "uuid": "7089f688-00f4-43df-859d-7d9c6a8f549c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658394, "uuid": "3b7e17bd-1893-402c-88fc-83969f65895d", "value": "24576:LyfmS4lSmHnVASwJ4jZfkSZLFmjwu3dfTgMKch:+fN8SEb3FftL0E2dfTr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684658394, "uuid": "295ca1b7-3fe4-46c9-bd64-28978d9c8d73", "value": 1056768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684658394, "uuid": "40997127-0701-4f40-ba40-910c37279b26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658394, "uuid": "eb02a85b-fe05-44b9-8e25-80726ac86c7c", "value": "646745784821.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "707cd0c2-f7c6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684666718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666718, "uuid": "cc8f18be-39b3-473f-9ef9-bec29922084d", "comment": "Malware payload (Amadey)", "value": "8ff7f4497733575e8640ae61b3f94343", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666718, "uuid": "2c88adb0-a00c-4ef3-98e4-e7a78dddef07", "comment": "Malware payload (Amadey)", "value": "35a4f273c54268c51ab1506a22d45e3d9e0a7838c5850d38ea4a7efb0b038fb8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666718, "uuid": "b0cd6710-80d0-41cf-8ba2-ff79e79f3460", "comment": "Malware payload (Amadey)", "value": "f8f09b11688516d42db74a56abfa286dbecccdb5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666718, "uuid": "bdb2ad43-d5fc-491e-8d48-c91fb59a1239", "comment": "Malware payload (Amadey)", "value": "47a7ef9d9da5b5092ad34a0a67232eefcfd2c44567cb1a87cce745840243ef7a3905b417753f42c1cf975ead78f4236c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666718, "uuid": "5568e22a-902d-4192-899b-d07651f0b72f", "value": "T113252306E7D54833E8B5A37018F263871B36BC63AD28868F2B49594B1CB30D1B97173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666718, "uuid": "d8e67f10-cbaf-49d6-8175-970e76a4001a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666718, "uuid": "93a73ede-8acb-4522-b664-b10a0f2bf3e2", "value": "24576:Qyw+L5cfgiYfn5BA6j1G3JQh0WRewx7hmgS4j0/SdEvR4F2lk:Xw45qkXA6j43JhEeo95wwq4F2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684666718, "uuid": "af511627-509e-4056-8915-5740ff034b53", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684666718, "uuid": "e42ba44b-c5f2-4581-a675-bea22d3bdee3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666718, "uuid": "1c69e4c7-89b2-47e5-a1bb-f699fdb9bf64", "value": "pdf-reader-pdf157.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f9cde34-f7b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684658395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658395, "uuid": "86e0d8e3-c2cc-442c-bdf6-33959a14701f", "comment": "Malware payload (RedLineStealer)", "value": "5dc7f7ab40f769366a80ac7bc26168f3", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658395, "uuid": "d6dbf7d5-e60c-4a13-a236-3dedb53bee1e", "comment": "Malware payload (RedLineStealer)", "value": "35eeec0f8d3bddf615029df7725f0f800bf83d15fbb4419ca38bde76d4057a19", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658395, "uuid": "ed2fa86f-4f64-4533-812f-5ff4fdbd3863", "comment": "Malware payload (RedLineStealer)", "value": "7842fa3fc9369d698e40f562174da91069da1ea0", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658395, "uuid": "730f5e68-6a27-4e09-8378-1c284e32c41a", "comment": "Malware payload (RedLineStealer)", "value": "714b528323e3a710afa91ae9275382fdd76056460c932f8995186fad28389458bf36811d17dd03e85dad1632b46f6818", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658395, "uuid": "c19ecade-798f-4f21-9eb7-3a84cbe5d95a", "value": "T154252302B5D8C426ECB527B058FF03A30F377CA49A34836E2B856D5B9C63295D878797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658395, "uuid": "ed904e99-bdb3-41d1-8155-095be9d89a40", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658395, "uuid": "6e8919fd-6d1a-41fa-8271-446fc63afd2e", "value": "24576:+yDXSS2phYhyE/F2yueCgHRpMDewGuFM3bwS+U/:NDoSI2F2yuerYMGwwS+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684658395, "uuid": "cb8c967e-91c2-4209-824d-e6d599ca262c", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684658395, "uuid": "5acca408-9149-4c9d-a04a-ee832a31ff21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658395, "uuid": "7299e702-d96c-44fe-9c3e-70d5381b6e75", "value": "66234584.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "007b4a23-f7c9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1684667818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667818, "uuid": "9044b931-7806-4f32-b3bb-dfc4420e2911", "comment": "Malware payload (Smoke Loader)", "value": "526f559de9ea0c06e68b34e3ea58f49f", "object_relation": "md5", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667818, "uuid": "a151d735-0d52-4552-9412-4a9d36ea28c2", "comment": "Malware payload (Smoke Loader)", "value": "36654561e0b8b9b0eb24ae1c5054fb6c5055afaa684f16ef0e919d5a46ccd1aa", "object_relation": "sha256", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667818, "uuid": "fdf4615d-f7e9-40a4-8ac4-31dc611cd540", "comment": "Malware payload (Smoke Loader)", "value": "e44c88392678ba9daeb3e2c087a13d571d6ec7e8", "object_relation": "sha1", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667818, "uuid": "40dc7979-526b-41f8-b222-05f9a182373b", "comment": "Malware payload (Smoke Loader)", "value": "1911cacd1371abfa31390e95ab275fc37018d18fae511a35b242e2411668c1b0ab75ec54ef1b0a82b0112def25c7938c", "object_relation": "sha3-384", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667818, "uuid": "243fd3da-1fd1-4302-ade1-1a56cf7c9d18", "value": "T1C6644B1352D1BF62E5224F729E1EC2F8B6EEF9508F4967DB62146EAB14702B2C573301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667818, "uuid": "79cbcdf8-a5ed-423d-bce5-559ea10c06cb", "value": "c3945e210b1009128598ead2a7524d0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667818, "uuid": "4b3f7215-a2f6-4aca-874a-deb9b9253254", "value": "6144:9FDlSKQgVLTB6xp1avmdMFUJdn7i5Oj4VqTUF2:7hQK/B6j1a6ll3UF2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667818, "uuid": "79a31ebc-19aa-4dc6-8eee-0b4b67aa3bc2", "value": 330240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667818, "uuid": "5cf69d23-f6d2-4a4d-8aa3-3233a3cce2db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667818, "uuid": "789cf136-e5b3-4667-8700-288880242574", "value": "readme951.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dce39127-f7c6-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684666899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666899, "uuid": "147b7762-8237-4dab-b480-f34bee16f764", "comment": "Malware payload", "value": "5a42fd5c6f2d1c1c3ffdc383ba2c806d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666899, "uuid": "a13a9b9a-98bc-4c16-b628-0e6d8fcdf6ea", "comment": "Malware payload", "value": "36bc49ede8e0f4a54449602ca2bc681f96b14869841a243ddfb7d94fb6f28749", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666899, "uuid": "0e268f71-485b-4b55-ae46-8fbcab820b2f", "comment": "Malware payload", "value": "65f74589e9a32ed978de589d6af98ad4b4eef30b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666899, "uuid": "3a21368c-b339-423f-84cc-1d7cb23b101c", "comment": "Malware payload", "value": "8892f7122c2cfcbc018f525bd06666c020b083b8ead7b32a71b832e23d35be07cae649c849ef6bdc68a86a996d7936bb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666899, "uuid": "3dabd208-463d-4ffe-b670-ccfe00d678ea", "value": "T180B38E26A9336E57C4C465B912FB0622F1B9070E34BC8E297E914FDDDB20B903517ABD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666899, "uuid": "b5275673-192c-4842-8eb9-a4f5275ba3ef", "value": "1536:hAbXJNEjvzlUkJDwdD1pb9OSXU0VHQp1v3pYQar/GqREGUnp15T551td9YH:KIG3pcSXU001vb1nr5NDmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684666899, "uuid": "403e0cdd-6a15-4c59-9572-0159bf701046", "value": 108220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684666899, "uuid": "758a284b-5b08-49c2-8763-343867acb742", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666899, "uuid": "b32169aa-3400-4f0b-bdfe-dbf2d19293b8", "value": "sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1032525f-f809-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684695332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695332, "uuid": "05d0aa84-76cb-4a4c-adcd-6df04f16116d", "comment": "Malware payload (RedLineStealer)", "value": "213678e1066f317db7eeb295a012bb56", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695332, "uuid": "8dac4d9c-4101-411f-97e1-2cbab3f66370", "comment": "Malware payload (RedLineStealer)", "value": "379bc2705dbddff662caace1e146bc2fc774ee711e6652462ef798fb8bbf91d5", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695332, "uuid": "9af30bd7-5a74-4a0d-be93-b8fb855848f6", "comment": "Malware payload (RedLineStealer)", "value": "0167fae0adad9ea09af3283198bcf0d88c91d4b8", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695332, "uuid": "cdce6fd6-eefb-49cc-a58a-9ce52e90a188", "comment": "Malware payload (RedLineStealer)", "value": "7177b0042507e8d412bee4bdc78851fd8cb3b42284e2185a14afc333bf82d5fbbccb333dd0665f7da27922a1c51c4264", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695332, "uuid": "27125974-939c-4e39-a7c7-86c5f057ca9b", "value": "T198E3F824279F8934D6BB4E3DACB15CD076BCAC126952D7464ECCF0593A73B80EB116B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695332, "uuid": "c8b50328-dbae-4ff6-92b1-70fb31718689", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695332, "uuid": "07648716-e9a8-4680-8592-bf9d546c69f8", "value": "3072:vV+m5cVQmRSx9WCEkEhPW67V8BjVhtZN8e8ht:vj4oihwlVht3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684695332, "uuid": "343e56d5-4e39-4055-b580-fdfca68d4c6e", "value": 149101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684695332, "uuid": "0429d89f-9232-4070-8a87-f43b0b94c2ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695332, "uuid": "39c8ed7d-4082-455c-95bb-dd4a32cddbf1", "value": "parser989.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae2d9fcd-f7a8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684653936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684653936, "uuid": "90a29093-fb9b-4aed-9342-f307973fa6d9", "comment": "Malware payload (RedLineStealer)", "value": "aa0b1bedaa726666295eb80b36584c79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684653936, "uuid": "31b4a101-4b49-487b-a2f7-1147e5f9999a", "comment": "Malware payload (RedLineStealer)", "value": "383247a2a5215734d9ad338cd72839783bf363e639ebf973b448820db7007e1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684653936, "uuid": "9778b082-846f-4fc6-8a5f-031d6b3316ad", "comment": "Malware payload (RedLineStealer)", "value": "70d6d5b2d3e2b6c4c3d14ce7f1d6c87fe22dc3cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684653936, "uuid": "0bed9562-5401-4b54-8b26-31fadee78df5", "comment": "Malware payload (RedLineStealer)", "value": "3f5a00f742c24a4d9ba95dd22f074cb230f6091ce6ceab8dc8f008ca95f4505af0634474b01f1963bb7e4e633a66a802", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684653936, "uuid": "2c7db57d-c67d-47bd-810a-259301d74669", "value": "T1A0252356BAE904B2F4F22B3068B602D307357DB0D93187BF3355794A1EB2252663737A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684653936, "uuid": "c03a4635-82a0-490a-9ccc-c65b133286cb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684653936, "uuid": "c177e95a-065f-46d8-93e2-8d1d420d10b0", "value": "24576:WyQnSfz93rZsnqwTvHJp6lqaKmv4geEg06U+1:laSfz99snqwjpp6ZvnlD6U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684653936, "uuid": "795603c4-418d-4acc-a5d3-58798e7f36e5", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684653936, "uuid": "4b01ed73-a04f-42af-aa8f-3b2396c6c599", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684653936, "uuid": "3ccc1bcd-b8cc-45df-9428-d4919879211a", "value": "aa0b1bedaa726666295eb80b36584c79.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dbe34ab-f7f4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684686470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686470, "uuid": "ebb43d9b-a839-4517-bcda-f5e5d10c2973", "comment": "Malware payload (Mirai)", "value": "6d59f7768da416a34ca15ea2aacf6a9e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686470, "uuid": "6a67002f-9c08-4970-a5d5-a364b12097f8", "comment": "Malware payload (Mirai)", "value": "384ad81fb8b4b25e148c71e32b164410d8e7e76158022cee9b3024f5fd8ea282", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686470, "uuid": "9f6ed06f-cd27-4c05-9ad6-58dce8cbbb1c", "comment": "Malware payload (Mirai)", "value": "35255b96bfb14524211480da7f474e77d76f525f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686470, "uuid": "64fe20f1-56fa-43c0-ba87-97181eabc3ff", "comment": "Malware payload (Mirai)", "value": "5483a98fbe890caf832f9c85b697729522b802fd5533aaf6c4016f906758f093c9873ef807170b92484ac0d6100acb6b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684686470, "uuid": "b1de2262-89d8-4006-bb67-d77fd28d4965", "value": "T164433851F8819623C6D0127BF66E42CD3B2613E8E2DF73079D269F20378682B0D67E55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684686470, "uuid": "430cb054-2f9c-4004-bc19-e98b559918bb", "value": "1536:JLj27cI9clVbwtCEKDKi/txnMBuHnT4OvvMxK:JLj3ZZtGOTBMxK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684686470, "uuid": "c31040a6-2cd4-497a-bd74-ce47f2950fc9", "value": 60164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684686470, "uuid": "ec0277f4-d6e5-4bb5-b14d-b848db256479", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684686470, "uuid": "800c4928-a4f8-4946-a02f-7f3943578fa1", "value": "6d59f7768da416a34ca15ea2aacf6a9e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc438185-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684680642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680642, "uuid": "2739c479-dd19-4b3d-8db2-1b144dced2da", "comment": "Malware payload (RedLineStealer)", "value": "20c38417c48f197aace9032205ff66d5", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680642, "uuid": "09290e85-0842-46b9-abdc-82bd0ab9c0f3", "comment": "Malware payload (RedLineStealer)", "value": "38640ad951cedbe074941932c45abe9d73240b44bd99954564f07fea35bddfd7", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680642, "uuid": "16e3e671-5c4e-4a42-9be4-7feb86077f02", "comment": "Malware payload (RedLineStealer)", "value": "62eab18afc7fd773f878ffbdef0f1e74c327a1e2", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680642, "uuid": "d7c3b5a8-c310-4c24-a523-5d03fcd4a3ba", "comment": "Malware payload (RedLineStealer)", "value": "9b02e6f996fa0ad6b30b0551d577f0b2e0125957df62ac37deb17dcc192102654e801ee30119d38f0b141a96618ba33c", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680642, "uuid": "32499992-3847-45b8-9a14-7eb2f1cd99a5", "value": "T107252343EBE844B1C9B16BB408F6429717767CE08D78436A6381690E5DB2AC9F63931F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680642, "uuid": "a0e5753e-32fe-49ce-87e5-b19bc9c94c14", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680642, "uuid": "23c5981c-99ac-4499-8ea2-93bcdde3d6ea", "value": "24576:iyNwZrH6khWvF1n8mU3so+zaxA5T0YPHCT6UT8S:JN2rakhWdl1Vn6T/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680642, "uuid": "b1da8e0c-a538-4ec5-9990-5a8d6ce716db", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680642, "uuid": "c6cf6727-2003-46a2-bc87-0e7f16cddf50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680642, "uuid": "1f398776-ecac-4df2-adf1-cb9c023e5ab5", "value": "reader289.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0306354f-f7c8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684667393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667393, "uuid": "6c98afcd-857d-4dbc-97b1-126f92cf9331", "comment": "Malware payload (RedLineStealer)", "value": "5e35dd7144c5e359081323e9455e17b6", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667393, "uuid": "59d88129-1673-4be9-b233-7d6f1a0cc4f3", "comment": "Malware payload (RedLineStealer)", "value": "388cbe87e427423a8229fb46b669924d3496f987be4d8b02732a430353f3a72d", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667393, "uuid": "6570e3cf-865d-42f2-9954-cc774549ebd1", "comment": "Malware payload (RedLineStealer)", "value": "27d54821c073a0d979172f079cbe61dbd026f1e2", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667393, "uuid": "ed40ec5e-5714-467e-a66c-f3891668c915", "comment": "Malware payload (RedLineStealer)", "value": "c2b4275569a5152ed3215aa2fb914027ea49ab7f77f88142903c600bdf78302f097490a0fe816444e42290a1834079ca", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667393, "uuid": "b3779742-0399-417c-b067-5b43707f3fa8", "value": "T109252343BAEC9032D67113B459F506870729BC61997C93AB1B49BDAF0C62790E93A31F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667393, "uuid": "b733989f-43e0-4a3f-b23b-2dee13b95b89", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667393, "uuid": "b17091fa-2a48-495c-898f-5e4cef08a6c3", "value": "24576:Dy04cOlqZUpmm8waIBaAw/S7FgCtu7aTsVTbBOgQ7:W04cAq2shwZBrxTsVTbBOF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667393, "uuid": "78b3329b-c314-4b67-8dbf-5f4fd2d5c2a1", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667393, "uuid": "42a3cc24-67c3-486b-b2ba-9dd272ebb3c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667393, "uuid": "798e0a97-dc8c-432c-ad12-21664e9ede2a", "value": "renderer387.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "452646ec-f800-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684691556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684691556, "uuid": "3dcc0719-2b77-4259-ab7e-cd9e036a6d4c", "comment": "Malware payload", "value": "06c45e866dee86cdabbbe33ad6019467", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684691556, "uuid": "12358538-2c0c-4f68-a685-9ef309c2f5d0", "comment": "Malware payload", "value": "388fb1537d336f645cbe254d044967081f7b6b843f642e3c9da6d820f85fd3e6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684691556, "uuid": "3b2093e5-9f00-4fbf-b4aa-4d0e15960ad6", "comment": "Malware payload", "value": "f96a4bd65346774d8afb9ba1b90ab59fcf59f20c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684691556, "uuid": "a120adc3-21ab-4595-8b2d-015b65e30c98", "comment": "Malware payload", "value": "ff740a7d1ddeddc2233b265581c0f3bcd80015aa2523509dfc15e5aa8c872d60b93a290b8b7a83faa787dbd9178baaea", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684691556, "uuid": "c193a70d-e4d7-4b59-b8f8-dec06f299a2d", "value": "T1EA830806BF614FF7DC6FED3746A9070538DC550A22A97BB67634C428F65B24B09E38A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684691556, "uuid": "e9c08d3b-8d2b-440a-92d6-76e84ecc98bc", "value": "1536:E2NLcwc+0PrNTjEojq6kpGZcnC2+hHgvXwp2Zz/cGcJsKi9W:E2NLcwcldgqNk8gv42Yxi9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684691556, "uuid": "4c0eb91f-8059-4ad2-be47-1bdbccb8508e", "value": 85664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684691556, "uuid": "61576827-e58f-4ecc-a734-7a9c3fd2577e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684691556, "uuid": "ae6be483-cbf4-44fd-98bd-7bdca1ef2e75", "value": "06c45e866dee86cdabbbe33ad6019467", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3c111d6-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684680682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680682, "uuid": "54ef6174-e66f-42bf-b62b-f5ea74ec3ade", "comment": "Malware payload (RedLineStealer)", "value": "f97c0ac990bcb80c29f74a80908ca529", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680682, "uuid": "aeb63a3e-c3cb-4744-8d7e-ab6a7f0bcf3f", "comment": "Malware payload (RedLineStealer)", "value": "38987886a37626a4201ca12c0e2301040d841cd697e42f5ef21f1370aeb4544f", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680682, "uuid": "65b8e1a3-4d2c-463b-a814-0f169bba87e0", "comment": "Malware payload (RedLineStealer)", "value": "103a6e6a72961be39e0066163166c6a64f68088e", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680682, "uuid": "ea0cf69e-bf7e-46c0-a230-abbd288263ca", "comment": "Malware payload (RedLineStealer)", "value": "15e62ae5bba3be07ae2009199398fd2318f6bb4dbdf60566a264fc10866fe326b2a723c7c8ceaf7baa5e068f7ca44229", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680682, "uuid": "72c97982-d7ef-42c2-a30e-43e1f80bc075", "value": "T1A72523567BD89472DCF0273908FB06830B37BED0A630A66A2794691B1D336C76836767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680682, "uuid": "e590cc41-e36d-465a-b231-8e696cfa1197", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680682, "uuid": "988b4cc8-ce0d-4705-88cd-a036d76ac181", "value": "24576:ry+DOYrxAKAH30UqKChDI2EFijAQNHZ2nw7:eerx+H30UqVhp9dZi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680682, "uuid": "6fb45c4f-5a35-463b-88fc-0c4644622ece", "value": 1046016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680682, "uuid": "302841e9-48d8-4608-97ed-9fe8a736ae6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680682, "uuid": "ef4cc21f-b4c3-4b1f-aba5-ecad0c0b7a67", "value": "tokengen892.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7426ca5-f80a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Neshta)", "timestamp": 1684696096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684696096, "uuid": "61a4ea29-8845-4c95-ad99-b128bb0a53b1", "comment": "Malware payload (Neshta)", "value": "825c1b8271c7a89060514ccb1ddfdd27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684696096, "uuid": "d6d54a2c-f025-428f-ab05-3ce978b0f09e", "comment": "Malware payload (Neshta)", "value": "3956258994c42b8394da2ca90e95313ad870f6611c0b2ce86c9cd247b57ae6f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684696096, "uuid": "fce0651b-3112-40fc-ba23-6b38bcd071b0", "comment": "Malware payload (Neshta)", "value": "75b4505c8275855a9e15497d0d364c800b9d15fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684696096, "uuid": "224b80fe-ee9d-4981-8dcf-8995e7880a62", "comment": "Malware payload (Neshta)", "value": "c50ea1980cc808af3366acf2177d01f37ca38c0b7864b06956530f0330d917837454822723fcfc60a34194c78bae2f31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684696096, "uuid": "49382d50-ec19-45a3-b1bd-7ebf5b4c1099", "value": "T119F53366E383C039C00A4234A84A2B66D37B9D273D1917236F823B5DFD365D77E4E686", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684696096, "uuid": "4753319a-13ff-4c96-84fa-2f8225e5d839", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684696096, "uuid": "33506acc-417d-4fb1-929b-b52b424b4c88", "value": "98304:WRVPnq1y5tQOM33ZNqCtBixHl54Oyjes1boc9:IVPq1yLanrqTr43eSl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684696096, "uuid": "5d9735ae-cfb9-4417-adbd-28cb8a355f48", "value": 3595144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684696096, "uuid": "3d7c95b2-bc60-418e-bb83-f0510d45a3e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684696096, "uuid": "57654536-5dba-4633-8660-144f5cdfe185", "value": "IMG001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4d5360c-f7c5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684666403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666403, "uuid": "0fdcf983-164b-43eb-ac91-40186902db6c", "comment": "Malware payload (RedLineStealer)", "value": "a74c64d4f9e8abec8eea6ea1191ccbed", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666403, "uuid": "0d2d75e1-2b74-490d-a03a-be5bfa4026bf", "comment": "Malware payload (RedLineStealer)", "value": "395df00eb3b6de2e70fa11f9c33e46f8fec949709375fba210efebefab28a70e", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666403, "uuid": "0e98914d-22ee-43b8-9125-507528b56c4b", "comment": "Malware payload (RedLineStealer)", "value": "8c082a2959643af314fe3717f0433eb0d4e2babf", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666403, "uuid": "d25fcbd5-4291-4601-9918-08e480087449", "comment": "Malware payload (RedLineStealer)", "value": "9157c19e2d6a80a1b5779050ebf95cc5a75473a1a0d713317f0d856ed76ca912180e052b3f22d4dcf90f5d8426aa3233", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666403, "uuid": "42682321-54b5-42e5-a45b-5c6218e7fd71", "value": "T1A62523A3AAFCD421DC791B3098F306D30A37BDE09874932F2255499E4EA35C8A935377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666403, "uuid": "6ed66a03-d22f-4926-b940-b7e7f5d9109d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666403, "uuid": "21cd3d61-0276-4fc2-82a6-22078be4faa1", "value": "24576:DyNW8RXuYDC30jfqui6BjFB4+USDe22XWXh1m:WdR+fGfquicjFB4ADZD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684666403, "uuid": "9d592170-a6ae-44d2-a5be-92494918f79e", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684666403, "uuid": "cb974ecc-7144-4c9b-b3ad-3625c2158333", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666403, "uuid": "34692c1f-33a0-491d-a666-04c5bcc100d9", "value": "7463534349.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20db003c-f7d7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684673885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684673885, "uuid": "670689ce-010a-49b6-b335-7d9365270c1d", "comment": "Malware payload (RedLineStealer)", "value": "d141b4a939a9056742792fdfbb9a8702", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684673885, "uuid": "49783fc6-fe19-4059-a3d0-f5614c664456", "comment": "Malware payload (RedLineStealer)", "value": "39b35860b0c28f1b16c3a2f9eddcbdaa66b1f2cf0123d2a102c294cb9fe57d6f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684673885, "uuid": "1f521157-8b1f-4ecf-8f7c-72b833c5363f", "comment": "Malware payload (RedLineStealer)", "value": "d881425f2c61e0a738ae4e14c1aad89b8c694591", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684673885, "uuid": "abb184ba-cdc1-4ca6-81a8-2652e4d324c1", "comment": "Malware payload (RedLineStealer)", "value": "85c033ee5ccd77ee16d6bd81175ee009398792f9a8da484a0e7f83024a0c115e2e905d379579d7ec19e6630473209667", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684673885, "uuid": "6c6e2106-60e4-46d9-9333-89a70b834a05", "value": "T1B4252212ABDCD431EAB26B7064F513C71732BC61CA7997BA2304E91A0D73784683277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684673885, "uuid": "2cb92e79-1307-41e0-90c1-ff9ac0e2076f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684673885, "uuid": "edd645c3-75a9-4e8e-a5ba-7dc1b13eaa81", "value": "24576:Cyd/5fHw5Yq8vFoe/bx96eNdPrdN/LI679WS:pdBfHw5YqE1Smd7/LnW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684673885, "uuid": "62600a1d-7322-4ffc-b824-f93a6f613025", "value": 1046528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684673885, "uuid": "77ffeb5f-8cea-4774-a469-c4612c8d6197", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684673885, "uuid": "d6786ade-8a61-4eec-a5b1-16bd9895f899", "value": "d141b4a939a9056742792fdfbb9a8702.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71039e72-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684680462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680462, "uuid": "2892702f-1680-4463-96ff-6347446b657a", "comment": "Malware payload (RedLineStealer)", "value": "5d811d9d5fb86b1209fe3748a89d7ea1", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680462, "uuid": "181fd62f-9ec7-4520-9c63-6f8cc4e86e40", "comment": "Malware payload (RedLineStealer)", "value": "39bf613e31de54ec22f34d34c3a342d4dd7c0c773dfeb849bb575384843c88ae", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680462, "uuid": "1e7fe7b7-e3f4-4086-a257-653de9ed958b", "comment": "Malware payload (RedLineStealer)", "value": "0a0a5967b7199b70918ab082b7c18b08f2402782", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680462, "uuid": "02b08bde-5309-445a-8202-aef1327a3625", "comment": "Malware payload (RedLineStealer)", "value": "c8953da498f591f68c2c4c5f5fe76bd538d55eaa8a303e693f4addd9d48744e7418bc0067744157c4788b5c5087f9a7d", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680462, "uuid": "07ee0f5b-34cb-4b3e-a801-451acebaeaf1", "value": "T193252353E7D98536D8792BB018FA47470671BC728E748A6B3384699B1CB2BC0F43536B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680462, "uuid": "807f83ae-5dc7-4a93-a147-22073409a597", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680462, "uuid": "59e80ce4-62f7-45c3-850c-48f7f8f21898", "value": "24576:0yajS5YSMX4+hHKU/lngR2EafEtHD3+b9DgdvxTHGdS6BOBo:DsS5D1wHTng8XfE1LR9xTmdSV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680462, "uuid": "088217cc-64e7-4753-8802-5d4c26b99a9a", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680462, "uuid": "d268f1a7-6bca-43d9-bccb-a880907ee6cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680462, "uuid": "942c7db7-61ad-4684-b27a-375ba94e806a", "value": "3535634213.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f792320-f7b2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684658045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658045, "uuid": "634b5d9d-584e-40ff-98c8-2bdfdd78ef80", "comment": "Malware payload (Amadey)", "value": "73f15326a5add0a942c26ae104b0ddd1", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658045, "uuid": "a5219866-2349-4c79-99ff-fd5d629817ff", "comment": "Malware payload (Amadey)", "value": "39d0979f072702256c2a3d280eb072d33338af7b2edb6c62cc7ca9c64b959e67", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658045, "uuid": "ca050ea9-2dff-4954-adaf-6b3831a591a7", "comment": "Malware payload (Amadey)", "value": "e4e27147e2174815c08cbd4fdd8e651063d2ee97", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658045, "uuid": "4b22296d-0b4c-4618-b496-ad73ee79a17f", "comment": "Malware payload (Amadey)", "value": "b708d95a0bc218d542e5d82b5de3f4770e755b1546282e024d662bb2375074ea90e168f0523f25615ae27d8f0b40c0d9", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658045, "uuid": "9477517a-35da-4eba-8959-b36d174f39a9", "value": "T17D2522066FE9A032DDB1A77098F747C30B397DA49C68D36A3B616C090D73990A47277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658045, "uuid": "c6c360e2-929f-4a7b-817c-9ca1aab27437", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658045, "uuid": "3ccdb653-ecbb-4841-873d-e2a14761c85f", "value": "24576:CyaLqaifCrBTXGW7qrLUQrfbGcOKWZ39PKAaNKhTRolM:p2qSrR37qtWV9insRE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684658045, "uuid": "6a347e7d-051a-45df-8463-88876f8c71cc", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684658045, "uuid": "44c55312-02a2-46a8-9668-489bdf387576", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658045, "uuid": "db925569-292c-4a5c-a3df-9291f73af85e", "value": "publisher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "091e89cf-f7b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684658384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658384, "uuid": "f118b038-a9f9-4e68-8991-3e884b59fd63", "comment": "Malware payload (Amadey)", "value": "b55ad1fcff65854d869e44c3280289ff", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658384, "uuid": "b6b230f4-9796-4f72-9258-c3e472bdcb06", "comment": "Malware payload (Amadey)", "value": "39fc18a8d4ead7f673571ea1b12e68982204ddaef91f173a4bde8bae4b32ff1a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658384, "uuid": "0acde30c-f90f-497d-824e-0706bde536b8", "comment": "Malware payload (Amadey)", "value": "6f3e99716a1e00cffa9dff4cd03bfe2f6ba5c532", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658384, "uuid": "cfd3bbd9-b04d-4e34-a8cd-387e5d965eea", "comment": "Malware payload (Amadey)", "value": "2541e42523aead3ea0ab76ecf3f5b068d2384aeede9541b4b567ddc43e079b3265cd99fb8a5c5e84ea3ae82ab1bbab99", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658384, "uuid": "dfb0d8af-b64d-4fdf-be95-1d114ecbcc37", "value": "T146252367BACA0173DAB03372D8F7069B1F31BC50583183662796BD5B2D726C0A13A776", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658384, "uuid": "43d712f2-5037-4327-9720-996d191d3ff5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658384, "uuid": "a11fa963-5f5e-4fc6-83f9-4fdfc598ad85", "value": "24576:JyMxljLjwn1VJjq/GtDbS2zfa23u8EI9R8V:8YlXjwn1VJjqWnS2za2+rIj8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684658384, "uuid": "02a4646a-ac53-47a4-82fa-75b852bdb69e", "value": 1054208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684658384, "uuid": "cfef7105-b624-4158-b570-e36039edc39b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658384, "uuid": "f7a4bb58-08b4-42ad-8ecc-34099a177cb5", "value": "274606.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0639fc27-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1684680283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680283, "uuid": "ed51593e-c2f3-49fe-ab7c-20c3036a1a31", "comment": "Malware payload (Stop)", "value": "e7e0449c46fd9213f79a440794db613f", "object_relation": "md5", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680283, "uuid": "faf54468-0b2a-4b41-b5df-af2053dc6120", "comment": "Malware payload (Stop)", "value": "39fe5bf483fe68f377e26bb250b5647ba7b4e550a4cc6c48d6c3e47dc65d362e", "object_relation": "sha256", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680283, "uuid": "bac6e619-0d43-480d-9175-12988c262a93", "comment": "Malware payload (Stop)", "value": "680d826cc60e3079f00d793de4f4564d9487e87f", "object_relation": "sha1", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680283, "uuid": "a646d83c-41d1-4f18-a06c-913b0628f73e", "comment": "Malware payload (Stop)", "value": "c100e0485c152edf25bd65c9ace50cf6e4408ad45449405d5c70cf11a783a92f2b64436d821bd7b0d6c3ed8b8638ad32", "object_relation": "sha3-384", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680283, "uuid": "90a10f45-7e1e-4fba-9204-75db62f22fd0", "value": "T15C05F182B196FBB2E56587754E29C2B426EEBC618F045BD722542F7F19B11E3C933302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680283, "uuid": "27ec9f7e-55a3-4574-a92e-b270f704205e", "value": "40be65705a95a43e6733e98c1ce5e92b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680283, "uuid": "5a99f305-7534-4857-9765-0b381fc3d6d2", "value": "12288:ej8GNJgH7Sb/RkYBYzuIrK9cG0+MPLNbS9rK8CDdVOHtiN+U:en7gmTBYSowcH5O9rK8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680283, "uuid": "8f37a2d4-6e48-4950-af78-bcb1ed33f70c", "value": 806400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680283, "uuid": "cf6f8e0a-94b3-4fef-8ec4-2aceab8efbfb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680283, "uuid": "93901cc6-3e35-4c55-a611-cd818addee71", "value": "processor533.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3e38756-f7e5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684680172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680172, "uuid": "bbd4a260-7b85-4964-9213-a0fa642e387e", "comment": "Malware payload (Amadey)", "value": "613c7738b8c640c394a74832f4ea914c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680172, "uuid": "abff7c7f-3c04-4ec8-b9ee-3e016549f8e4", "comment": "Malware payload (Amadey)", "value": "3a3cd2721926de4cb5e8004cefd2f081d5165723c62b0bb8d78129500e06bac8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680172, "uuid": "cb68999a-d652-4123-9f89-0fdee4cdc6be", "comment": "Malware payload (Amadey)", "value": "d7d2d8b76498c55a74fad4b462715035104fdb1e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680172, "uuid": "4f708861-754d-45a6-9011-57eabe53192f", "comment": "Malware payload (Amadey)", "value": "53fc6a44f8d076b87a50c10d2188381414a3494fdcf0480434a73d614cc536c0966c08893876425c531ff6f5241a9e0b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680172, "uuid": "8de10c60-0bb7-4df6-a5c3-30561be92f33", "value": "T1EC252306A6C98431DD785B7068F342630B78FCA29C3592A63702BE1E5DB27D0DC7676B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680172, "uuid": "c5d719c4-5c3b-4bf9-aaaf-39e283d9e0d1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680172, "uuid": "685ed0a4-01ab-40d4-92b1-a4f849f1d74d", "value": "24576:bytauMZVOFuPqN46czNaVBzGthf7i0GEoIHbk:Otu7OFuPqNB/VdGrD9G52", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680172, "uuid": "379d1ee8-a42b-40c4-b8da-04f9d4654a1b", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680172, "uuid": "0ef87ee1-5e7f-4b94-85ae-fa732e2963d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680172, "uuid": "91eeee35-beaa-48b6-bb58-9d184fbd4f72", "value": "stealer874.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9a847e7-f7ed-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684683564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683564, "uuid": "c4365c7b-c942-4474-8c75-8860f674a629", "comment": "Malware payload", "value": "0d5cd5dc7b6bee2877b44fa65d25d258", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683564, "uuid": "6d065e9f-e3f3-4def-b200-9bf67a4c5b90", "comment": "Malware payload", "value": "3a4d135877cc022598bf269926879316f227d851956f5b3456c47c1f5c521e03", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683564, "uuid": "7fad5022-28f1-4399-a6c8-fb7365bc8d9e", "comment": "Malware payload", "value": "4f26a304c6d2a6a7adb904e678348d3820bf6a59", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683564, "uuid": "7d037a58-b606-4fd9-900a-79e0b5dc05bb", "comment": "Malware payload", "value": "1b940f37b5b955dd9e1ddc61364932c173abbc29d642bedc832b3a3bc79e8b78602a5287c98b3a93d77b4461abbcacb9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684683564, "uuid": "839b9d43-16af-42cd-b0d5-4684dc3f99ee", "value": "T130E3B4A5640E5F9C9C05A0B502198F389C406D287F7ECEB3D3D6AEBD18930E1E94EB75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684683564, "uuid": "807d5d5f-725d-4901-a0ee-84071eeb60e2", "value": "3072:qTohRrCF+aTHHPGbwboPBZVccqnf2xquY5:q8hRrCgaTHHu00BZF2fp5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684683564, "uuid": "ef5d9c70-1e20-4b6a-9138-f10e5b5f1645", "value": 143912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684683564, "uuid": "582e4350-16d1-4d9c-90ba-f8ca4184ff18", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684683564, "uuid": "c4245fbf-e2d9-438c-ad9b-54e6d0d06c8b", "value": "0d5cd5dc7b6bee2877b44fa65d25d258", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de1013bc-f808-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684695248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695248, "uuid": "a0e00a68-21e0-4c1b-9693-2c57b5c4132a", "comment": "Malware payload (AgentTesla)", "value": "7e742fad53be0251286e9f74d4fd06fd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695248, "uuid": "b3943e10-0e3b-479c-9d34-328d86a402ed", "comment": "Malware payload (AgentTesla)", "value": "3a513d23de944abee925b1e8cd9bebf3c22c6fc3f1eec8b98d0d44c29d873f07", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695248, "uuid": "c4846b33-f825-4431-93f6-3feb03aadaff", "comment": "Malware payload (AgentTesla)", "value": "92f176c0517b2e622971cd7de759e7396ea1f6ce", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695248, "uuid": "07817836-8302-4e13-b0d8-4751a791870a", "comment": "Malware payload (AgentTesla)", "value": "f48285f3ec5d76ff0774c15ac4261ffb3d3f1be6b2ebddde894213b1184db53542264e184687ac6f5414bd067ff78059", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695248, "uuid": "6b9b2161-ed60-4ca8-ab22-ce1784c11027", "value": "T12BA4236786D2EC9C56EDF2BD07CC1FA94E6116E8DC3A820FCDFA735C090E5D92280665", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695248, "uuid": "899d317a-1d65-4c3f-bd27-a3e1267eb9d8", "value": "6144:MMtXuPogCmKCoaUR40W8uW8r7H4pU12w1sIQkgAmqimuUnuNAXFK8nex0DKy0dBs:fX0oX0Ns8YEwIQchuNgF7ex0cO357Y01", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684695248, "uuid": "8d5b85b9-0ca6-4b47-b3bc-7db8fd0c8fe2", "value": 460317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684695248, "uuid": "d6bcb040-b1af-4a0c-bed6-bed43d772696", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695248, "uuid": "29162f0f-f4bd-4e43-9eff-30d0c082392d", "value": "DHL216.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8d189a7-f7b1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684657873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684657873, "uuid": "8201c57d-d7e0-4615-8def-5f387f6954ea", "comment": "Malware payload (Amadey)", "value": "6305b20220755b9a530eab704f67be58", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684657873, "uuid": "181fa6d7-653e-4eae-b7d5-162790946b72", "comment": "Malware payload (Amadey)", "value": "3b4540241597b22b4ef6b40669f7ab70dcf1cc3cd7150ca9d10208a763064852", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684657873, "uuid": "8d53061c-ab31-4956-b33c-674c30a5d263", "comment": "Malware payload (Amadey)", "value": "28f668327924ffd32f9b418df98003a5d676f84a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684657873, "uuid": "89afac95-a9ba-4771-8a86-a90f49ac4c66", "comment": "Malware payload (Amadey)", "value": "e4f902d808201078dc84dce917a5650902633439f01359f40076071c7c9bc54ae1dea0cb61722ee40f4e8b08a7dcd9a4", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684657873, "uuid": "ffdd2c31-4f55-4cdd-96ce-ff9b4755d5be", "value": "T107252323BBDC0833D4752B7068F507D30736BCE09D7D6B99335A844E48326999972B76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684657873, "uuid": "ae0fe089-b127-44e1-85e1-9f09bda4792a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684657873, "uuid": "7a0ddba3-7919-4f83-874e-f5af0b18e580", "value": "24576:5yMgyQKhKPfVClqKAHwWLTMczn1P6wafsfVsZiUTDf0sS5Az:sMPhKPfVClqKAHwWLQsncw5fVslTDzSu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684657873, "uuid": "15161c5f-5fed-40c5-937b-4170a38755c4", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684657873, "uuid": "043c7c4b-fd58-45c3-8b6e-1b6f8141b74b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684657873, "uuid": "375df4f5-8912-45e5-b6be-a81e345a5e10", "value": "downloader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f51a729-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684680433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680433, "uuid": "1bae05c0-cf6d-4203-a41e-1e0346249604", "comment": "Malware payload (Amadey)", "value": "65be99dbd5cc9eb911b91b4c6bd4184e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680433, "uuid": "3055392e-62ef-485d-8510-ebbb2a6a8de4", "comment": "Malware payload (Amadey)", "value": "3b59f8933e2d2dac66ca3bd67aa4c4e834012215dd5a43be01469d4100a0cc16", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680433, "uuid": "4e488a31-554e-420b-8723-7d2a80527e55", "comment": "Malware payload (Amadey)", "value": "75ddd79fb808b9474018b781f695d2c487389dd7", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680433, "uuid": "d2b58b1c-36d2-45c1-a488-b6bcfd4fb405", "comment": "Malware payload (Amadey)", "value": "73522c5799a3a5cc026c22f752cee5dd74f8cd0778a472a227cb9562da3de4ad935211f99dd206092dde620513768a0e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680433, "uuid": "e2e9e3a3-c41e-4cb9-acb1-aef249a851dd", "value": "T1E0252313A7E84131D8E6673458F357470B39BCD09A70A2261789BDAEDD736C0AD36327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680433, "uuid": "a0bdeac1-f223-4e56-85e8-7461e2590131", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680433, "uuid": "f75cc18f-63d3-4688-85b7-251b10d4d16f", "value": "24576:wyhzYWPW8OMruJqSg5LFmvQTBbWD2xJtzeLWrhJME:3Zju8OBJqj5Lkv0BTJtzx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680433, "uuid": "c14150fe-557e-434b-813f-3fce40e66ffd", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680433, "uuid": "fdecc6ee-9743-4d25-b62b-4f1ccff223c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680433, "uuid": "405a352b-5dbf-44d7-953e-106fb4eeb62c", "value": "245245254398.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce9dde53-f7c8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (TeamBot)", "timestamp": 1684667735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667735, "uuid": "22b33d19-3f9b-407a-86f1-c4a3fe7edb83", "comment": "Malware payload (TeamBot)", "value": "2879be81b827ff0500d179a4bbd91cb3", "object_relation": "md5", "Tag": [ { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667735, "uuid": "c36bb475-51c6-465e-94f7-1ac072ae5fb0", "comment": "Malware payload (TeamBot)", "value": "3b648868dace6a94bd3839693a32e49934bae255a856950ae8353212c369ee3b", "object_relation": "sha256", "Tag": [ { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667735, "uuid": "d632eca2-8bcf-4120-8ae2-d09ef0ae0896", "comment": "Malware payload (TeamBot)", "value": "f041b8c960559640c049de94f4b31ed97a778b96", "object_relation": "sha1", "Tag": [ { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667735, "uuid": "2fd8244d-4e1c-49d2-8bb1-848c781d9550", "comment": "Malware payload (TeamBot)", "value": "f71a29185c12b406cab0a02ddadde02919d1dbaa79a9da506345b0e0535db7b4fe12a95117bb4276645e90386afba7af", "object_relation": "sha3-384", "Tag": [ { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667735, "uuid": "f3ac0647-dd21-49a5-8d03-290f8eceefe2", "value": "T172644B43A293BC69E9254A728E3EC2F8761EF5504F0967D72218AE3F18711F2D6B7701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667735, "uuid": "15b1893d-c089-42ca-a0e4-d43ee1e466dc", "value": "885df6b18e739ee3563619e20c0ba91a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667735, "uuid": "77d7176f-6b67-46a4-b336-bbbedbb35b9a", "value": "3072:+J/g1AW8IsXFSM1lV96+ACtH8sSdkmK7pIQK20YTrTwnOs/+9OtJpzLPhTqxq:j1hyVplXtB4tKqQKnYT3nsdtLZTK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667735, "uuid": "c78e875c-81e3-4d32-b197-448e1e1923a3", "value": 334848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667735, "uuid": "6b3af12b-72ee-4725-b95f-e7223c125946", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667735, "uuid": "092b92b8-0ada-432a-ac0a-1cd02244423b", "value": "2454814.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d61d1574-f808-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684695235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695235, "uuid": "a22ff4a9-3b8e-4e5f-8594-5f0a2545905d", "comment": "Malware payload", "value": "76b024c2977a54e595e561b8eeb90bcc", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695235, "uuid": "2a667da7-e4d7-484b-b2aa-245c363c31dd", "comment": "Malware payload", "value": "3bb2ab3b397f01ac2734314dfd691626578679ba5183ff328508a4c8651a3c59", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695235, "uuid": "d257be47-e25a-4c38-9004-658ae423159b", "comment": "Malware payload", "value": "fff85b045c35930e36761ad2db012be41269f90b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695235, "uuid": "3b3e8671-067e-4834-b4fd-ad6d6f65ced0", "comment": "Malware payload", "value": "339c02da2a1d21e6670d61172505784062ab124d4053803b827a80d38113bebfc3e81b02b48f2e14f563627a1aa54dd1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695235, "uuid": "5e887476-cbbc-4f66-a793-a5155580239a", "value": "T1ECB423DE97285DC9373250C19A47B8FA43652917A77110C3CA6B891EB487FF2413F2A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695235, "uuid": "7b44e02a-3abe-4ce4-ae9b-025fd57feb98", "value": "12288:lpKA728ExBlCrbWdxwEMseVuyuFdFDDnoKAMyHIDuk:M8ErwrbWdxwEvdFDDzdyI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684695235, "uuid": "be1f114d-0b6c-4474-aa8d-d9509019635e", "value": 530131, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684695235, "uuid": "2f2530ba-f610-4898-8233-c142442c2dda", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695235, "uuid": "cde7bd5e-c906-4745-858a-5dc9107d97c0", "value": "526953.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9439764e-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684680521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680521, "uuid": "aaca6321-8ff7-4b52-8779-5ff697dbfa05", "comment": "Malware payload (RedLineStealer)", "value": "163f86a0f8b8e8f11c24a0ae5c8fa0b8", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680521, "uuid": "bbedfbdc-13e0-45e9-9871-cda5ab8eadc2", "comment": "Malware payload (RedLineStealer)", "value": "3bc9910a05b5d6b5458ac6228cdb1ed3210873bd9cc35699de29a2d417f79e57", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680521, "uuid": "364707d5-2aed-46ae-ab4f-0f5575b89905", "comment": "Malware payload (RedLineStealer)", "value": "7bb0a9b2554a65325bb8e1123da121b601ba3fc2", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680521, "uuid": "1ecfea15-4b39-4eb0-a341-7697d9799268", "comment": "Malware payload (RedLineStealer)", "value": "ebb850deaf05b90c8a3a3eb5f285f102fbf177f5a97b335f84368f4c5f61d818e69e2536794be7eec2d9570c88c9d14c", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680521, "uuid": "bff442a3-d9e6-4d4e-b4e4-0014f1b42dc6", "value": "T1AB25234379D98033FEB63BB158FA61830A35FDA08CBC52AA3744E9461C32A497536777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680521, "uuid": "2b876c1f-93b5-452e-8344-7a177a953a61", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680521, "uuid": "8bc080bf-8803-4f07-9be4-aeb51d074677", "value": "24576:yy6GUSptBI+KY6PSq2U77tnDWA9MNicpxGcWIWicU7Tv:ZBKPSq2cp1IicHGaWi/f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680521, "uuid": "1d694f1d-fddf-47d9-a4d0-946ec77794f1", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680521, "uuid": "4afdadfd-4f08-453b-96d8-a15a06504753", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680521, "uuid": "6d891363-040f-4cc5-90d5-aa421fe96d1b", "value": "calculator366.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0886802b-f7b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684658383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658383, "uuid": "8ff138d8-83b3-467a-8f87-0f5c90d1807b", "comment": "Malware payload (RedLineStealer)", "value": "5dd179448d5ab32d921cc26a4201d445", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658383, "uuid": "350a6082-2dc8-493d-b622-ce85664f1352", "comment": "Malware payload (RedLineStealer)", "value": "3c1470392d3a38ed16a5d101fea2c18d248a899906aec06c467c33af80265cb4", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658383, "uuid": "95234fcd-4f4b-4d4b-b39f-cbad199fb478", "comment": "Malware payload (RedLineStealer)", "value": "fa42d8edc2c333b72e990b251bcdd7e53fdf2767", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658383, "uuid": "fadf1833-5409-4061-8982-4e5324105546", "comment": "Malware payload (RedLineStealer)", "value": "1b8d27e9b4826e40ec2f3dc08e970a44eb362562221f36af0afd062cb78996f7620405661cc98f1c99cb920f0c191117", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658383, "uuid": "2b8504af-c463-41b7-9138-576cb14e7926", "value": "T1B8252367EED81072CCF6537188F613934A367CE1D87987AB2F50989A0C73A809E74367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658383, "uuid": "e6ef1960-3ece-4e3b-aa7a-81c456530932", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658383, "uuid": "e2719b9b-cfd3-4255-904d-c5c4e6034721", "value": "24576:nyem7r2RZtSmtsQm2t0+f05ut6UnGJw4xOdBTjLxnGT:yp2R/trm2+Hu8U0wddBTjLVG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684658383, "uuid": "439d32e7-f9cf-493c-aa3c-2eafe0edd703", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684658383, "uuid": "eeeeb974-987d-4eaa-a2e6-f6b20ed0c4e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658383, "uuid": "99004488-c76c-4b0f-86cd-06b7496dc98a", "value": "2724243594.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "751f808a-f7a2-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684651264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684651264, "uuid": "9ea71c13-b29e-4cf5-a9f7-6bf1227ccc44", "comment": "Malware payload", "value": "14c9c6c830d74dd583dfdedebb136826", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684651264, "uuid": "7b9f29c4-35da-4caf-8829-eb2cc726b099", "comment": "Malware payload", "value": "3c304f0319051bfedfbd91caf611cc1a2c66038eee61d43f96c0b2bfb1c576b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684651264, "uuid": "a9474c0d-f737-4e9c-8dad-418c2e57c54e", "comment": "Malware payload", "value": "f781d7ff9695cfd39007443d3f2a98b82768b207", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684651264, "uuid": "2d5b26a2-b1bc-4ac9-9063-878e0264abba", "comment": "Malware payload", "value": "11b5a7433d59b18929ac60a9b3a8cb55b2db6f0a60e8a0dce929acf8c5d3c36e666ce77b5bbb3f2349be56197068587f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684651264, "uuid": "e06fc1c3-a4da-442d-874e-533e01b8dc31", "value": "T19EE4513C2DBA25E3C038F7AE96D050B3B27B8D23B71E9A6514C307663A7692167C351D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684651264, "uuid": "fc317e55-2944-4928-a54c-4d0281a467a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684651264, "uuid": "ebb01799-ea4c-48a8-a71d-8d4f0751705b", "value": "12288:aKrsoLhgmc1pBWMmxybldRL6+A3kKnOSruYnX9E:DJhb6MA3RLMUryu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684651264, "uuid": "217cb94c-5522-4d09-bcc7-84d3d677ad5d", "value": 701952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684651264, "uuid": "696fbe56-9161-4488-b534-898d5a974127", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684651264, "uuid": "53e18c19-ab7e-4d75-8a26-f636f4e69c9f", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a1f0978-f7c7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684667217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667217, "uuid": "bd27bf55-8ef6-4d4c-87e6-49303bd04469", "comment": "Malware payload (RedLineStealer)", "value": "66d1f397f2e853c894209deae52e7ea2", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667217, "uuid": "2795bca1-f224-4766-9a96-806c816c48d2", "comment": "Malware payload (RedLineStealer)", "value": "3d4cc02f3193bb3149af3dbd9c810ae43ead8ac6ef7d4e7cf30e62f7a68d32df", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667217, "uuid": "0512c48c-8b60-4cf6-99dc-17b32ecb3fc9", "comment": "Malware payload (RedLineStealer)", "value": "76dc74e52274e33b688f10e7768abc164452b3e0", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667217, "uuid": "def9e42a-bdbb-40fb-ab4b-0b674f94a552", "comment": "Malware payload (RedLineStealer)", "value": "be57b8bdd3d10d85de013a808d03cfa39d35ec7798283ce68812dc828ec2ff761e3b39a480a469dff4ad86709af79f25", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667217, "uuid": "706af130-6676-4dcc-8f26-40e9c073fa6d", "value": "T1F2252316A7DC8073DD702BB488F307D71A36BCA48974C7272751AE2F0D72899A17A736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667217, "uuid": "93e51d1e-4250-407a-9efe-b9c961cb0ac9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667217, "uuid": "081925ca-8c51-47e0-8cff-ead891a784c9", "value": "24576:tyUaxI0vuIJqZ6/bvebM0QYJjHSv5ETWfpB1:IVI0vuIJqvrQYJjHSuTWfpB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667217, "uuid": "568f93ac-8642-4819-967a-3dced6e8673d", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667217, "uuid": "9a32afd2-09c6-496d-b3cc-d2fcfcb47c92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667217, "uuid": "898e25b7-5ca0-4261-8561-2e9289ca0c9b", "value": "353512727.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e3c89a4-f7b2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684658017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658017, "uuid": "c64892ba-d7fb-4f62-97d7-d9d4d0fa42a7", "comment": "Malware payload (Amadey)", "value": "87516deb38c3a60921feea6f44fc332e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658017, "uuid": "679150a7-f209-4b12-958d-937e0a6b9018", "comment": "Malware payload (Amadey)", "value": "3d52dfd10b5c3772450a444dbe3f5843ec47e656c1bdf8289cbe7d72045965fb", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658017, "uuid": "07a67ff2-3c6e-4349-a23a-9f8ecec35eda", "comment": "Malware payload (Amadey)", "value": "98fa44b54b8a9528385dcea5cf7d3e573f60c975", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658017, "uuid": "30e18232-dc09-45e0-bfcb-2231b6694195", "comment": "Malware payload (Amadey)", "value": "8c418c84d92831fadf29725958b6b266cb3d90610e4e149a85d0678f08276bc02b456616dee58a3b5ca290896419b845", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658017, "uuid": "797ec423-fea5-4c68-9354-9d2832f9bdd0", "value": "T1EA252312BBE89036ECA5277A95FD0A530A387D705D38525F2286687D1C723D4FE323A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658017, "uuid": "a386c282-2bfe-430b-b08e-213c144eb33b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658017, "uuid": "08b29c16-9ba0-40cf-949b-ba7686a330fc", "value": "24576:XytjDLOjt+G/urq8pyZvNo3kuoSse4nbRpaxu:itfijb/yqPZvNo3k0in9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684658017, "uuid": "2a6960eb-e65a-4c68-8953-2b5a3dbe06dc", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684658017, "uuid": "1efc2993-4708-47aa-8ff5-68398aa34eb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658017, "uuid": "db2a03e8-1a34-46ab-8347-f0044a7c7f23", "value": "physics.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c7e57c5-f7f3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684685877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684685877, "uuid": "2f4fdc82-8933-4700-8e92-94ccc787a79e", "comment": "Malware payload (Mirai)", "value": "07faa7bcd7734d9e5999881d709520d1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684685877, "uuid": "b2e58a63-68fc-4e45-b741-e7bd800d365e", "comment": "Malware payload (Mirai)", "value": "3d9675ffee1766af9faf7f330539bca1079472dbe06430b050c19add2d16b3a3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684685877, "uuid": "bf0dfcd4-9dde-46c3-bab6-28944878e542", "comment": "Malware payload (Mirai)", "value": "d8528a7cb819e0829885a5d1d753757b2dbc5d36", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684685877, "uuid": "1a2c52ce-e069-4b48-8eea-0e7fce1b9458", "comment": "Malware payload (Mirai)", "value": "08d9a8f6aebee9861d3fbbf342cc0e9246c6425ce72890058edb9cf7a52804f2475593f81d043500ee6d952dbd49ce20", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684685877, "uuid": "6df209fa-2b0a-4599-8ae2-f161b53eff5e", "value": "T11B432B35BA760E27C0D1A8B621F74B25B6F247CE26E8860B3D710D9EFF615406507AF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684685877, "uuid": "8e8779f5-1df7-4328-9e73-43a5e2f65be2", "value": "1536:bAl0ijyaKnEov/7t3GXhnfQ+Y75ItO97Ei:clF7ZfYVx7Ei", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684685877, "uuid": "f30d60e7-5ff8-4ce4-af80-e434806a4e1e", "value": 60416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684685877, "uuid": "05ee541c-2af9-45e3-afa7-1cd20af89695", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684685877, "uuid": "76e5caab-404b-4afa-9212-cb00504db46c", "value": "07faa7bcd7734d9e5999881d709520d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06272e01-f7b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684658379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658379, "uuid": "72b50e41-56a4-4607-815a-76fcc4a81ac5", "comment": "Malware payload (RedLineStealer)", "value": "c54521a4c41ae2b3a95bd7faa8eaf4b6", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658379, "uuid": "e051b777-92df-4382-93ba-047edf7f9f97", "comment": "Malware payload (RedLineStealer)", "value": "3da66a1f2fef56ad28c8c61dee024e9cfb33251cdb1f1a50df97ffb9c2760857", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658379, "uuid": "cbd17587-8c02-423e-93be-973c1650d9c2", "comment": "Malware payload (RedLineStealer)", "value": "afe62e5e8b980ff876c271e67d5f6e9014e3376c", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658379, "uuid": "a22a4ac7-d121-4be1-8a67-a997085f7727", "comment": "Malware payload (RedLineStealer)", "value": "ee5c55a2dfc4a2ee5910a6e3a6aa3826567cff67bc5194d6ba1b007af5530c787323509cc130d135412281092fdf83a5", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658379, "uuid": "1d4315de-9460-4bde-84cf-940f66c7d634", "value": "T12F252306AFCE5133C8B03B7028FA03871E39BDE1AD74865F178549AF5D7218495B6BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658379, "uuid": "fd012680-e741-4b7c-aee1-53172fd6bd1b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658379, "uuid": "c94ea0b4-644c-47df-8120-77a7738a19da", "value": "24576:Hyhg/xuAsZ6Qp4qfy4qdPTnSEsQziEKbiPThMDu9nv+sn:S0xG6q4P4qdR6+PThMDu9G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684658379, "uuid": "8329fecc-e891-4166-8262-b6a3ea40b4ce", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684658379, "uuid": "a9f9695e-1df8-4c68-9b23-e8fb597bc9e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658379, "uuid": "560352d3-8bd4-4a56-88bd-a97d83eb938a", "value": "2482391.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8547e323-f7d0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684671047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671047, "uuid": "b7435e9b-5440-4caa-8dce-f03db2b5aaa2", "comment": "Malware payload (Amadey)", "value": "e0739b2ace2cc1b6ce0f21358697cadf", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671047, "uuid": "2db11773-77ee-4aeb-8680-d44c138a0167", "comment": "Malware payload (Amadey)", "value": "3db2e1bb2276312cee7fe218f04c1d91f100b2bb72580bf919fa32dcf154a844", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671047, "uuid": "9d69f17b-2711-4255-8ed8-1403f0072b55", "comment": "Malware payload (Amadey)", "value": "9b46691f6244cb9acba2064fc0861d54b5f4b150", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671047, "uuid": "4da1c334-ea40-4951-a071-8e6c313b5375", "comment": "Malware payload (Amadey)", "value": "7c230336ed746a0555315141eef5acca19b45d721d3baa1a8027ec126f2888c36907096d1f862e72660c51da63ef57fe", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671047, "uuid": "1aa34699-16da-4d6a-8b2f-d04f2e1a3fc8", "value": "T161252313AFE80073DC761730A8FB03D34635BCA15974D1672251996B99B3BD0A9B23BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671047, "uuid": "42406fc3-3ba8-4b50-8e7c-d41b60fef632", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671047, "uuid": "6446a201-dd7f-4bc3-b70a-3fa42d09c0c4", "value": "24576:Qy32k5u0Nhq8vBGzmkdl1ieAsyJtfEcl:X32k5u0Tq8v4/XoVsybEc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684671047, "uuid": "7c191832-fcbd-485b-8ca2-36865c694431", "value": 1045504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684671047, "uuid": "041bb761-265c-4910-8177-2178ff3a705a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671047, "uuid": "f8662b30-20fd-43a1-9e2a-e7acf58e534a", "value": "encrypt765.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed2f0061-f7c8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1684667786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667786, "uuid": "11fdf959-85ba-4740-bb64-4bed9e66babe", "comment": "Malware payload (Stop)", "value": "a5898cb5f40f220c3d0b1406788c828f", "object_relation": "md5", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667786, "uuid": "928fd521-f4aa-4ede-8d6c-4131f9ba8641", "comment": "Malware payload (Stop)", "value": "3dd9e3687e115e7920de3f3a2b9a1c6809f0f7372d0457fe6bd609444d58a98d", "object_relation": "sha256", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667786, "uuid": "ba4474fc-3cf0-403d-bb30-29f1fa66c0ce", "comment": "Malware payload (Stop)", "value": "3dae746c8ac79bf1ab6c23c81c7f3e7bdaccff99", "object_relation": "sha1", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667786, "uuid": "ba466a77-142b-4190-99ac-34bfdb73a30d", "comment": "Malware payload (Stop)", "value": "66b9985bace915f62a8daa18834775488b14009ccf634216f68c9a305c70e77edbfc8bcdbd451d131de7314a08a850dd", "object_relation": "sha3-384", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667786, "uuid": "95a2e45f-9d3a-40c9-9d16-9e7b1459bc25", "value": "T14005E002A1D1ED23D7154A728E2ED6E4369EF9618F196BD722147B2F08711E2C97F332", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667786, "uuid": "6f11ae5c-c025-4b5e-a597-724c527a0ea8", "value": "52052f823a75c3e49d6f33c06369892a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667786, "uuid": "b738e274-fd73-431a-8228-8115fd1e3f6d", "value": "12288:er5Znt39bhsLx0QhhjnrqHEo5NIjNRQfd54z2XCBTgTmHk/ye/LDu:ePnLblQ/nbKNIjNRQv9/yk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667786, "uuid": "bd147138-79df-4d6d-9783-48ba2704397b", "value": 843264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667786, "uuid": "164b4ac2-2cc2-406c-b970-89840db69e53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667786, "uuid": "183a1391-c26b-48fe-83e4-520f308a315b", "value": "extracted261.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "968e4602-f7c6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684666781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666781, "uuid": "6866dbe6-6627-4d37-be79-388d7ae0f0fc", "comment": "Malware payload (Amadey)", "value": "21c2fa70df0be2e03920357e78fef688", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666781, "uuid": "f7b5920a-ea51-49d8-bcfd-db2e0b566225", "comment": "Malware payload (Amadey)", "value": "3e4c8b0418b6b3b6243449f74ed099fa773e9f555d138583888a4a2d9d3542ab", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666781, "uuid": "543354a6-3dfd-42e9-9b75-52b31c51b4c7", "comment": "Malware payload (Amadey)", "value": "9aad1b25b1bbd8fa1fdbf2100c5102797379911f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666781, "uuid": "f4e44e25-9682-4481-a89d-ac898173e47f", "comment": "Malware payload (Amadey)", "value": "4ed59c789e4fea277db95724ff34e7c373cbb6f800db878e1af727ec74b2c0bd414efcae549a9e86737824f12dd4d5f7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666781, "uuid": "a4a4821f-0397-4c45-b742-73dba09195db", "value": "T1A2252313E5EA5071C9726FB098FB06931B363D915D3453BB3785A82B09B16C8F63236B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666781, "uuid": "94297ddf-34ee-4533-8ddc-4a4261704399", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666781, "uuid": "8e953fea-7e9c-47c3-9cbd-41a788f61556", "value": "24576:5yGlBlf1cTAd9/tN89RyGxhBtd5qRrz6a61HpQYO49qIE+:s07lKyGxP7UFugYO+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684666781, "uuid": "3d3deb11-6d16-452f-8bf8-adeab3da9ca8", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684666781, "uuid": "346383c4-11ac-43e3-9a91-7d25a5810244", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666781, "uuid": "db664131-83e5-4117-a10e-eb25459be6a3", "value": "reader716.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "590db920-f7c6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684666678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666678, "uuid": "7fa2d2e7-2a30-411e-b9d3-4a30a4fb0d74", "comment": "Malware payload (RedLineStealer)", "value": "f02859a373dd35372ad506ab3e906786", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666678, "uuid": "1ce9caee-c43f-4359-876d-13598c45515f", "comment": "Malware payload (RedLineStealer)", "value": "3f1d8a8f320fac0629f37e1ab021f17f0a433f8832ba74507172212518d7a922", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666678, "uuid": "57174bc4-aaba-4527-a4ce-a1fb25e36fda", "comment": "Malware payload (RedLineStealer)", "value": "cbca6b5d00d27eaa65a990716917b9835bc5b5c4", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666678, "uuid": "4803df88-bb7c-4ad8-bdbc-ed2a9f0651ac", "comment": "Malware payload (RedLineStealer)", "value": "a7a0b8ba510ac443930966f709f07e1cb189397dbbb281636c8ac7de2ac0f3ea74b080ee3b91c1686ea5c0923dc0b5ae", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666678, "uuid": "7b13cae5-69c1-4d61-bf61-67ffba4ed972", "value": "T10B252313A3DD4073D8A06B301CF706974B3ABEE2597C812B23D5A45E9CB36D8A975723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666678, "uuid": "a632eaee-014f-4528-99a9-d7019b36bef4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666678, "uuid": "2b6e25ae-b95c-4289-98cd-0a342773ba48", "value": "24576:8y7KG4CuLaa5ALqpH4b8RZ141ZC3LEzi1ZT+vln:rOGLuLaa5WqpYX+LbjKv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684666678, "uuid": "a2eba1e8-2f77-4ba3-b732-7ac56210f6d4", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684666678, "uuid": "6ea296c6-3a41-465c-a1cf-bb3c90735226", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666678, "uuid": "0335a420-842c-47fe-98e0-fc9ddbffae1f", "value": "multiplayer176.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d76855cc-f7c5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684666461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666461, "uuid": "e55d7034-f47f-4577-bbc9-39d412a97567", "comment": "Malware payload (RedLineStealer)", "value": "fbd0277a8112b275905e7454ad95db4f", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666461, "uuid": "b797a6e4-24bd-44bc-983e-e3b3fe45d601", "comment": "Malware payload (RedLineStealer)", "value": "3f31a7bc7a6a9c8ff9d67ac54ac146644c635d692f5e39829076ae8608ded9bf", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666461, "uuid": "7397a7fc-712a-442f-98a3-a387f8efbce1", "comment": "Malware payload (RedLineStealer)", "value": "5175cd7e9cd95a4b579a9afb43339d12a492ce58", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666461, "uuid": "6d08ecd8-fee8-40f8-9445-ec0865532b98", "comment": "Malware payload (RedLineStealer)", "value": "619a6c40d0558d7b15a8f03e159dc13c2f6a48f2b5e55f6373ad75c6eed2ab33cef778021adf960369247e1a1ab0d3da", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666461, "uuid": "099c42ab-33cf-48d0-8bd8-15e215597ae5", "value": "T1EB252303ABC85532ED9627B009F10AA70F3AFDB14D38952633189D6F2DB3351A275B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666461, "uuid": "7b0879e0-b0f4-426c-88b1-6b08d81145f1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666461, "uuid": "ce127f0d-922d-45ee-a930-8f641664b856", "value": "24576:TyOS912oUbqrN27VcJIYXgx8NokA5fDT3:m10LbqrN27VTYwqakAxDT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684666461, "uuid": "94c09143-8974-415a-bc00-4afd264de795", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684666461, "uuid": "b0aeca0d-1021-4dc0-be71-eb1ac44d4e1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666461, "uuid": "c9ae3417-07a6-4123-9c8e-1f28ec2a2cfe", "value": "Startup826.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2a706aa-f7f4-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684686559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686559, "uuid": "79448ed4-9ea4-48ba-a445-2ce4fe0c7569", "comment": "Malware payload", "value": "8fcc0d5cbdb2f4f35697115a515cde35", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686559, "uuid": "253ac45a-0821-4b32-bd93-200a45444872", "comment": "Malware payload", "value": "3f3e885f02bc29260d15bc28a7310cddf9fa0ade052d3f5d20e1edcdc3a02e7e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686559, "uuid": "05d6cdd0-e55c-4a52-8910-f1957212a781", "comment": "Malware payload", "value": "d6f9ec37b3b3e8e393e942c103d6237fa746a06c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686559, "uuid": "c4b69839-522b-4538-9671-5c20962f5da3", "comment": "Malware payload", "value": "54714f36eff750e196f3cdd90936b061604686591239e84dbfacf6c4dc5d3a3575dd75c0164ac982245d81834dc52ca8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684686559, "uuid": "8c7a0e1b-8ebe-482b-8d11-5e8f8da87e6d", "value": "T133D3C65AAB619EBBD81FCE37069A4501248DE64682D93FBFB2B0C51CE74B94F08D3D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684686559, "uuid": "b2d2f497-35c5-4ab2-8926-0c181b4769d8", "value": "1536:o2beTpNb9DERkLMurNpZ3efJp68E1wYqBvd00PUmkVmSFxBC7vXZX:o2cNJLlrvJF12vdlPUmkASFxBKvXZX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684686559, "uuid": "8f65c117-ffd3-4f57-87f5-a1a7623e62ae", "value": 134222, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684686559, "uuid": "8fb34c5e-56f0-464f-ac0c-31fe27c0561a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684686559, "uuid": "48578a48-b448-4597-af33-e5a57da7578a", "value": "8fcc0d5cbdb2f4f35697115a515cde35", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "007ab049-f808-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684694876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694876, "uuid": "ba08d16f-135c-405b-ac7d-63a00de1a63d", "comment": "Malware payload", "value": "a558f144ffbafabe6f1c2d026a9c2ce1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694876, "uuid": "0b6ecd76-5f51-4a56-96b2-42f100667f64", "comment": "Malware payload", "value": "3f5a1e22b1928c9e3ad5925cb30e1800ee5457eb9bd4c42c303802eb3de73bcb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694876, "uuid": "39905c21-8679-42f5-a1bd-bc487da5196f", "comment": "Malware payload", "value": "d9b116412c611c542c8f73708f94744008669d8e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694876, "uuid": "50a13ec2-3a29-42e7-80c7-a75ccbfcd074", "comment": "Malware payload", "value": "3f8ee1087dee0c28db19d06ce37997e1abada2cb1475bfe548ceff2c9b9cbb23bbd1180db4d9ba2ae7969bc336c5b7c6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694876, "uuid": "e646ea7b-306b-4903-9a1d-c8252ff4444f", "value": "T120252313BAD4D037E97A273110F602D31B39BD6588BAA26B2B43795E5C72E806D71733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694876, "uuid": "ed353535-eca4-4b1a-b4ba-ed6263c6bda8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694876, "uuid": "adc62518-f4ed-491a-8675-9751ef09b975", "value": "24576:fyqZ2Rr2bwFta/qk5xxeKXkT20F7y6PcLFCaZGJd:qe22ua/qKxVUTDEtZCO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684694876, "uuid": "f15819af-a0ad-4ad5-b730-a215329bd373", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684694876, "uuid": "213bf93d-437b-424e-a0c5-cb06095331aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694876, "uuid": "1cdd468c-d349-4f5b-8b49-fcd255f8c663", "value": "loader442.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ba59322-f807-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684694680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694680, "uuid": "2955885e-d9cc-403a-91b6-6303f6eddf5d", "comment": "Malware payload", "value": "7b52c89104609b0caf17b4e94d0f2703", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694680, "uuid": "396d2034-8cc7-42aa-b1aa-85cb88dda200", "comment": "Malware payload", "value": "3f8a4a1111d716395d53fadd94f4d916fba7737976f3ef5085c1d20b63548412", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694680, "uuid": "4d826b91-5ce9-4a6c-9c85-c5af43a1539d", "comment": "Malware payload", "value": "bdbbac7557b69e179cb793153788f0a056877bf5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694680, "uuid": "d5c43374-ec9e-4f87-852b-287f1c576009", "comment": "Malware payload", "value": "3b4a4886beb3bb51e69b4d00a015167960dde32f70d146f5137af27850f60c6cab8daf43fcee1ba0264eede2a7d74539", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694680, "uuid": "54c499eb-ed39-49cb-a696-3585c423217b", "value": "T1EC25231577DC45B2ECB1277468FA43930E3AB8E18C7C934B2786D65F8873680A47536B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694680, "uuid": "f04ef50e-21f0-4c37-b0bb-f78086e4e757", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694680, "uuid": "72e33b49-36a9-4828-a086-13fa13a61ea1", "value": "24576:8ydK4bKiPZO69FkKkQ0xKfVsv6xGtAogbhpjPRVECo62HX:rUiP+d0fZbDjPP0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684694680, "uuid": "93d7211f-c7a0-4f5f-8f11-0d5e97b6176e", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684694680, "uuid": "db04532f-47e2-4d73-bd6e-2d10d4d789cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694680, "uuid": "374129da-2b3c-4e2f-905d-18244673dd3f", "value": "248990s582.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43a4d90c-f808-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684694989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694989, "uuid": "1a71128b-3ccc-499b-8045-5cbacf489409", "comment": "Malware payload", "value": "bda511c68ebdba7b4ea3353dca78497d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694989, "uuid": "175f468d-df73-4212-8850-bc1a82583636", "comment": "Malware payload", "value": "3fb55256aecac56aa426a618839fd29ba8b05c467e8504e4156a8844716213d7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694989, "uuid": "c34ab6d5-95ec-44dc-b16e-5b04dbc2fe34", "comment": "Malware payload", "value": "c336d0b292e081ba0d4d9fc14bef9563952b9f66", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694989, "uuid": "39d360d6-5a14-40e3-aea1-ca1300811849", "comment": "Malware payload", "value": "5b622d09124ee2c4b33edf56ae7d2bfb38c153b93d048037cf79b4ceb672ac15bbd02706cb74e4e648540227a57a1e12", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694989, "uuid": "a2401292-473f-44f8-86dd-8ad1dd3b85b6", "value": "T160252383ABD96133D470237055F307D30A3EBE631D2997BB2715E8660CB2A849574BBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694989, "uuid": "d8ceeeff-38c6-4528-bb6a-82b668969058", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694989, "uuid": "e41f9425-a345-4489-bbcc-cc9d872dfe56", "value": "24576:Xydkvf9SkvLqMO7PSRhdHx8WuaVlSUfByI1:idqpLqM4PqR8W7VlRs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684694989, "uuid": "80e9ffe1-5a10-4d7b-a7ce-6d8f3bac56af", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684694989, "uuid": "ac3dc3c4-f378-4031-942b-639add4af6e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694989, "uuid": "443f43af-89ef-49f6-8a34-a00dee23247f", "value": "viewer899.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66d9b7ef-f808-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stealc)", "timestamp": 1684695048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695048, "uuid": "c48ffb2b-e125-45a1-b1f9-9b52bbe2ac0f", "comment": "Malware payload (Stealc)", "value": "58f61436dd0f2338cd757cf21ee4acf4", "object_relation": "md5", "Tag": [ { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695048, "uuid": "c93abb7a-30ea-4ff6-aaca-0b94103d3b5b", "comment": "Malware payload (Stealc)", "value": "3fca9d61e9b2314922039aff60baada436365731961bad0852fb67301b305ee3", "object_relation": "sha256", "Tag": [ { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695048, "uuid": "5da3d138-f24e-4f92-9934-54ce8c7ff8b0", "comment": "Malware payload (Stealc)", "value": "0e4cdf9bb33e9a2770c0fd556e8e2618af45c9bf", "object_relation": "sha1", "Tag": [ { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695048, "uuid": "8f2f4711-3181-4a03-b308-0065136c0469", "comment": "Malware payload (Stealc)", "value": "027a37d36f87320601920afabb0a3c7a25b1176afd6b0dd49a6d10ea2cedcee0069b97b28e94742d44cf3cbb0a0f5ffa", "object_relation": "sha3-384", "Tag": [ { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695048, "uuid": "1c4f72a3-447d-4a94-836c-2b62639821ca", "value": "T179647D13A2D1BC62E72646728D2EC2F8761EF561AF0927D72A186F2B14701F6C673F41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695048, "uuid": "f6a929b1-059d-45c5-83c1-3a4e3fd01051", "value": "ad1da3007d39bc21ababd35f90247ee4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695048, "uuid": "e0e7ba9a-6566-4fe5-9f24-2429be0deba3", "value": "3072:R08rcq+SFVOMq2b+qyjnadHZH7JwqywEYs6zxsk1EZfOqHrTyFI:rrcqXCMq2VyrkVrywEYjFbqHrT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684695048, "uuid": "fe4e2461-12a0-4a8e-9369-82479a0913e3", "value": 312320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684695048, "uuid": "1e9db843-78da-4da8-bcf9-12471a8a82eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695048, "uuid": "14c196b0-2cf1-42d5-8f2a-d8db669169c8", "value": "274722510.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57c6e573-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684680420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680420, "uuid": "9e3e8f7f-8541-4505-9a89-0c2f84c91a99", "comment": "Malware payload (RedLineStealer)", "value": "c89ef21f6ae0cd85bab6c28dcdba26c3", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680420, "uuid": "45a81c52-78e8-44e8-b3ac-a282d14ec7cd", "comment": "Malware payload (RedLineStealer)", "value": "3fd0a9c6cde9ce4859865971bcb501ce0dc0f0ba24b28b9ccf4f9a1c2275b683", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680420, "uuid": "a15db45c-1495-4243-ab50-e250b18cbdd4", "comment": "Malware payload (RedLineStealer)", "value": "69ca4bcd812f18274f7109d1aca86440dc40dfcf", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680420, "uuid": "c2240881-a3e2-4e8f-8909-13c7c3ab273b", "comment": "Malware payload (RedLineStealer)", "value": "84fbedaea2ea2182ef33d27b7eabda7fcbb3cb5e73dad71a19a1ba8fd5e84332073a8755977c4f095b5af1ff8404fc5d", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680420, "uuid": "fdc1631f-c5d5-404b-9e57-9801380b9998", "value": "T19FE3D624279F8930D6BB4E3D6CB19CC076BCEC12A542D74A4ECCF5593A73B809B116B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680420, "uuid": "9828ca93-22d7-4590-bec4-8ce1195bdd23", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680420, "uuid": "1a7d1472-af39-43fb-9c66-4484917edb9e", "value": "3072:2V+m5cNQmRSxWWAcP+DDXedh7Z58e8hk:2jwCUudh7z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680420, "uuid": "2ba26552-eae0-4938-ae20-917b73d8449b", "value": 148730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680420, "uuid": "1003557f-15fb-40cf-ada7-a39fe8696f82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680420, "uuid": "cad10d29-746b-4b47-a91d-8c65b6b085e2", "value": "234433512747.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc6c1108-f7c5-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684666469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666469, "uuid": "019abcfe-7173-49b6-91ae-15be8edab1fd", "comment": "Malware payload", "value": "7153bf14e6e6962ca774ce1dd2f0ec46", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666469, "uuid": "52579cef-5110-4e64-83cf-e01d113fdd58", "comment": "Malware payload", "value": "401a46dc073335a58439905283747df3cf5363c3d8294d8838ce2989f987676c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666469, "uuid": "7c146497-2bef-441d-9e57-2aac30c3085f", "comment": "Malware payload", "value": "3f876acf5a334e69ad5638fe32a619e8d0830a0a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666469, "uuid": "c22b0a47-2e13-4e15-8a67-50b8b1bbb307", "comment": "Malware payload", "value": "7771372654942b11bc801569308e11c8c712c24fa582792cd7596aa3254abd8462d2678d0e40f5eb18f19188e1be6e70", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666469, "uuid": "6aa68a8c-1e3a-49fe-8689-61ae0b91e0fa", "value": "T1F603D15DF8441CADCD9DAD38D2EC36B94594E0C332C7BB4C82549D49E68DA8EBC9A0D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666469, "uuid": "2bba9d40-ecab-49ad-8d54-ce9c92c72945", "value": "768:ktiNiNdNpdTqRqRNgI3INoJkG6/ikkM2XT2/gp/UlGqtnJ76mMgIFAxhwXWMv:HNiNdNH3dqC3PM2jKm/VqT76TgIWxw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684666469, "uuid": "e69b7d68-ad7f-4e70-9c0a-a4bdde91e58b", "value": 38496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684666469, "uuid": "4921c03b-0eb4-4208-af1c-adc8636ed995", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666469, "uuid": "61ab293d-6452-4535-a65e-d66885146164", "value": "7153bf14e6e6962ca774ce1dd2f0ec46", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "184e6b2f-f7b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684658409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658409, "uuid": "7d2af730-1051-4f29-bdde-66aa2ba26770", "comment": "Malware payload (RedLineStealer)", "value": "b98c016dfbfeb9f865aa7773c2a1b2ca", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658409, "uuid": "4cabd575-78f1-44cd-a192-bfdc02bc7035", "comment": "Malware payload (RedLineStealer)", "value": "402cf4559218dc073008995343dade684f35eaa3c9d46048120f6381d8f8117d", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658409, "uuid": "b9495d40-0492-4a02-ab46-3e75d8d2be1d", "comment": "Malware payload (RedLineStealer)", "value": "1dca3c8cb7185f08872a5ff003e85502f617aaaf", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658409, "uuid": "efa6fa22-f796-4641-b7e1-1a5891700fa8", "comment": "Malware payload (RedLineStealer)", "value": "e1b1a345ce08ee17d2088105b7a8139c5fe26cfca6d5392b08e7dcd59ef8d97efa1ead66f01a771112b870df46894e4c", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658409, "uuid": "167b9bf9-198e-48de-8406-106c9e65a5d8", "value": "T16025230176DC4562ED673B701DF212572B75BDA0AE389A2B3611EE4A1C336C4A8373B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658409, "uuid": "3b931ea4-b9a6-472f-ad4f-22aa0e1a208f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658409, "uuid": "6a520e10-9ace-4f54-afd7-842ab0c75b6b", "value": "24576:pyGQ9WX5i4pG6XCQ8qhd022JIR759j2IpFsguo:cHcdG6X+qhd02mk5lT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684658409, "uuid": "af52f319-fdcc-46c4-adaa-4d011bcfb9b8", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684658409, "uuid": "42551842-8b90-4c7d-b36d-f1f1ffbd694a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658409, "uuid": "1ad322f1-88c0-4ce4-a4dd-2e3c6eccb6c0", "value": "Temp867.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd47ecd7-f7d0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684671249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671249, "uuid": "5ca1165f-7cc5-4ad8-8191-9842dd3a6777", "comment": "Malware payload (RedLineStealer)", "value": "f7624d7ec14018c7e137ab8391625042", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671249, "uuid": "ba29d38e-fcb8-4f47-8663-f2a028a47bae", "comment": "Malware payload (RedLineStealer)", "value": "402f93193d81dbb43e47829c3a217302fef13b2cd8e70eacb4b3d4f334da5c9d", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671249, "uuid": "e6cc68b6-bc1b-486e-b0cc-a5aa4a4a0477", "comment": "Malware payload (RedLineStealer)", "value": "e4f5bc83b45dff097f8fd668bf620ae455d3de11", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671249, "uuid": "cb0c0908-9d0b-4509-9d8d-bafe01be16b9", "comment": "Malware payload (RedLineStealer)", "value": "100707b2d701f777689fa220feb98c581f8f6e979662158c0e3c75b1fccac7d6a1a9071ea58799457efa071101a1b09d", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671249, "uuid": "aa1cc6a8-7eea-4719-9dd2-1f4bc4c9a5f7", "value": "T19A25230AA9E80A27DFB517709CFB024B0E317CB21970966B7784585A0DB3B98E53177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671249, "uuid": "694db6d6-9979-4ed4-8a58-93f992e83e7c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671249, "uuid": "04ff78e2-2cc4-4048-963d-b5206720272b", "value": "24576:ly2HMHauSRgOeBV3fmgHHiVrBoxYx39yJT9h:A2sHdNOen3fmNLo839S9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684671249, "uuid": "3ed58b8a-71aa-4940-91e3-f203893a2340", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684671249, "uuid": "1fae77b6-279f-48b5-be58-09e5836414cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671249, "uuid": "02b77808-3c75-4c46-b2a6-cdf09f621254", "value": "publisher480.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d4b5c4e-f7f4-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684686550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686550, "uuid": "f70da4fb-187e-42a7-922a-28eb79c090ef", "comment": "Malware payload", "value": "d5ac0d4c7e6de9c2914d70656b907337", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686550, "uuid": "38726fd6-28b9-4056-8b95-823afcc21a0a", "comment": "Malware payload", "value": "4063aee2d5d5c6ff1fa6e529675a9a7af1cb02390a9dbf903973c8c0f3070cf0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686550, "uuid": "d8921656-6a32-4be5-be0a-152fd0903927", "comment": "Malware payload", "value": "65480d965af65cd152bd5243000aa300d748e79e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686550, "uuid": "a918c847-dd2b-4f85-910c-3e44262f0936", "comment": "Malware payload", "value": "f6eca6fc4157ca5fc7a8b515c15e909cf3fb509237b51ce97c44aa6842c28ac398168793453ba700ef1fc216dcab6a05", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684686550, "uuid": "2fb277e8-6f15-486d-803d-de0a7a24b134", "value": "T170D3956EFA12EBBEE16C863107F76F70D39531A22AA1D341E12CDA181E7125C2D4F760", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684686550, "uuid": "e18cea6d-691f-4b76-841b-544f0e8cd582", "value": "3072:jGTyrDxJWwAfr9f3yJddxUEJmTDmjOrWcpu3NJFARtRVJhGvaZqhZYiDhB/ZZ9Bq:C+nZSZwnJeUmkASFxBKvXZX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684686550, "uuid": "99097255-1c5c-45ad-86d2-02f1e5f99fde", "value": 134222, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684686550, "uuid": "64e3a86d-e1b8-473e-b60e-1da1f1151abe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684686550, "uuid": "1e6b816e-4c1a-4625-9b7a-8d7b306c3308", "value": "d5ac0d4c7e6de9c2914d70656b907337", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37f919f7-f7ff-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684691104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684691104, "uuid": "8eef286e-e443-4b68-b172-b3d3bd0d11f1", "comment": "Malware payload (RedLineStealer)", "value": "7f76c2660cf705eddc10e062cb95ce54", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684691104, "uuid": "3c994727-c915-43a6-af5e-912cc71117f1", "comment": "Malware payload (RedLineStealer)", "value": "40bdde551c167389157dbf25a9a0f2d5ab727e181abb95875d16bed538eda157", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684691104, "uuid": "0403b62d-eed5-4c75-8a39-b4dcdba18570", "comment": "Malware payload (RedLineStealer)", "value": "51fad4658266795ae70fc3ff35f5b7a876eeb172", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684691104, "uuid": "7bfd46a1-179c-4fde-9889-b70937b95d09", "comment": "Malware payload (RedLineStealer)", "value": "7d27a5cb032295ac62e347d648425a059d5d86579136acd4bd5a5ebb7511cd3e03d267606cd74bfb8c3fedfa235cbe87", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684691104, "uuid": "2cad2ef9-1c26-445b-93b0-3ba50a415437", "value": "T1CF252303E7E86122F9726B7414FB13DB1E397CB25E389B1B2694651E09B26C47C3532E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684691104, "uuid": "a6f68e3b-383e-4b46-b4e2-c700c5f958ed", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684691104, "uuid": "69a6f459-5c3a-40be-ba76-023c2bcda08e", "value": "24576:gyjFZQxPgwOhfxp9b/9ylbgfh8myNS4bPEMU6hR:n/dwGp9hyRgfh8zHh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684691104, "uuid": "81bc6ca7-07f8-4e72-b537-72f7106b79a1", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684691104, "uuid": "72d6513f-896c-407c-83b9-0751586dfa58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684691104, "uuid": "8b3356e3-317b-4191-81fa-99bcc4437a5c", "value": "21324575.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe3a3574-f7d0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684671250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671250, "uuid": "1bd1698d-b20f-4e39-9a7c-873cbfee7d02", "comment": "Malware payload (Amadey)", "value": "9076dd1f01eb2a112a8ad912a1cd7b77", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671250, "uuid": "ce966188-dfe3-442b-b4f4-8f17d21c9572", "comment": "Malware payload (Amadey)", "value": "40c6cd4b3f2167674931131a9ea660c85f80056acc568356f7af3fc7719628e6", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671250, "uuid": "cd738bd3-1699-4ea6-97e0-ec28639c00f6", "comment": "Malware payload (Amadey)", "value": "bf3c862f527d1612f215790129823b174faa5f6c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671250, "uuid": "9c150345-bf07-49c9-94a6-dae7ccc99063", "comment": "Malware payload (Amadey)", "value": "b0fc3d2b1397e0538ec4d4ceaccd59fb23151c4aec072da05bd430f8a1ed3f38df1d781bd87f117259a864181f5775da", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671250, "uuid": "5553bd1d-9bb6-455e-9a39-4e6ddd46f529", "value": "T184252307A3F90079EDF81BF448FA42D71B75BC619A7DA35A3689590708B2181F8353BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671250, "uuid": "d9f0d8fa-f115-4e5d-b32f-a3b0650c7824", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671250, "uuid": "4f72bf72-71ca-4d37-a75c-7181166caa14", "value": "24576:ZyP//GEOpq/v2CE1oZ+ExO76e5+4wchzaYMD3NXkky6j6Vu4tQRV:MPXssd+EQn5+4wbxXkQEQR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684671250, "uuid": "75003a65-a6b4-4465-815b-47f33da56cd0", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684671250, "uuid": "4a5a4927-9f0e-4e22-bd47-62285a0f6c3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671250, "uuid": "eb31a5a1-282c-41b8-a25b-873508c8af7c", "value": "readme855.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06140c72-f809-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684695315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695315, "uuid": "d6f911e5-ef0e-4fb9-9680-f9bca6200c8d", "comment": "Malware payload (Amadey)", "value": "d8e168b66c36dd134c5a50ae8fea3df1", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695315, "uuid": "c6cbfa40-01de-4faf-ad17-c89585932152", "comment": "Malware payload (Amadey)", "value": "4143d88e3e703dca1adfa8aad4a0e2c7cdfa4e0865095c18b1e57a2d9be68457", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695315, "uuid": "0e72f68e-cf9f-4f36-8667-186a2edcee90", "comment": "Malware payload (Amadey)", "value": "272b062a47d4d088316d453b09935235f7a79300", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695315, "uuid": "9ad957aa-1667-489a-b52c-f00c6146305c", "comment": "Malware payload (Amadey)", "value": "f152fbd52405d0110c5403bba9ea5262818ef000ffea6171906de71ef9551bd05f811430a073f4a31bbfcfdd6ab3300c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695315, "uuid": "782c7231-bafb-4328-9be7-071e59154770", "value": "T1BD252302FBD44423DDB513715CFB46830E36BC724AB8835F2A452AAD5E71AD8A437B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695315, "uuid": "31ac6e43-37fb-4e90-88ff-c9eef0062434", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695315, "uuid": "77b9ddf1-5217-4613-8c1a-cfa01c2dbf70", "value": "24576:Ryr+iL0X52RqDAKYDqL2Pps81OfN/a5tHC/fqNMXE4D4O:EFvqDAxDqLFLF/aTHZMXq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684695315, "uuid": "c9b166ca-266a-480b-8338-7f8aa15fea6f", "value": 1054208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684695315, "uuid": "3dc8ddce-fbde-4f2d-b54e-35e6c807dae9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695315, "uuid": "b9231192-6508-4a0a-b01e-077ce2972830", "value": "listener373.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "207c6abb-f7b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684658423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658423, "uuid": "c4ca11a6-ff4d-49bd-9749-4a6cb83ce9ea", "comment": "Malware payload (Amadey)", "value": "dfe5c3ddf78dab0443e22ce35420c579", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658423, "uuid": "2dd14247-10dd-4958-bed2-fb0796270a33", "comment": "Malware payload (Amadey)", "value": "41639b592631c69f9da9ce5550a94705c3d9ac8579877ff8e26e67219723d04e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658423, "uuid": "3e85537e-b0f2-4d1c-bf95-76ef058ae62a", "comment": "Malware payload (Amadey)", "value": "558bafac3aba70571643782f0c5ea7bf58fc591a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658423, "uuid": "36d1e336-0d6c-4fc6-9e50-d42d3000b5a4", "comment": "Malware payload (Amadey)", "value": "d35ffbc8390de02f8c7881916193e3f4c7a018be0d69f80b24808a44e29b00d9215121875bf416f92671d283d22b26b0", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658423, "uuid": "f1aeb038-0fab-4e22-915a-fbea8fc65427", "value": "T11C252303BFD0507AE8742BB4DCF642474B32BDB0AEA593262345DD560E33A91AD3536B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658423, "uuid": "c3f0a4cd-1d99-4569-a19c-45b5f0d15e0b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658423, "uuid": "6466f54a-094d-45c1-bab1-65f8a6e737dc", "value": "24576:nyPGTjopgQqHLdwq3LCAMh0yQ+rQS7OBAmdY2G5TL:yPGTspoHLdwquCDS7CA77l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684658423, "uuid": "4239ac1d-653e-4286-adca-34381b09cd8b", "value": 1046528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684658423, "uuid": "d9ea63d4-8f14-4464-9a01-863a9498b284", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658423, "uuid": "cd62671e-3585-49d4-9d8b-82aec133703e", "value": "compress891.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ee533db-f802-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684692565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684692565, "uuid": "5fa82e1e-1ba6-426b-b483-7d298d2dcbe8", "comment": "Malware payload (RedLineStealer)", "value": "98f8bbc69e4c578a8e579a8f5ab816d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684692565, "uuid": "c17e427a-ce7b-4827-a931-cdf2ecca6f64", "comment": "Malware payload (RedLineStealer)", "value": "417ad2285573d0ad66e471aec4b7ce6647ffdaba578946f9b5125d16898c81b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684692565, "uuid": "d2bbd5fa-82d4-44da-bbd4-6e60d0549b8b", "comment": "Malware payload (RedLineStealer)", "value": "1f5168ee955bff9addf51069afdb7386bff797c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684692565, "uuid": "1519b507-7398-48c2-b616-f34ce83208b5", "comment": "Malware payload (RedLineStealer)", "value": "e160cc0f95a42314847a79f14f56560c6ee1704ae0a78bfb1628fa6d4f43483d666830d2cfe6ea7da9616fc2f9f27215", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684692565, "uuid": "291d3704-0b9d-4bcf-8e12-e42b066d0970", "value": "T105252303ABD89173D9B10B7060F627C3173EFF558DB4926B5F8A998A0DB2681D930763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684692565, "uuid": "54f0c6bb-7c86-4a47-bbb6-68ef0c2f7fab", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684692565, "uuid": "86caf276-47d8-4bd9-b373-b403158f635f", "value": "24576:nyH67vpFXwPs4D+84qSRYuqrHpjld1Pijo1s:yUpFl4y84qqYTHpjlvijo1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684692565, "uuid": "e37e6729-282d-4744-8678-ccdbafeda743", "value": 1046016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684692565, "uuid": "3c24910e-520e-4315-b0ef-63259ef66db6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684692565, "uuid": "0ab4ffa2-a15c-4fa3-a095-aeac3aab1fea", "value": "98f8bbc69e4c578a8e579a8f5ab816d9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b557f5b5-f7ec-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684683154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683154, "uuid": "01978a94-7c72-413e-9a7b-0a1243ad9b17", "comment": "Malware payload", "value": "27961ac82caa6101913c910c599ea7c6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683154, "uuid": "99f26f8e-8d66-40db-8833-e67289cccfe4", "comment": "Malware payload", "value": "418673832767856fdcdff7f126a9402e3399c0a9a64924aca2e81fc3cf8a591e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683154, "uuid": "43965800-77b1-4db7-98dc-17f2ee469489", "comment": "Malware payload", "value": "cf7fd000295df6b6233ec2fe2f163069cada3539", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683154, "uuid": "10da5545-5588-4b31-a6cf-fe975c0dd672", "comment": "Malware payload", "value": "10b5d5c20a53564a952ba87ff747652e5753eca207450a7ac3121d0a8601bce872010577832db4a69d6ad3e9a32d833a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684683154, "uuid": "d34b03b0-1bcc-468a-9008-f382a1601d96", "value": "T13AC37D61E8FA36D8C818C036156B96F88F138D14A1931EF5C6C63BA9445FBF4394E7E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684683154, "uuid": "ba7748ca-73d0-4042-b6bb-bf1ebba1d37f", "value": "1536:U/vUEgazeukl/lQqopYpn82UMgG6BPC/CQDHNZA+K6hs5DoajS9:UXUfxumiqoyp82gG6BP6A+JyDg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684683154, "uuid": "e9b56479-9ecc-4814-96da-fa3759e987a0", "value": 127992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684683154, "uuid": "8a19ff4d-d575-4cec-b8fd-631329385fe0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684683154, "uuid": "6bbdca0f-d6bf-416c-8b53-f484baac580b", "value": "27961ac82caa6101913c910c599ea7c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4e0c72d-f7c7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684667289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667289, "uuid": "88e1f455-3027-4872-97be-755c9217f501", "comment": "Malware payload (RedLineStealer)", "value": "daaee353013133c387e8a58433b6744f", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667289, "uuid": "dcb338c4-ba38-40ea-a140-0ad0b50bbd84", "comment": "Malware payload (RedLineStealer)", "value": "419ffbf50aa02337038120cecbc62c42c22272f2c9670a450e92c7956c3783c5", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667289, "uuid": "19e6849a-3e0e-43c1-88e2-3d1a32124416", "comment": "Malware payload (RedLineStealer)", "value": "f7b86ad7e3f4db38400697fe97e134c8d0610b05", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667289, "uuid": "bd3d1506-ddab-4e41-b32e-3e794963b321", "comment": "Malware payload (RedLineStealer)", "value": "dcf95897c5d80817551e92e3478542c50bcd01a58ec36e618c69d0e9c5b2dfadd5bd2f110cc87a88e8ce159c00b319b7", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667289, "uuid": "b00c8544-f225-4e1a-ab78-d00fc149ebd3", "value": "T1FE252343F3FC5472E4A47BB0DCE813A70B35BDA2A83192465785AC5A1CB16C8E171B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667289, "uuid": "47591cff-bf0a-4a80-b871-5b3e9b80afd9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667289, "uuid": "2bb8d92a-41ee-47a0-9540-2dc2c49f357b", "value": "24576:iy0HQWvyIafqHIda+LnoK10v8yBrS9PEVmLQ7aK:JEQ0yZq4a+bKv8yRKcVmLQ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667289, "uuid": "e8d3dd1c-aff7-4f6c-9f27-c65f8fb5e695", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667289, "uuid": "6c1fbce1-4cb2-49a6-956b-0799c060834a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667289, "uuid": "6602e174-7164-46f2-97d3-13b77952278c", "value": "config954.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5e0b272-f7c4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684666029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666029, "uuid": "7c8f2ced-f643-4782-ad1b-3637a2f737f6", "comment": "Malware payload (Mirai)", "value": "b9d0b5bce21e245fcd15170201dbf1d8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666029, "uuid": "9ea06871-a076-4d46-943a-0804041edb3f", "comment": "Malware payload (Mirai)", "value": "41cb3f9ba243c0ddaa6efb1ac7a22d47bef26c37cfaeb9352d0e5b1e1539c6f3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666029, "uuid": "3a371cac-3550-4fb8-9948-401715f1362a", "comment": "Malware payload (Mirai)", "value": "02c9b3b4bb9799c46c2be22c9df36c57bb59517d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666029, "uuid": "f1ec00e0-0513-40f6-90ec-306f53801e01", "comment": "Malware payload (Mirai)", "value": "3f91735cf710f9621cf7cb18e762e75ee2f8d54901a2daf6a17cd08a5edc95dd6fb2d888ad8247b74f5a6df21c1f0687", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666029, "uuid": "051c7223-ae1f-4e4a-b33a-f842192418e2", "value": "T1DBF2F2918569F523C460613F893B4A07E34867CCD0D5F4E61B071AA9F9C329B9CBC8EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666029, "uuid": "28a61ad7-a6c0-4d08-a1c3-bd555ecc5f33", "value": "768:q8AfPa0bejYLOGfFmqbhHREFgFm3BkGF+GjnrT9KAGxy3U9:q8XEejQOMMqFHRjQR/FrjnXrG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684666029, "uuid": "ce0fb0c4-5e0e-44ab-9c31-0d015619a538", "value": 34580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684666029, "uuid": "b01488ed-c475-4f7d-abda-6c4059de5923", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666029, "uuid": "27e639f1-4fe6-4729-85c9-61b1d576aa40", "value": "b9d0b5bce21e245fcd15170201dbf1d8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3e287f3-f815-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684700868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684700868, "uuid": "fd6d36b6-4e07-4ae9-ac93-64f4d35a605b", "comment": "Malware payload (AgentTesla)", "value": "67600a2cf6e129d8883d76799561df02", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684700868, "uuid": "334f728d-39f9-450c-afec-4276dc9bbfa6", "comment": "Malware payload (AgentTesla)", "value": "4201e877ac2b8a647439434da82534b0ca5fbf7b6b47c127467e08ede45ce3e4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684700868, "uuid": "4b154738-780a-41dc-ac29-45f861af5406", "comment": "Malware payload (AgentTesla)", "value": "1fff55f246723c258e03fc2c71e382dbac1ac7c3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684700868, "uuid": "302d0b08-2fe1-45fe-89cd-2c03ff1996dc", "comment": "Malware payload (AgentTesla)", "value": "12caf7d6a77d53782fc66564ffb8b9d9f4f19327061e2c60744bf14a0e151e05ace4feaba8c841199ec22732a2da27cb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684700868, "uuid": "6475455b-39ea-438f-a8ba-b7c5216d6b09", "value": "T177359D983650789EC557CE768AA5EC34A7302C62D30BD24750E31DEBBD4DA97AF012E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684700868, "uuid": "fefd6a60-eccb-4bc4-a85d-61862995528f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684700868, "uuid": "0cd8e4fd-6307-4422-982f-80e935825a00", "value": "24576:O6GvclP07gBzekCfSbzUSy9VnNiPxhX49dXsMu:LGiP08Bzekty9VNqxhXAFA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684700868, "uuid": "7eff175e-6041-497b-a56b-aaa3b5d5bb51", "value": 1121280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684700868, "uuid": "ddd8083a-230f-4800-b4fe-b944dbcfb787", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684700868, "uuid": "b389a1f7-55c1-4857-8355-80570d99bbda", "value": "67600a2cf6e129d8883d76799561df02", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39528884-f7b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684658465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658465, "uuid": "f9b36bf1-82e5-4a03-ac47-1edf9ef0946e", "comment": "Malware payload (RedLineStealer)", "value": "6f300ab36948535cb3662364641e4910", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658465, "uuid": "0b9cab8c-c73a-40fb-b2d4-e62c1222df4d", "comment": "Malware payload (RedLineStealer)", "value": "4299d56044136c613d2ec8e14fe6073a16bf380399b81c7d738c253904719538", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658465, "uuid": "96647c29-6240-4dd4-b1e1-04afb820cd1d", "comment": "Malware payload (RedLineStealer)", "value": "500b42f177d4b0f0589e8d962fa9335d01dda8ba", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658465, "uuid": "c58c83a2-4915-4fb7-bd20-dd9a45dc888f", "comment": "Malware payload (RedLineStealer)", "value": "7cba03ea6c5f018a24cd2b40c140f6ac365e8fded32211e1912e752ea67cc6c951fa68d944b260b7ce714f89627f4c80", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658465, "uuid": "32946504-c506-4b0f-816d-26587136ed09", "value": "T114E3F824279F8934D6BB4E3DACB15CD076BCAC126952D7464ECCF0593A73B80EB116B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658465, "uuid": "4d5265cb-5dba-4eac-b73e-e7c1a1943c2d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658465, "uuid": "e545b510-f371-4530-bf9d-5c147910fe0f", "value": "3072:vV+m5cVQmRSx9WCEkEhPW67V8BjVhtZN8e8ht:vj4oihwlVht3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684658465, "uuid": "c9fc298a-61a8-4b6c-9175-28b9ddba4fe8", "value": 148605, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684658465, "uuid": "d8ce1ea5-9413-40a3-a538-d44b80e901f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658465, "uuid": "9b324d11-568b-44f7-bc23-28b5c5b31b34", "value": "noname901.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7793c63-f7d0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684671239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671239, "uuid": "bbdd9c62-3170-4e91-accd-664c0319737a", "comment": "Malware payload (RedLineStealer)", "value": "0259f6834235395c0ad1ba77da75f12b", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671239, "uuid": "92733e62-eabb-483a-8979-b3923798d914", "comment": "Malware payload (RedLineStealer)", "value": "42c8ce26b80bd88383876299e54714ea36bc1247537bfbd19fc44d031bc40924", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671239, "uuid": "daa0134d-f38b-44f2-bb94-0325d722fb1b", "comment": "Malware payload (RedLineStealer)", "value": "7bb1c1aa9881200bac4bac9c46582537e92a2dfb", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671239, "uuid": "e0c860bb-68de-4ddf-8dd7-21268120c1fc", "comment": "Malware payload (RedLineStealer)", "value": "8e8f1b2022bd3081a808bd8e07bb2897f5c8bbfe386d9e361ea472b9231baf9d87450f97734d72384b21fff08cf168ff", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671239, "uuid": "c18c872d-73fa-4e5b-90f3-ba04d4bc89d2", "value": "T19E252327B7E98031DD752B305CF313E31B3ABCE18E30963B326969660D766849531B7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671239, "uuid": "80d0503b-9454-41c1-9cf9-20ac4fa644a1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671239, "uuid": "1e518690-909b-4b88-9ea2-dcda8e7076f5", "value": "24576:yyh9uvWLrAqJ/9mfO5sKWA335/6FuJhwzaKd/lm19p+e:Zh9uvMrAq9+fcXwz1m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684671239, "uuid": "c8d1093c-ec29-4e25-b8a6-4797afea78bc", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684671239, "uuid": "92e4b2c1-c56e-4b33-a9a1-e9281171d846", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671239, "uuid": "4898e3e5-5111-4e17-966c-5be73260c3da", "value": "installer689.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0488dd62-f809-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684695313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695313, "uuid": "184db863-eaf5-420d-bb6f-c0eeae89c0a9", "comment": "Malware payload (RedLineStealer)", "value": "b19cc5e58dde0b6fa36b72eaa41f9961", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695313, "uuid": "6dd37435-104c-48ed-9473-00275d08f810", "comment": "Malware payload (RedLineStealer)", "value": "42f4bc8fa3dccf707d9dfdf1afd553420097e21659c9d09ad718a235c8d02cc2", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695313, "uuid": "a1d5c0a9-ff23-4bc9-9a24-96368127f3a6", "comment": "Malware payload (RedLineStealer)", "value": "cafdd03ed110c9ed57d53339c2a0147219dd7651", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695313, "uuid": "5ada2a61-b538-47cb-bdfd-54eb74d794ea", "comment": "Malware payload (RedLineStealer)", "value": "0eaf994cd842e9f8dbb103880358baba279a4196146fa205b98d928a4c0dbb17528214ad7d300b9e679e883f072915a2", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695313, "uuid": "8fe689a6-6809-4cf0-9dff-49db9402666b", "value": "T184E3D624279F8930D6BB4E3D6CB19CC076BCEC12A542D74A4ECCF5593A73B809B116B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695313, "uuid": "3c93cd7d-caf8-4221-af6f-e0929ab08fae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695313, "uuid": "cdc3796a-646e-4066-8f69-2fa041c4bcda", "value": "3072:2V+m5cNQmRSxWWAcP+DDXedh7Z58e8hk:2jwCUudh7z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684695313, "uuid": "23b5927d-90b3-48bb-901f-8cbe6d70171f", "value": 148806, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684695313, "uuid": "eb7a8b2d-b9f9-4d3b-b7f4-52fb3f9362ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695313, "uuid": "37dfe16a-1b57-4453-84ea-f79da0b14d21", "value": "launcher459.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94b3dc60-f7f4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684686535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686535, "uuid": "c6a9619f-04f2-4609-8f86-52a20345bc11", "comment": "Malware payload (Mirai)", "value": "3275ef0ec6a0ff8dd72affe7c48143a5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686535, "uuid": "b9c9d12c-b341-4218-a2bd-ac9051791d16", "comment": "Malware payload (Mirai)", "value": "43041f85b1b4e3eeecab30b0b43463600c6a1f2133ac3bb59f0140ce4dfa40b6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686535, "uuid": "52e4e0ef-0628-462f-8aac-b605c38fbcfe", "comment": "Malware payload (Mirai)", "value": "8d2ffd492dc4fae55e6b569ead29b9ffa8858406", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686535, "uuid": "b7811152-0330-4016-8775-b2de2c47670e", "comment": "Malware payload (Mirai)", "value": "fcc8f8c71b038c6b869a4ce2043bda4a1aeda693d6880f14f6563a06f7ad8157e5738db856a98fae08259af6c4373169", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684686535, "uuid": "8ed73bda-1d38-4209-8d92-20ba9addb438", "value": "T12D73A61ABE228FADF759823147B74E21AB5823C637E1D685E25CD5002F6134E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684686535, "uuid": "c907fdde-1092-4d7f-a092-779bd1e75aea", "value": "768:/BXuHnOYFLWm1QwmCP/+P/8VETNx5uDCtOob77SjFd6oREa76cmKhQaaykRpeDja:M1LWm2w2J81Fd3EDiZKeHKrxmDG/7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684686535, "uuid": "10c1f88d-9776-40d4-8525-e784f8fbb329", "value": 73440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684686535, "uuid": "942c738a-b02b-4f28-b2e8-2614829aea78", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684686535, "uuid": "dc64d76c-92f3-4911-80bd-66d7437fb1c0", "value": "3275ef0ec6a0ff8dd72affe7c48143a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d001c720-f7c7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684667307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667307, "uuid": "4982fe60-72f7-4e21-b95e-a161beb85fd9", "comment": "Malware payload (Amadey)", "value": "f74f3eeceb6deb968b8e61e71b012aee", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667307, "uuid": "197b1a63-25e8-4f84-a4c6-def49087ede0", "comment": "Malware payload (Amadey)", "value": "433ee949fe714cefdd981c01fc63b3854534587ecf876e7d4c6d5d87b529a72e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667307, "uuid": "4f7208aa-3805-4552-995e-477949a0e38a", "comment": "Malware payload (Amadey)", "value": "af1d967f775d06f4c13c2f43f07d9a09052f0ef0", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667307, "uuid": "6bc3334a-70b6-4253-a7be-0a4627c58fd8", "comment": "Malware payload (Amadey)", "value": "32f602eb17496a0c87fe61aceafa9926376ec4f8aa8875a9e1bdcf3793718e51983773726d4b816b66d909aafc443747", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667307, "uuid": "ac2ba98a-6161-4924-b720-959349463bc0", "value": "T1D9252303A6DE6432D9B617749CF203971B357CB0A631D39A3359A89F0C729C4A971B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667307, "uuid": "eb5a3241-8132-4c1a-9c2d-8aa980953212", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667307, "uuid": "5b193821-a0d0-49c1-a45c-941a27a11786", "value": "24576:kyfmJudnZOmCIqXiyQ+joFMQ9GkTA0iIxI6et1BS99ds9Gdo3:zfmwdnQmCIqS+joFMYTLiIy6e+W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667307, "uuid": "f72e7d91-d2e0-45ee-aa5e-75d86ecba4e1", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667307, "uuid": "40b96db2-f8e3-4624-83f0-c61957621ed3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667307, "uuid": "82729283-01cf-4359-8640-3eb0469ad44a", "value": "effects820.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85466abd-f801-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684692093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684692093, "uuid": "057f4878-ceb1-4a6d-a1e1-8850ff7d1199", "comment": "Malware payload (Mirai)", "value": "3ff41b7b19155e1edde61988b90098eb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684692093, "uuid": "f4d786d8-0a36-4d14-b423-fbfd2556bf0c", "comment": "Malware payload (Mirai)", "value": "43658b04fdae9c016b659adc73bb335c29c7b9bce4325b407682be9894c1b31a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684692093, "uuid": "7ad03f13-9b18-4b5c-9138-579682b2166a", "comment": "Malware payload (Mirai)", "value": "2b3db1967ee4a004eeec27188d5d81424db483d0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684692093, "uuid": "f067d849-c1e0-4f49-a980-de55a9f2724f", "comment": "Malware payload (Mirai)", "value": "4667aa90ba288650291532ec92b184d924283352294be08fa647c9b1f551b7a603b086e5a0060ba48b13cad8a4fdb006", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684692093, "uuid": "2db93284-15bb-4eb6-93ce-d46044242bbe", "value": "T1BBE33B46A6408B13C1C21776FADF424633229B94D3E773069928AFF43F87B9E4E63605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684692093, "uuid": "d8806299-bb1f-417b-b77b-5969fef26ef3", "value": "3072:Wg5WcBD08sUku621rsoahZVZAz2LKbgOqjag5GfO8VM/9c9k99E:Wg5WcGhvuNooahZVZAzAKbQ3GfOeM/9Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684692093, "uuid": "bf3dec8c-453f-4b97-ba77-eb6121af449a", "value": 152860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684692093, "uuid": "7d0c835c-53dc-44c0-aa4c-6d5134c05629", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684692093, "uuid": "367bce28-0523-458c-b56f-3a9c79e297d9", "value": "3ff41b7b19155e1edde61988b90098eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb62517e-f7c4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684666065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666065, "uuid": "70ee6463-cb59-46c5-a01f-df009228ecad", "comment": "Malware payload (Mirai)", "value": "13cdb8a32b4a3b9ce3d51f5946441dc8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666065, "uuid": "c3af0795-eb55-4ee7-bc7b-a96ae6b5d6ef", "comment": "Malware payload (Mirai)", "value": "438746b7bba523d229d8cc7b79700f7a8e3143eb8f60e5f30dcce621c06b0749", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666065, "uuid": "d1b3f0d9-451e-47f7-a574-637c9f635d2b", "comment": "Malware payload (Mirai)", "value": "9fb3ae9b471306544c954592e1ecfc1e29dd249b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666065, "uuid": "152f8047-460c-42c0-80fc-177ebcf24648", "comment": "Malware payload (Mirai)", "value": "4b6be7598ea2cdde2a09dac2b65ebca22db785cd15ceaed1e237cf16615dd2a6cbb668969914e746b8fa5fdcf38bfdb4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666065, "uuid": "9c8d4138-291c-4678-9564-201f14a86b1d", "value": "T1EC633B46EA87F9F0CD450AB8205BAF75C436A8333130DFEBEBD8B9179D55742605226C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666065, "uuid": "263b2721-efb9-497c-a04e-9540d9032af5", "value": "1536:IeAolofbYYQsBehM1XcB3xESOUd3dgO8SbmDuGV:IeyssLcBTpXb+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684666065, "uuid": "5b44d894-6279-4f2c-b8fd-570fd4245f8c", "value": 70232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684666065, "uuid": "e4a09365-33b1-4833-843b-36d4640ba6ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666065, "uuid": "1a6b9e85-34dc-4688-96cb-512d77a66cf0", "value": "13cdb8a32b4a3b9ce3d51f5946441dc8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4633729f-f7b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684658486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658486, "uuid": "b7ae5b40-aada-480c-85a5-eda266312965", "comment": "Malware payload (Amadey)", "value": "baf0ea9f40c8eea4c72ac95a63465783", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658486, "uuid": "b6d69a89-566b-4cc9-81d8-63899d9c689b", "comment": "Malware payload (Amadey)", "value": "43b6bfabb72ed75fe5a88b392964e5788d394d43273e7bba31f67e0b0fab096b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658486, "uuid": "6223b4e4-ee19-4848-b523-72ca6e37e4b7", "comment": "Malware payload (Amadey)", "value": "0a137d6cc21f36e7091db90ed0c2cec0030605bb", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658486, "uuid": "a8cc4241-5527-4e7f-9161-f0541d24879b", "comment": "Malware payload (Amadey)", "value": "0f942bcf1a0671e57d7141d8c5eea479e05cfa4076af7e62618f1cc4605a0909d6dd14684b1a7da1097705109236f90a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658486, "uuid": "74ef3c19-f37d-418e-92f1-44469823ad18", "value": "T1EC252387E7D84051FDB1237458F60BC70A267D925D74832A3B89AE5B1CB2496EA3073F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658486, "uuid": "75ff6437-e65b-47d1-a3a4-0fd52d4ce3f4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658486, "uuid": "674b21ea-ae99-4e4d-8fd2-c8c4f46a5c14", "value": "24576:vyQ8WmlvifzVFXM5epBmVSkB9wwieTPmJb:6QX+vejIVpXdDmJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684658486, "uuid": "99e9de61-4dc0-4b3b-955f-25ab9ead3a14", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684658486, "uuid": "f6d668f5-d491-4894-ab62-9497d9f8ae62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658486, "uuid": "2b638e44-2931-4a2d-91e0-2342b2d96de6", "value": "start317.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6362808a-f7b1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684657676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684657676, "uuid": "22301f0b-8dbf-4124-8974-a2cd4b57d729", "comment": "Malware payload (RedLineStealer)", "value": "87a284f36c1eaa125bf075305154511d", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684657676, "uuid": "b3a21418-c2eb-47f1-8f6c-741141ffe077", "comment": "Malware payload (RedLineStealer)", "value": "43ca91c9335e5244f25d343007793cdbdf42f4d11657b3544d14f199b2c15a85", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684657676, "uuid": "847a5d4e-a221-4d10-bb3d-1bbc621043b2", "comment": "Malware payload (RedLineStealer)", "value": "1c4d074c31ac2bb65b6e03163d8abf72363d37ae", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684657676, "uuid": "aa1c306e-0fa1-46d0-aa2e-fb27fdb03049", "comment": "Malware payload (RedLineStealer)", "value": "58dc8235003fbe70c749b3cf35eeb67e815e9b0b0ae2ec7349f8be9039f4e95a7fec7b139b9ccd679cd8c870fbe87e7c", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684657676, "uuid": "99814347-a987-4cda-972c-ea197b4874f9", "value": "T197E3D624279F8930D6BB4E3D6CB19CC076BCEC12A542D74A4ECCF5593A73B809B116B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684657676, "uuid": "906e9ebf-2707-41c9-88f2-952aa3a1fb46", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684657676, "uuid": "12cb39bc-c76b-4eb6-a582-67b5806e35be", "value": "3072:2V+m5cNQmRSxWWAcP+DDXedh7Z58e8hk:2jwCUudh7z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684657676, "uuid": "b214b764-378f-40d9-92e3-8b56a5767ebe", "value": 148728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684657676, "uuid": "cf6b0966-c937-4c84-8f36-97e4d93e278e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684657676, "uuid": "5dae4d20-5ab9-4a57-bcf9-6dfdfcb699d6", "value": "1212324.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d64f0b1-f7c7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684667222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667222, "uuid": "fd92c7c4-3d37-4882-9841-eff130158ccd", "comment": "Malware payload (Amadey)", "value": "9a64509d8384e008b823a47e118fabd9", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667222, "uuid": "6a7ac037-9fb0-44ce-9a2a-0bba2ac0144c", "comment": "Malware payload (Amadey)", "value": "43e9c97290e39e90c51829a1d85b042c49b7f91b51e99c8a0417aa4fa0d196d7", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667222, "uuid": "c1224ff1-d0ce-4a6f-aebe-3ddd4b78353a", "comment": "Malware payload (Amadey)", "value": "e29d00ad68fbe1468991e7f67f4c44dc44f44a54", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667222, "uuid": "0165b5b9-fc0d-4397-a5fc-3f54232b155f", "comment": "Malware payload (Amadey)", "value": "e396c7ee58f22327b8ed849f7da3158c1f5c94831baa3a48c1593bbf4cbdf07451bdb83cf0907908ffce9048b1a5db05", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667222, "uuid": "53a2f99f-b560-4b22-bbb1-5dca2d771c34", "value": "T13B252317F5C84262E9B17770C9F942832B39FCA0D8B4C75A2B96E9192D73290E831777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667222, "uuid": "f200464b-3a46-488c-a1c0-6c2f1a9db9fb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667222, "uuid": "94ee31e5-e583-4dc3-82a4-4ac7a5de9c7b", "value": "24576:yy3uJFfZGqzfwcexXwV+S/rLU5a/h76V0VmkzV:Z34fYqDwcfVTDweIgmk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667222, "uuid": "d6c94418-4b08-4fd1-b446-733766489fd2", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667222, "uuid": "11a33323-2bd7-427f-b4f7-69c1fd4db7b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667222, "uuid": "68b9ca5a-ba61-473b-a808-360555892859", "value": "423979.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a32e36a-f7b1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684657688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684657688, "uuid": "ab652c35-989f-481c-9c8e-c2ef07685422", "comment": "Malware payload (Amadey)", "value": "247629c898405fbeaeb347dba0486043", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684657688, "uuid": "277685b3-3fbd-4696-8735-3add722b052a", "comment": "Malware payload (Amadey)", "value": "441f87032bcd48275e7cec7307690e95f19f8990bccf6ab9deb6516240db6eab", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684657688, "uuid": "09dcee8c-b812-496e-87eb-8296009774fd", "comment": "Malware payload (Amadey)", "value": "e10947607c33c325f9a01016002e4a90830f32a5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684657688, "uuid": "f6945d15-2cb3-4fd8-a973-76006e465555", "comment": "Malware payload (Amadey)", "value": "037a0c6dd4b5d5538a68487dec04c823a6291a178864c9a296c1f7ace5a529c34e417058a617598c71e5ab1b1380b3d7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684657688, "uuid": "b49ed6cc-7265-40ae-9184-c869b91c9245", "value": "T157252367F5C891A7EDF513B4A8F306D30A3079614CB4D2272B99669F8CB3E58203476B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684657688, "uuid": "eaef6246-5e71-4b9c-8c80-87e244eb54c6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684657688, "uuid": "4795cc1b-622f-4b5c-880a-224120b1bb5f", "value": "24576:nykvqdgHF0B+qxmcCaPX/wDgJer1jj0Gv2gzBvo:ykiWHW+qfvIDgJer1joe26", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684657688, "uuid": "e33a35c5-2c25-4a98-9580-be333d17016c", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684657688, "uuid": "e761bec9-6046-49b1-b0c9-e10a66f92919", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684657688, "uuid": "6dfe2b51-616a-4eed-b672-8bcc8c52beb8", "value": "1212324.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82a177a5-f808-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1684695095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695095, "uuid": "5ad25c78-c29b-4960-8bc9-ea1b909c4bf1", "comment": "Malware payload (Stop)", "value": "cbe7a31a79c06c16565d085f24e348a2", "object_relation": "md5", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695095, "uuid": "4916aaa8-1845-4624-90b2-c74843f3c852", "comment": "Malware payload (Stop)", "value": "44b358791fd570b307e9c032a8306f91ee2900bb8c4aa2ddadf7fdbca0edb23f", "object_relation": "sha256", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695095, "uuid": "84421b56-e188-44c1-8cf3-388da1a17bfb", "comment": "Malware payload (Stop)", "value": "564794e6978771e5c7277f59d60319d646bbcb55", "object_relation": "sha1", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695095, "uuid": "d25e35e1-ca41-42a5-a60b-8bed243dfc67", "comment": "Malware payload (Stop)", "value": "c3ca99993b3cc79c54068b3e39957a4ae24846ef1e3e05d520187ec6c3abcc87290bf9d29fb95a27327f216b2186db12", "object_relation": "sha3-384", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695095, "uuid": "c31b08de-114b-485c-9b0b-f1136790859a", "value": "T10905F11362D1BC60E66587769D2EC2F8765EF8608F162BC7A6086F2F14721F6C5B3B01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695095, "uuid": "bbaa6a7b-4108-4bdb-9142-65344e415fb0", "value": "ad1da3007d39bc21ababd35f90247ee4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695095, "uuid": "50ead325-d1bf-4aec-98c4-931144f81c44", "value": "12288:H2LVmdBvQzrC1g7IfxBCpoCcetbNIe3CpLc4G1ov/BqGyZkq:HUqvQ61g0vCCC5B3Cp7aohqGyZkq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684695095, "uuid": "70e4d644-4404-4eb6-8acc-1d85e1898258", "value": 823296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684695095, "uuid": "dd9b2e0f-e2ef-4224-b08e-6a675e2d9afa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695095, "uuid": "651fdd96-e190-4982-8a18-80504f0c0150", "value": "world778.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04c7c387-f7d1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684671261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671261, "uuid": "b4eb67e3-3ed5-4e2c-95e1-db4ae9ca1421", "comment": "Malware payload (RedLineStealer)", "value": "8de2126208a762032f0a055fe8a1ac0f", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671261, "uuid": "c23b6944-a7f1-4a1e-ab25-b8ce0a01cde1", "comment": "Malware payload (RedLineStealer)", "value": "44e5886d883aa5f605b18bf4e7622672d7abf665601064356950fb68071c3009", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671261, "uuid": "bd23db1a-93ef-49c7-846e-4547f8fea080", "comment": "Malware payload (RedLineStealer)", "value": "d1e9ec77fa915e03f9af963ee31190ec6b967d8f", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671261, "uuid": "a4d3f347-eeb9-457c-a766-b615ab39aaa1", "comment": "Malware payload (RedLineStealer)", "value": "af9abc894d6b3d995950322f6f00ddb340e92fc7555e7cefb7f988c1b691a4f4d28742ec1c66b13635b48a37fe5ff4c0", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671261, "uuid": "65449661-91d5-404c-8dec-17d8188d408f", "value": "T1BB25220BAAD9A432DCA157B1A4FB024F0B377DD18974572F2B979C4A0C735C8A5B037A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671261, "uuid": "ac73a181-ecbf-405c-81ff-b2bb5f8be989", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671261, "uuid": "2081290c-b257-4ce3-8129-801cdbd5b5ec", "value": "24576:Ly4XAxyg3lBiAIp5VwsoMmBi9xBfX2FCa5OqxTHE1dv:+xxygVkDp5Vw5MH9xF2F7ZxTk1d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684671261, "uuid": "59dbb334-e99a-4ee8-aaba-803a43837825", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684671261, "uuid": "ae3aafa8-e0fc-4dcd-9e6c-d9734017b0d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671261, "uuid": "ffcdd0e1-f287-47e9-9740-b74b85d4d0c2", "value": "start977.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c2c8db7-f7e5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684679971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684679971, "uuid": "f6625acb-1002-4298-a0fb-008cf444a171", "comment": "Malware payload (Amadey)", "value": "88c8121df0f8b44d38ab765b8f8c002a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684679971, "uuid": "d11156f0-d375-4f8e-a7b0-910c42bbc7af", "comment": "Malware payload (Amadey)", "value": "453fb3f5cdb8508197bfedcd8ecd7505961d2913fa4a0ca8fbe569f31bcbc4ab", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684679971, "uuid": "8ddcf8dc-3023-425e-b696-1f1d5040332d", "comment": "Malware payload (Amadey)", "value": "845df938995ff66ca48b8a9e2a977e281eaab4e0", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684679971, "uuid": "691cf37b-5393-4b32-b6a0-480946404456", "comment": "Malware payload (Amadey)", "value": "b8a75eb678cb5bd6a8c21a9d56d733f8e0e212f18d8a6852b674e76cfaa21d4c1f660101c20353b193e4dddbd1b0da34", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684679971, "uuid": "d5cfcf8c-e32d-47bc-80e7-b07a7f900838", "value": "T1ED252303BBE89076C8B63B74ACF617D31A32BDE04A7893562A05785D5C735E0A872377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684679971, "uuid": "07f44880-18e2-49ce-9eb7-5702bf28959e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684679971, "uuid": "6101843d-6309-437e-84ca-1e14588d1b27", "value": "24576:jy4V1ewTQJqNUqT67e7g7v/f8ctTLFT/+iJ5Vufk7kQO2:24V15T6qNUqT66Ub/RFFr++cfGkT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684679971, "uuid": "38304d4e-62e1-4f5b-84ec-5afe9d69de09", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684679971, "uuid": "93bd7141-dc7b-46cf-8773-d67631130971", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684679971, "uuid": "490e855a-2eb9-4dfb-b769-4b74223ef8fb", "value": "66234204.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1cb4bc6-f7c8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (TeamBot)", "timestamp": 1684667767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667767, "uuid": "4d3c0c72-f434-4255-9e07-570b4151f9ca", "comment": "Malware payload (TeamBot)", "value": "3e711e2a2a08eb8f6ecec5fcefeea457", "object_relation": "md5", "Tag": [ { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667767, "uuid": "1ebd9471-1b73-4bf6-ac0c-893ca28986a8", "comment": "Malware payload (TeamBot)", "value": "4560c775fe92392ca397f177c4c8df8eb9f20217a957e1880a296bf6ffb8b5cc", "object_relation": "sha256", "Tag": [ { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667767, "uuid": "9b9b01b6-261d-4cf3-812b-d67256638980", "comment": "Malware payload (TeamBot)", "value": "655343f1f09ebb424b04175b85bfe115091ac7a0", "object_relation": "sha1", "Tag": [ { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667767, "uuid": "da92fbf1-f4ac-4f04-8167-ecf071536f64", "comment": "Malware payload (TeamBot)", "value": "c974ab10389d830197299e8d4b34cf9a426ef7fb7685cc9d350972a1a7670cc6d3a11de0412efb595d4dc853051b9daa", "object_relation": "sha3-384", "Tag": [ { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667767, "uuid": "803334db-3f0a-478a-8ea6-7b919f0115d5", "value": "T108548E926AD3EC79E56606718D39C2F8762EF861DF1567C72344EB7B18301E286BB301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667767, "uuid": "55966606-316a-4055-afa9-1657af12af62", "value": "dc368f441a884fce22ecc585e2bd5326", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667767, "uuid": "65bf87a0-b0f3-44d1-a8e3-e6bee9e9183e", "value": "3072:Gb1/YhlJijyvs/QzEqhG6VzKcF/PuZz8NqQW5J/ALea+ksSILxN0TXqpWjZ:IBY7syv7vzzKcZuB885JILTYLf0TXT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667767, "uuid": "0f834cd0-aae0-4eae-a2cd-3adcfd51a359", "value": 300544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667767, "uuid": "4b70711e-7609-4eff-9d33-c411dc4fd3fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667767, "uuid": "51b7ef96-e5e0-4dd4-81cf-6428e81bbdc5", "value": "bitcoin749.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdb1a289-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684680591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680591, "uuid": "8e705c96-8692-4a81-82f3-b4a399494b98", "comment": "Malware payload (RedLineStealer)", "value": "f48f433f9e694ffc1a39ad792dd23f2e", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680591, "uuid": "5299053c-eabe-4f0b-9ff2-f2352baa91ae", "comment": "Malware payload (RedLineStealer)", "value": "457ca830ef3257571defeaecf1ae9b7df3354557f3af36724199832a6a60b974", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680591, "uuid": "42a23687-a1b2-4995-babe-d6265c8c4d06", "comment": "Malware payload (RedLineStealer)", "value": "0930f34088dc107fbeba21c483ceab2c67744660", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680591, "uuid": "f210f660-4388-445f-94c1-8ac2684bbe01", "comment": "Malware payload (RedLineStealer)", "value": "9165ef7c96b4a5dec5d280bea31a325ae75de12ff8d9830566d6e7cd7bce55922edc03d303b8f0ce3e608b7c1ffa9c6c", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680591, "uuid": "493261cd-6c44-4b55-8bdb-f1c8024166ec", "value": "T119252317AED480B1E83427B419F313972B32BD615539D3972388AC6E1E72BC1EA7131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680591, "uuid": "3cd71a34-9cda-4e77-aee8-eec354dda471", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680591, "uuid": "c4b87311-8843-441a-87be-88bc8a4be2bb", "value": "24576:Fykz8vwSqS8x9dS0mqI11ooTkJGfSF8x9BTJG:gIfSqZx9dFmqI3TkUfu8xn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680591, "uuid": "7bd9aef5-cf6f-4eb0-ba40-77381b24dfeb", "value": 1056768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680591, "uuid": "d0a0f39c-8db4-40ee-b159-cdb3cbf6edae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680591, "uuid": "3170117f-b3b4-40fd-8a70-49831465ce36", "value": "interface298.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a312655-f7b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684658386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658386, "uuid": "cbf55857-f836-4eef-bf68-b572bb5ed742", "comment": "Malware payload (RedLineStealer)", "value": "57e3240e91b855b16fc01b3a0e675d1c", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658386, "uuid": "1cc0cc77-5b19-4b19-9543-73a7bfa7c88b", "comment": "Malware payload (RedLineStealer)", "value": "457db42a4e399f41bcd9dacf2aa527cc170a0ed46b0840ea2d6a0cf12be9bdd8", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658386, "uuid": "dcc7c684-4301-419f-809f-ec1c58bbb155", "comment": "Malware payload (RedLineStealer)", "value": "860c69daa332dc6e7c949ff7fadad26eac3c7303", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658386, "uuid": "06a4b100-ed1d-420f-afce-c16515df623e", "comment": "Malware payload (RedLineStealer)", "value": "35931a172bb0c2bbe4e2df6ce80c89764edd49e14e020f331c0d30de02baba381552a703f20408f258806b3c1b105fef", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658386, "uuid": "81d4d147-397d-447e-b730-c3a5993fd0ca", "value": "T1FC252343C7D98436DA792BB498F703930F36BC65CD341A2E3A459A192D73A54A63333B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658386, "uuid": "abcd1d7e-8c7d-4f1c-93e3-6621a0176e1c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658386, "uuid": "c2b34edf-a25d-4cd4-84bc-ae3fc8342a36", "value": "24576:ny3lHqJQ+g53DiBq/SCLACqywNv0m02rJM8QX6OJ5:y1H953DiBqRH+vl02r4X6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684658386, "uuid": "9a32fb14-4f8a-46f3-9771-cab944f7dea8", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684658386, "uuid": "2988e8dc-ff7c-4eb7-b9a3-af34486473f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658386, "uuid": "08196f1d-cabf-48e8-8c3f-621cfcaac3ce", "value": "32332350.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dd3c7c1-f81c-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684703569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684703569, "uuid": "f610c278-3f9b-4a4a-a135-462c17a68cc3", "comment": "Malware payload", "value": "fdf4bc24696160633ad1932fb768fddf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684703569, "uuid": "ce940dde-81e7-4351-a14e-7b9ae268f9f8", "comment": "Malware payload", "value": "45a381b98a77e1e37fed522dc391e742afd47ec747047660432e8f65358bd540", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684703569, "uuid": "1f3524ad-9f0d-4843-b658-b4d19bd5c375", "comment": "Malware payload", "value": "8d7414260fb2c64b285b26f234680aeacd567246", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684703569, "uuid": "5b493440-52df-4fc5-98f8-0a9eadf15fb1", "comment": "Malware payload", "value": "06c2252604f9a3b73db6460e41f94878ff2fe1ea41069f4c2d56b8b4b1d0265e6110705168a8284721f06d92278fc03b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684703569, "uuid": "948853ea-472d-4674-9169-750838c510a0", "value": "T104252213EBC88073E9797B709CF312830B74BC252D34827F6B4969790D72A9469747AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684703569, "uuid": "31b217ca-30b6-437a-ad5a-19cb8c676b15", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684703569, "uuid": "f49dec29-7596-48ee-93df-ac31e6614161", "value": "24576:3yN9KnVGqi2eq+jIKIqjKMMr+mcu+UE35gi/lWC4XyHbN3a:CNQnVGqi23BPqjKMcmUK6iNWNyHk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684703569, "uuid": "cef07d06-24be-447a-9a8d-05fcdb57d6b8", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684703569, "uuid": "d336de15-c978-460b-a6fe-debaa1e0bac6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684703569, "uuid": "5877cfc4-5b21-4b8d-b595-5bc666a6fdae", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9760fdfc-f7f4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684686540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686540, "uuid": "67f99c0e-ca98-4b3a-8058-eb3f72393585", "comment": "Malware payload (Mirai)", "value": "756109d2ee890046c262f483c3cc4fc6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686540, "uuid": "20904dbb-9e7d-40c0-a393-9a79525cb79a", "comment": "Malware payload (Mirai)", "value": "461bff8518153b3cb81fb771a22a96a1f0323dc14aa76a50594456e529517eab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686540, "uuid": "e14f2922-dac8-4111-bf38-7356db8d4bd8", "comment": "Malware payload (Mirai)", "value": "7ddc10c13b790028dda75dab3d2c96fd31923660", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686540, "uuid": "3296a8dc-7cab-400e-a5b7-2b93de96412f", "comment": "Malware payload (Mirai)", "value": "431cefd717c175ee77f6ab44b8694e44e89c432bf5735546e45ce2a971a7be391c8cae5edac586bd2fbfe83dde94eb31", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684686540, "uuid": "4a19d371-50e9-4bf3-8066-2d2f9c4f1d65", "value": "T1D8338D67E82A9E54C04641B075349F341F23F5C493532EBB2AA9C2B95093EACF645FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684686540, "uuid": "2d20864e-b6e1-4690-aa04-37ec59a8e944", "value": "1536:FaQpz/FIPfk349FY3KbTWVyd/hCcUHNx6:FnpzNIPcAY6bzd/h8Nx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684686540, "uuid": "01ead455-3c0f-45c6-9a99-3a1c9d04ff78", "value": 51328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684686540, "uuid": "fdc11931-f4cb-436a-9da7-251e29c73045", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684686540, "uuid": "98b3f38f-b0e0-40be-9ad5-1e422cb71a23", "value": "756109d2ee890046c262f483c3cc4fc6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9284acbc-f771-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684630267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684630267, "uuid": "79e0eff1-6cd4-4d80-aa18-22d1178527a2", "comment": "Malware payload (Amadey)", "value": "a817b67f52efdab8690d528233bb0723", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684630267, "uuid": "eca8d2d0-bec8-4cdb-b4fb-e3debd1ecfb2", "comment": "Malware payload (Amadey)", "value": "462ee863999ec4120dbb9a3e4606bc094e98fb18dd5f0832a46edf9a475ae9a4", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684630267, "uuid": "1327bb8b-4505-49c9-b5ca-498e5bfeb86c", "comment": "Malware payload (Amadey)", "value": "3e2389183bb5d2ad985f6415a9f80be88c723b91", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684630267, "uuid": "7dfacb4c-1b36-4f13-a0ac-fcb5fe229350", "comment": "Malware payload (Amadey)", "value": "223b850b12ed81238497a363f53d5130e12528d76222848e9d08e2087f49ad883d80eb410841551602ace581c030d9aa", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684630267, "uuid": "ca139562-571b-4807-a35d-daaaef4952f5", "value": "T107252343EAE9D172D870B7704CFB23970E3B3CE0953483671586A99B48727806576BBE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684630267, "uuid": "80743687-e260-4df1-bae4-4a52233c5313", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684630267, "uuid": "1616080c-1722-444d-b6e0-9acbef39ee5e", "value": "24576:nyBqoH94Iq3kxeR3iPW8F4ds+0N2yH41LnT:yBqCTq7Sjed9a2yY1L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684630267, "uuid": "19478907-485c-4f15-ab39-014971886765", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684630267, "uuid": "f2cf3769-34cc-4b6d-a7a1-adcd709e006f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684630267, "uuid": "72fbb335-2fbf-47d2-979e-be208efa78a2", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62b656ab-f7c8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1684667553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667553, "uuid": "e247c8eb-2cf0-431b-af61-29e6f2a16d62", "comment": "Malware payload (Stop)", "value": "80d2aa38246b13f02c838a3f13fe02f1", "object_relation": "md5", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667553, "uuid": "0660c9ed-c124-420d-9216-dfba687c59fb", "comment": "Malware payload (Stop)", "value": "4686341164821a5eeb9602014b98dbb442019c4515f5c4b9eac1492cba4d8e0b", "object_relation": "sha256", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667553, "uuid": "8ad1bee1-bb9b-40ab-8731-2888feb47ca9", "comment": "Malware payload (Stop)", "value": "6861eb16cec548ed64f70cf9a21027df869f2226", "object_relation": "sha1", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667553, "uuid": "9e9a013d-ed56-4b67-943e-5c00780b940b", "comment": "Malware payload (Stop)", "value": "d129dc1ee732bffe1a39ac949c337d3b57a5d81d1ae89f0c7af6060bc5f5b8d2e7eb05083d28708a6953bcf214250eeb", "object_relation": "sha3-384", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667553, "uuid": "f73caa14-b73a-488c-b758-2d3c5c9dbb06", "value": "T18605F102B2D3FB72E15D8A718D19C5F865EEB5618F052BC722386B6B19315F3CA72312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667553, "uuid": "4e92ec18-617f-4ae3-8070-0b5a267a5e2b", "value": "c37a1f908dc8ba7c67223959bc2021cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667553, "uuid": "c1dea222-e96d-4cb0-a339-a5e70a376902", "value": "12288:g9wLGSXs6WPWNdE05Be3XEyjGVskMcarFHpUlw1kWVwVeRUGCn:gAGQs6WOT2XnjGly+w1kuwEUNn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667553, "uuid": "b6f9da9a-5063-492e-a4d7-f8c1fa4306ab", "value": 807424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667553, "uuid": "ba63771f-699f-4103-b358-0598e1bee063", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667553, "uuid": "49030a09-6067-464e-b326-97ae11c567e8", "value": "2332324349.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d0412fd-f807-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684694468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694468, "uuid": "163ab007-62f1-4451-a4d5-752b7324d13c", "comment": "Malware payload (Mirai)", "value": "8be71b34ef9577904ba7f5ec51ce4352", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694468, "uuid": "b77df13a-2fbe-4cea-9fed-c4c6cb0abe40", "comment": "Malware payload (Mirai)", "value": "46a66c57317b516f78db488c34431f25d7d2bd950a2f8fd7666f5c4be9d30a6c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694468, "uuid": "d5b603b2-e1c8-4077-9015-e000524da978", "comment": "Malware payload (Mirai)", "value": "4d38ed69abdcae4d3f909c38afd67dea5b1cfef1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694468, "uuid": "14cb8b08-fe44-4a6d-a092-43008c82cfb2", "comment": "Malware payload (Mirai)", "value": "8ee78f2298bad020a80b0895e7d06a9372d1e60c4f9298f8956814e9284d6823322c1e52f5a985d98c7b5a3cb000d365", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694468, "uuid": "42e9c907-2e90-4a82-9b63-3d3cc4c80610", "value": "T1C573E819FB514EFBDC6FDD3706ED1B0135CC558622A83B3A3174D928B64A50B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694468, "uuid": "4edc303c-2cb1-420c-bffe-fb1d59f67b06", "value": "1536:iroIzx14qekYxVlU2xD8QIevbQStgVAvRgGTI:iroIdzo3U6D88C9GTI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684694468, "uuid": "8f5aa84b-b5c6-4957-a50e-c6746bc80522", "value": 80704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684694468, "uuid": "1b7674aa-029c-4a6a-9407-57559bf37aaf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694468, "uuid": "272f0331-388e-4685-8c41-03b6e916f420", "value": "8be71b34ef9577904ba7f5ec51ce4352", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "949a067e-f80d-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684697272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684697272, "uuid": "b9f82ee4-fa5a-49fc-ab6b-f5a014893e34", "comment": "Malware payload", "value": "52f350cea5575f37cba87b77077ecd74", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684697272, "uuid": "3e45bc29-1dde-4459-8581-065d9ebead86", "comment": "Malware payload", "value": "46fc1cb666edf0c70d2785f706339bdefd0b00dcc634349c2c1e15335af571c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684697272, "uuid": "303dadea-494f-4514-b45e-4f422279f67a", "comment": "Malware payload", "value": "e555d3bcff68540d1f1f7224ea02527a85a55efa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684697272, "uuid": "a3d60359-b0de-4d98-acd5-ed65ec0e7eb0", "comment": "Malware payload", "value": "440934e63ef8db7f2118dc6f56ce16b54556d528a9f242317e19db6f6cfc99c7c5fb049108ccd09b350c5c307daa4a7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684697272, "uuid": "7d17e00d-8502-4ddd-8aa1-c4a11f7bd4c2", "value": "T1DD44AF1233C9C07AF4A3197585C9CE75A5ADB8700B2F50DBEBC84B5D4F626E2AB31247", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684697272, "uuid": "a369d85b-7fd1-41d3-b335-6e4398875886", "value": "33e2b12a816de1c22216b99486f98fd0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684697272, "uuid": "0a5e151a-40d9-4814-86e2-8bf8526dbf61", "value": "3072:NwxUVSyqezfy/aGNBNX/NOmkyNytxvG88RtmorCE8viSkNoWx1RAifkHnHhqI:SCZvfy1NBNXctxp8LruE2izzAicHHkI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684697272, "uuid": "441eacc6-ad80-4db4-a1dc-ad37a1243c07", "value": 266512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684697272, "uuid": "d8bf989d-56d2-4fdf-a4a4-a28efe9f02fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684697272, "uuid": "8b351ea1-a22e-4c1d-b672-f60de4852427", "value": "version_v319.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f419d04-f821-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684705666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684705666, "uuid": "18ea497f-9e63-4f29-979f-6df96c85579e", "comment": "Malware payload", "value": "6fb14fff29fd6ccaafe384bee137c710", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684705666, "uuid": "499f0ddc-7531-40b2-888d-ef4c48fbb0b7", "comment": "Malware payload", "value": "474a30bf1ca79b8a26a23372d36ac8f7031b0f498285980650d05f0a22c8375c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684705666, "uuid": "796d7bc4-2446-43b2-83f9-89383b450703", "comment": "Malware payload", "value": "4563060825313723a12826365473ac56166c644f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684705666, "uuid": "3bbd68eb-bfc3-4803-ab86-3e43e8a021f6", "comment": "Malware payload", "value": "19a5da76db015fb1b90e8140bc5a82e491cd582687781ca8a4a2132ebf1f5785a532b4711629f693d29566fb5e43761d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684705666, "uuid": "c5e3651c-7c7b-41e5-8dd1-e24a5f98da25", "value": "T141953342D7D1C03AF611C7B31C5B5E20A5A37EA9486EB2EDB2347B8D267F4D0F992214", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684705666, "uuid": "d7f2b3d9-6b5a-408b-ae89-71b373271cea", "value": "e92b45c54aa05ec107d5ef90662e6b33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684705666, "uuid": "b6bbd30a-0c98-4aa3-9f87-7a93b752639b", "value": "49152:tifei8Wolj9IGFGUG+6/5kWQkqiZC21s8wuH:tiGir+j9IGFK/5kWQkV0u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684705666, "uuid": "f59e9ffa-4f81-4af8-81a0-120599ee38bc", "value": 2025746, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684705666, "uuid": "dc532f51-77e2-4f32-ae0e-78624d816878", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684705666, "uuid": "e353edf4-de3c-467f-9496-77743d07f760", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce798b7e-f808-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684695222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695222, "uuid": "f6a0b375-f1dd-453c-bbfe-e4ff8c7b6944", "comment": "Malware payload (RedLineStealer)", "value": "a5195fd59627e7b0ab3c0eb484ec05e7", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695222, "uuid": "09d76d84-0f9d-4359-a90b-7501f0a2be9a", "comment": "Malware payload (RedLineStealer)", "value": "47b20e0ef6f659c64b2cb5ce8cff259238b00b92f4391dacc37e6b53014b9124", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695222, "uuid": "319c8ced-93ca-4979-ad5d-6f55b22f4b71", "comment": "Malware payload (RedLineStealer)", "value": "5569d63fcf1a94c4b7c74d747c3f6ff46a9a6c18", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695222, "uuid": "d14253e1-3c65-4b29-b7af-514e624b8c9b", "comment": "Malware payload (RedLineStealer)", "value": "477c1dc731f3f921dee800e8f20d295c45903dbe9e81ea4c6c184b75ad7255f1652d4a2636de715f6a49727752dd0902", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695222, "uuid": "f63c0130-f8d4-4166-8559-8e1e4cec0e83", "value": "T1C4252342E7E48276ECF413344EF7038B0A36BC91A975529A27419A5B1CB2BC2767077F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695222, "uuid": "ade5e3d8-6437-466d-88f0-052ea13680ae", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695222, "uuid": "e947a1f3-752b-4c0e-b293-053e816649e4", "value": "24576:cyd9r6u/kOLVsF7+r8wvwfUxENzafPi9GMT+3NASz:LP6u/kE67w8wv/xE9GPZMT+n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684695222, "uuid": "825e74ca-9c23-4c8d-9403-ae75ba34da98", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684695222, "uuid": "2046b535-ea5f-4f5d-a047-411b78f7172f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695222, "uuid": "b23195fd-763a-48cc-9e21-3284f1b8452b", "value": "353512181.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deebd625-f808-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684695250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695250, "uuid": "4e6be720-60d5-40af-a45e-979091648e15", "comment": "Malware payload (RedLineStealer)", "value": "ee3cfbb4fa2bc44f2abc9c3b61bd7cef", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695250, "uuid": "6d19c49f-fa7d-4afc-a9d1-d07427970505", "comment": "Malware payload (RedLineStealer)", "value": "48a02d645bb31a876ba8f0a5cb819038817c9db87c73052c67e934a40f25209c", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695250, "uuid": "0119b47b-59d9-4e8a-b57c-c48f0c5fb607", "comment": "Malware payload (RedLineStealer)", "value": "0649012a5e9b5efae2fc2c62f7bb9313c5007c1d", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695250, "uuid": "dd8a5009-c08f-474e-a088-a35485552e4c", "comment": "Malware payload (RedLineStealer)", "value": "8bd4ca2e45633eb55f551da8c2846be24cb481fbdcff33b105cf5fb5526695d35b42420309ad83f31af58c3c35572779", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695250, "uuid": "acf2032c-98d5-4ac5-9369-8a725d66260c", "value": "T18825235BBAE55472CD7927B088FA16531F3ABC988EB0824B3349915F1D329C0AD32777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695250, "uuid": "a06efe98-5683-485e-ac86-51300e68a1b4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695250, "uuid": "0956687c-4db5-464c-8dc2-fa964cc68ecc", "value": "24576:9ym5Gb7fPSnGMRn94qc85TnMp2JrJX/WUsxREs+GtC:YmUXf6nGK94qc85TnMQXX/WnREs+G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684695250, "uuid": "94f5b974-9bec-4fed-b27e-eec430b514e7", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684695250, "uuid": "a5c6634b-e09e-4a00-a490-8b2ba05f79f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695250, "uuid": "0a267979-7308-410c-8a35-e5a28b4f0c3c", "value": "DHL660.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55366816-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684680416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680416, "uuid": "f9cfc51a-5b84-4307-b49b-4730064e8366", "comment": "Malware payload (Amadey)", "value": "48bd78136d569b05c0a5ad605b4af0a6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680416, "uuid": "360b7cb9-45a5-4f5c-96c4-890eeba51e66", "comment": "Malware payload (Amadey)", "value": "48a31e1bbb85ea2690cb68c227e450fb477e39c9bdffdde9632b572ba84db6ec", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680416, "uuid": "00b021a5-59a7-4dc9-bf43-694550d342d1", "comment": "Malware payload (Amadey)", "value": "7a6302422ee8c6d37069b4bb06e76c3d1183dc4a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680416, "uuid": "62b6c107-72c3-41b1-9192-c83669313d59", "comment": "Malware payload (Amadey)", "value": "5ea4b181b94dbbf4c24fe3ec5e7a11f857224c5e1408abfd357452c45e6552dff4d5ceb8efe06833d20e7fcfbe1e0903", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680416, "uuid": "eaf8cc13-01c1-4040-9ad6-506d85b6fe0c", "value": "T1F1252303B5DF8475D872273428F20A930E36BCA18E3D867E6385662B9DB39D11C72767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680416, "uuid": "711e958a-96aa-4a4c-861a-f8dc2b56665e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680416, "uuid": "6a51aae4-3b0f-43f1-9a56-7e0a08ee711c", "value": "24576:oy9a8yYUvA5W67AqbVUI/p4PWAdp7EEvXXPCKG2sg8Tn4:v9a81X7AqbBAdBtXXPCcs3D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680416, "uuid": "c305244f-3ddf-4484-9a6d-fed8aabd26b5", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680416, "uuid": "014fdbfd-79ea-4e88-8a7f-85a3b21f31ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680416, "uuid": "9cb3f25e-a9ca-4be3-92de-312f280d1dbb", "value": "2332324318.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e64952d7-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684680659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680659, "uuid": "b3a95f3b-b72b-421f-9f30-57fd6920e405", "comment": "Malware payload (RedLineStealer)", "value": "72062e52222bbdc52f1ecd7158a33648", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680659, "uuid": "476e89a6-643a-4302-a0b8-1c153f02ef4f", "comment": "Malware payload (RedLineStealer)", "value": "48e882892aa2e856c095e8ae4f4e49f03d4c4d5a4acb0727275571b8acdf9cff", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680659, "uuid": "7f3199de-8016-4c79-8324-5b3f54b2c3e3", "comment": "Malware payload (RedLineStealer)", "value": "10f17739f16d40d40a6718d90a53f2fd1ca22f24", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680659, "uuid": "da547d2d-4d68-412f-8665-a19f2bd7581c", "comment": "Malware payload (RedLineStealer)", "value": "a63400a8294986db82ee3934b1b267ac154ab15deb74be738a40c2c68d96fc638d75635099fcfaaad88347f216689d4d", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680659, "uuid": "38d481ea-6a7a-48e9-8eb3-e4d8619f01bb", "value": "T1A8252353ABDC9172DC7527B158F707931738BCA65E3A666F36009EE948336C0A83533A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680659, "uuid": "40d93a7c-002e-4466-b1e8-d79347d7e38b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680659, "uuid": "11ea424c-20af-49b7-988c-dc4e7b1445a9", "value": "24576:Uy7mF4PWwVDTqq12WT3064GxOizEXtIFl5EKXpwuNlTMUEF:j7s4hTqqBwh257pwuNlTMU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680659, "uuid": "f0cfe086-9584-4e43-80c3-1baf0fe0f781", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680659, "uuid": "7db2349f-9bcb-4d57-9cf9-ebfbb38d0087", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680659, "uuid": "5967d4e7-fc74-45db-a41c-9823e2de4ad4", "value": "router737.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ca19e40-f805-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RemoteManipulator)", "timestamp": 1684693823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684693823, "uuid": "539c83d1-df91-432d-b900-a52971c8b998", "comment": "Malware payload (RemoteManipulator)", "value": "a9401f125c0d374a3730bbcce97cedf4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684693823, "uuid": "e2a6d253-f860-4978-bbdb-0b3106a9b9b2", "comment": "Malware payload (RemoteManipulator)", "value": "490f16c9cc592b36d5835ebdffe6567b49b82dc3e3104dc355a25953aff9ff79", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684693823, "uuid": "e0e0d804-2afa-4271-b8ee-324753370093", "comment": "Malware payload (RemoteManipulator)", "value": "cd08b77fee21ab4b07748ef13de3346e597b3f4b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684693823, "uuid": "9a2f5dee-78dd-472d-a8ce-8a77b3e15c71", "comment": "Malware payload (RemoteManipulator)", "value": "2bd8c5fcc123afb7f98e1baeb9e8439cfde98275881d70bddf6480e17eeb7fd5893c756b8fa11d22eea0daf97a581006", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684693823, "uuid": "31fe45cf-56bd-43e4-9316-f63375bc9dc7", "value": "T14F073352E7E24415E4FB4BBA8DFD4B1407BABC9A1A07578E4384F11E9CB67421CA43CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684693823, "uuid": "d7f9b98d-853a-4132-ba6f-e6744094a005", "value": "51d1f6a548cbe091a440204f9bfeb14e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684693823, "uuid": "ffb4ee44-2167-482b-9121-477c731a0fad", "value": "393216:8uDuv1P8S71svm2bmMQhJHMEeBYRgqxvQP1W:qvqSiNRQsEyYRgOIP8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684693823, "uuid": "e3dce5ff-b325-42c2-a45c-72cf09819081", "value": 17807792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684693823, "uuid": "720162a1-4370-4f7f-a264-648794bd42de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684693823, "uuid": "112ec2f5-6a22-4073-a554-387ce5116923", "value": "a9401f125c0d374a3730bbcce97cedf4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfd084fa-f7c7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684667334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667334, "uuid": "b6e89364-8b70-4aaa-a481-d5c0196434f5", "comment": "Malware payload (RedLineStealer)", "value": "47699fc6a703a076f0ea3eac3e44a155", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667334, "uuid": "3c46c469-f23c-46f2-86db-6f90875934b3", "comment": "Malware payload (RedLineStealer)", "value": "49b27dde80aaa402eba3b307abd102fbd0a33e47a83670b7445515c0eab6efe8", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667334, "uuid": "d6ca8558-3eca-43b8-8f83-e95e6edb7cdb", "comment": "Malware payload (RedLineStealer)", "value": "3a245bacee6b535ea4f9714f644b74505cec09bb", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667334, "uuid": "cc06d262-06a9-4bf1-a4bb-d544a8da2b92", "comment": "Malware payload (RedLineStealer)", "value": "55dc6427fc8da918c045f519c7fc30c0dc5ad0483f45c1345a961c8d932f6a8924f2e9ef693251390349451bc1a7dcd0", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667334, "uuid": "860df37e-95ca-4fbc-b523-a67de647a904", "value": "T1B7252313BADC51B3E8651B7494F302830B3BBCA18AB8D22A2349DC9E4D729956537377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667334, "uuid": "b1c02e33-c811-440c-b391-f77087b68aa1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667334, "uuid": "d8410bf1-785b-4614-a60a-99b929ebe483", "value": "24576:nyRIYFaABfq5eaqlxMawL+eHtdnB2TDnV++zgt5:yRygftaqPAgU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667334, "uuid": "d436f771-a19c-4873-ae7b-6b048abe4652", "value": 1046016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667334, "uuid": "65c13cb5-25d0-4732-8452-84455c3c6574", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667334, "uuid": "d8d63326-3c77-43e3-a1c7-de53141efbca", "value": "graphics423.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f57d36f-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1684680513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680513, "uuid": "1397d41a-432b-4c34-8156-6d8dca3693b5", "comment": "Malware payload (Stop)", "value": "89662c80a81d195cdca6cd68802a6c86", "object_relation": "md5", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680513, "uuid": "80db0b5a-1929-4eaf-87e7-96551ba9c396", "comment": "Malware payload (Stop)", "value": "49f59cd7879fcb6e138d11848bb8ec897574ad02195f53db51f73c7a3f4c8e00", "object_relation": "sha256", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680513, "uuid": "8051b51d-6146-43ed-8a70-92231726aac7", "comment": "Malware payload (Stop)", "value": "bd32195a714e55aa19682078d3aa0ea0bccba4a6", "object_relation": "sha1", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680513, "uuid": "8294fabc-c456-493d-81c0-d64b443e67f3", "comment": "Malware payload (Stop)", "value": "d1ef05157efd2119e3e8c5034cda5b3766ba24b3d40c8a18064c3e0427e10e24a20c3e46e16bb5268c00284e6c2a79e1", "object_relation": "sha3-384", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680513, "uuid": "2997a33d-d1cd-4dde-a7b9-a5c9b5738800", "value": "T19905F1037192FF77D55587718929C6B876EEB8618B012BCB32556F6B18312E3DAF2302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680513, "uuid": "5f61a180-104a-497d-9c63-ec4ff4db0518", "value": "40be65705a95a43e6733e98c1ce5e92b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680513, "uuid": "27e5d36d-500f-4a3d-a7ba-c8dda7b254ff", "value": "12288:gjcGhibCavuW8ISgi5mSaawzZrJyEDcGCkcseUDUNIc0f4fEsK:gHhib5+ph7+ZrJrAc7eBNh8sK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680513, "uuid": "4f82f7d1-6996-4945-b7fc-681fc7260228", "value": 806912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680513, "uuid": "1f4a3126-3f86-48aa-acc7-fd5a3b5bc392", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680513, "uuid": "19ccffcd-ee49-44f6-b5fb-d914e56d7618", "value": "app388.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f688cf8-f7ed-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684683359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683359, "uuid": "cd02c2f9-2b93-4e11-88e5-3f036b1571cd", "comment": "Malware payload", "value": "a2f49f4b26a49a79a0dbb1a1a9bedaad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683359, "uuid": "dbdb3a6f-4564-4140-878a-b51726c802ce", "comment": "Malware payload", "value": "4a50e74d3b1dc34207c5517af0ef632c463238fd087d37fc51b5c6cff0e03b72", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683359, "uuid": "c264d27b-9ff5-471e-8055-79858e454f84", "comment": "Malware payload", "value": "cdf7783d12a7abff2413df92312131fd78e76638", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683359, "uuid": "f9f49b64-abdf-4372-a02f-c53dc524c754", "comment": "Malware payload", "value": "0594af6c24c26a0f7421ef6ef25e35de398be620fad5da519c138dfec63f6717ed2e7df93fe6b52b25842f0d6eb59858", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684683359, "uuid": "1a9a8812-6b13-41f1-939a-94840ac5ee14", "value": "T1EB334AC4F543D8F5ED47057011B7FB379A31F1E91228D643D3A9AA32AC92602E91AEDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684683359, "uuid": "aaf871d4-389b-4799-bb24-ee93c5bfb6f9", "value": "1536:F9OtaT+xZhrExeqpwCsCeGUsDhPjGMa10pq3kUYG9:F9OtaT+hrQjWtfibL+iq0UYG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684683359, "uuid": "24975cbc-4a2f-4a5e-9be5-010d645f1f09", "value": 50256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684683359, "uuid": "1985d421-b577-4da9-b3ba-894656170e61", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684683359, "uuid": "7fb801c2-f093-43eb-97c5-14d343e5f071", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc252831-f7c5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684666415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666415, "uuid": "6cbc656b-faa9-418b-be49-93c2bb668c83", "comment": "Malware payload (RedLineStealer)", "value": "ccfe1ee9605128a0cb049e3478116c2f", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666415, "uuid": "7ba42698-1bd0-4c10-82f1-c9b01892438d", "comment": "Malware payload (RedLineStealer)", "value": "4a76fcbaed512bd829840b68696297605b0507f005e3bcb4784448c668385d89", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666415, "uuid": "b00cd4c9-e83b-4355-810f-4bdd225878b8", "comment": "Malware payload (RedLineStealer)", "value": "e5bcc0f1ea5876f4741dfe11d03106810d4c6c40", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666415, "uuid": "baf05a6f-7769-4d3d-9cba-842c95e1e526", "comment": "Malware payload (RedLineStealer)", "value": "db788d8b4e1fa855b4b47e3f53e704e502ef2caa3bb2d465b97961d3ba49b836743bbc9f6075662e8990ab9b72773a9c", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666415, "uuid": "2bdb6452-cb91-4f7f-ac5c-200564020372", "value": "T103252352AAE944B1D8F51BB48CF60783193AB9A19EBAC35F5341A9CF1CF3640753072B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666415, "uuid": "3e82bea2-1312-4457-817b-21684f6c95d9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666415, "uuid": "2253e296-a338-4437-b8e7-59fc8701801f", "value": "24576:ByJfFzsuaHlJqjwsvyXI7KRCuEkdx9OoTg:0JfFzsumKxg3rxT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684666415, "uuid": "024217c7-d75c-4faa-b8c1-e1c4c8c11cdb", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684666415, "uuid": "f365b9ef-8aec-41e2-b34d-6fc76b746777", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666415, "uuid": "adf6e3c0-49c5-441f-a9e7-c4557eed4c34", "value": "909000383.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7f82327-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684680689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680689, "uuid": "3aecf688-e934-4328-b15c-5de9f5e1bdbb", "comment": "Malware payload (Amadey)", "value": "9b2bcbb25259344da08fce45a4a41f8f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680689, "uuid": "ff084904-8f05-4a86-99be-25a9d0b93682", "comment": "Malware payload (Amadey)", "value": "4b03751f3e8ee05a01888c934e0546ca34d46df1d8cefe7530fe168c187b2f27", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680689, "uuid": "1ec37ca9-9dac-4c71-8918-6ea011b7d8e7", "comment": "Malware payload (Amadey)", "value": "b36565291d50752b94d5962a98483433b9262749", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680689, "uuid": "07512367-a02c-4286-b3a8-dd9cb52000db", "comment": "Malware payload (Amadey)", "value": "7927fc8c61cc697ac2db9aae963d3455d7f826c04498c23deb12c922fcb7962bf4f30f5f9997883c082a104cfa0a209c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680689, "uuid": "86d4cf9c-f718-4c43-be04-4eeae0c73c4c", "value": "T1B0252303A7EC9676DDB2533018FA06931736BDF549B4D72B2B81EC261C72AC4A07572B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680689, "uuid": "9278a564-8a39-4caf-8ede-38e2a7b2e9ed", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680689, "uuid": "bb15c708-60c5-44a7-80e6-0e739414466d", "value": "24576:hyWeOfWxw4q8mZPRyRLVqFcxEs+K+FU9Ph6O7KL:UWTWx1qTZsycxB+KEU956I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680689, "uuid": "72994dec-ecb6-45a8-9ccd-480038ab0b1a", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680689, "uuid": "a39aa492-a488-44d4-b5e8-2381dc318a01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680689, "uuid": "25eae015-c770-4b2f-a222-033aa5518b5f", "value": "utility141.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f5095ad-f802-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684692351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684692351, "uuid": "4d07b08b-0e76-49f0-85a3-335a095f88b9", "comment": "Malware payload (Mirai)", "value": "d8d732187b82c10ee10ca942f16f52d1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684692351, "uuid": "9ef5f79d-70a3-418c-a495-aad469773ab9", "comment": "Malware payload (Mirai)", "value": "4b135e5f2b67b2ebe723b77faf62abd76440ec4b3beec606719936b3c52df764", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684692351, "uuid": "87abc1c7-bc17-4781-b036-0802d0387970", "comment": "Malware payload (Mirai)", "value": "d48af3a52b70457fb8dbabead1ab87f3883d9896", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684692351, "uuid": "286a8b89-96a6-469e-a074-289fd983683f", "comment": "Malware payload (Mirai)", "value": "b71352e75f8ff14a9b21353837c28c257fd20d7b5b7a47bb940361baf10257899e3f5b79d94db06875b51a48f47aaff7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684692351, "uuid": "f0ba2b7d-f369-4707-b5eb-a67ab575d465", "value": "T190C2E795FC86A667C1D01376BA5F9F4A3B6163D8C2CF73039EA01730BA8691F1D22E54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684692351, "uuid": "c57d56d4-aa7f-4809-9337-e864a479d0fd", "value": "768:6Pzhw/XfEG5sTL3yjSHg3zJF+wFclso6:6rwXcG5svRkF7k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684692351, "uuid": "4bd2984b-aa50-4c46-a821-6d19baaa27fb", "value": 26868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684692351, "uuid": "27717e50-ab20-4312-b457-62d71fec17f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684692351, "uuid": "6a7db1fb-667d-471e-a36c-c6567b12d16e", "value": "d8d732187b82c10ee10ca942f16f52d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02a19689-f7b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684658373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658373, "uuid": "e0b1bbcb-d118-462b-9289-bb302af1d1c2", "comment": "Malware payload (RedLineStealer)", "value": "481ddd411f8c5fa2a63a95a5b1fac7f7", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658373, "uuid": "139d8fe1-5dd7-42ac-a102-e042212d5141", "comment": "Malware payload (RedLineStealer)", "value": "4b43ae8f0527cafad9fb1534d792eb5cc09fdb6db2aa397bb3434416755699f5", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658373, "uuid": "4603f039-e69d-4945-8a1c-1c4c05a5ee84", "comment": "Malware payload (RedLineStealer)", "value": "916ce9ee3bc8b97fae7c9ccac4a9240dc38c262a", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658373, "uuid": "12c93501-a490-4f22-9e93-1b35a473be18", "comment": "Malware payload (RedLineStealer)", "value": "7e61fa1a7d1837223ed4a7d620a0acd10e9b34fa418652c446c94c3fd0fb28f3d1345fa944b2d5f21e4ee05fadfc93d6", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658373, "uuid": "afbda76e-af31-4117-beff-0b19a91ea57a", "value": "T186252317BBD8E0B1D8B32B3098F60B9306397CF54D7842EF2365AD190D73695A972326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658373, "uuid": "6770329f-6cb9-42fb-a7c8-8034aeb15dfb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658373, "uuid": "88e063d7-fe1f-4219-831f-e28bab649914", "value": "24576:KyDmgXItHwz1q7JITrwdcSu84uEtMAdi:RDmgXItHwz1qVITrwdch", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684658373, "uuid": "c7f514cb-3b25-4087-bec9-6a758ab8ee22", "value": 1047040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684658373, "uuid": "7e0e3203-1cb3-49b0-acfd-6723ad28b794", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658373, "uuid": "e0f31736-c876-42d3-a5e9-8bbc3f3497f7", "value": "2332324551.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc5af4cc-f808-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684695299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695299, "uuid": "cbce26dc-6d3c-4ef9-9fdf-a1f868ec9c4a", "comment": "Malware payload (RedLineStealer)", "value": "17cc2a645ede65f983a294ceeeb13198", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695299, "uuid": "902701dd-7eac-4705-a5a9-40efec42b267", "comment": "Malware payload (RedLineStealer)", "value": "4b7480329a21a3fa3ca7e9b4f897f0b5851088cc0578c4bcde9bb9403f0ff044", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695299, "uuid": "dbdda11c-e9a3-4b45-a06c-83f6120f535f", "comment": "Malware payload (RedLineStealer)", "value": "edb2cc732904fcb7cd6e96726ad3344b87845083", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695299, "uuid": "8561d86f-8251-471a-a4ef-7eb3cb1616b9", "comment": "Malware payload (RedLineStealer)", "value": "c8465e3e3ed0ee426a775c631a659a293d2c177a3cc9165b824c5c4193d7bebaaa96d25b37c34aab10c03e6498482771", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695299, "uuid": "52f3df12-7435-431c-b5f2-7d0060ad8534", "value": "T125252342F6C99166E8F72B3428F702C31F377D80E67CD26B2695996B0D72790A830767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695299, "uuid": "89d6b9e8-253c-40f4-b0cd-595544072284", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695299, "uuid": "2815dca7-be90-42cb-9ca9-14a53619dac0", "value": "24576:CyzQFbr9fuPESPJT1wxaR9QCHragboxBSv4K96O:pzQh9fuMSPpWER9Qezb+BxKc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684695299, "uuid": "3c88cabf-3362-413a-842f-6bf07273ec16", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684695299, "uuid": "d7d1a72a-493a-4957-b2d5-368bde08bca0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695299, "uuid": "6fd9e36a-e49b-4c31-9e82-c19ccc6f752e", "value": "formatter957.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edc7e282-f815-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684700858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684700858, "uuid": "18233eda-4504-4c3a-86d7-816d0489168b", "comment": "Malware payload", "value": "0fcabff10f0b3659aecdcb536e685377", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684700858, "uuid": "67f67165-63b8-49d4-a8e1-695d9e014310", "comment": "Malware payload", "value": "4c0f274e3694fbabe53bf4160108b37353cbe110eab6effadfad8dc1f868d49e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684700858, "uuid": "86a9e208-caba-4103-86f3-26ffbb1677d1", "comment": "Malware payload", "value": "fd1f72d74a65ea4f71fbe98acf5a6a84398632b8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684700858, "uuid": "af2f31bb-af83-445d-9456-d2aaa94d3d09", "comment": "Malware payload", "value": "3de79b246d109c9318d8ed994feac0c68df78200debb738a58654153843f0f6952b6b4189dad245ed2c3c52380d93888", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684700858, "uuid": "4c9d699f-fcfc-43c4-984e-7a2da29d70f2", "value": "T127C5017AC560E060FFBDC0F6883D5FC275781E8501FF6326495BAF7171B21A8A69BA40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684700858, "uuid": "1b764144-51fc-408d-8a5a-49f17d403eed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684700858, "uuid": "bbe3dfb8-5a4f-4252-a329-5524b451bac6", "value": "24576:FCXYEopBLD+2pIRPAo+V0z68WEZYcsl12gwpU7ng4QLCKnv8hfiF+IoHOWZ2wvxI:SFnPAo+S28BZY3lgg97ngB+KIIoHOWD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684700858, "uuid": "b1680412-20b8-444e-bea9-95252019780d", "value": 2500096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684700858, "uuid": "c7b8ba01-c5d7-4f2b-a0d1-394af5b75ff0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684700858, "uuid": "916e0db6-c8a2-407e-91cd-800bbcf9ff89", "value": "0fcabff10f0b3659aecdcb536e685377", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d7b5559-f7b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684658472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658472, "uuid": "5cad6766-7cfa-4e95-aea5-f518f786bdae", "comment": "Malware payload (RedLineStealer)", "value": "653597f0c88296ad03475431fb98fe20", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658472, "uuid": "25d4faeb-e740-4f82-aaf6-0f844d6bb553", "comment": "Malware payload (RedLineStealer)", "value": "4c5d2f5c702b85bb6deb6cc426597e27ffc4bd3b3b141ab756d89db3ccc8e75e", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658472, "uuid": "5be4a3a5-a65e-4786-939e-01feaeaabfce", "comment": "Malware payload (RedLineStealer)", "value": "dc66ecb81d3eea01e1a120ade3e561e3304e6e4e", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658472, "uuid": "995df133-0c5c-4df3-9f57-85f097d4bdcf", "comment": "Malware payload (RedLineStealer)", "value": "f21b311560c2f6ec6310cf2597e76e728c9e75760ff170277547374e184187a177555bbc528fe00456e69643c9428271", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658472, "uuid": "eb01800d-82da-4fcd-8f23-e20c894b151c", "value": "T1ADE3D624379F8930E6BB4D3D6CB09CC076BCAC126552D74A4ECDF1593A73B809B216B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658472, "uuid": "775389f7-4e9f-43fd-a030-4a4bbad28270", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658472, "uuid": "84ee7f1d-4559-4757-9a5f-b73f58cd21ef", "value": "1536:o2BGlTP+mZP61sEYDmRSNIgcscLDuRwH77+u8oxQKHbuxGBNM740wuei/Qv+R+Fn:6V+m5cvQmRSN90+82iTi74h9ZF8e8hU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684658472, "uuid": "78c07b2f-b76e-42fb-9963-ae27911f2d3f", "value": 148586, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684658472, "uuid": "ec1beb25-490f-468b-aaa2-c2d07b98625f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658472, "uuid": "453c0aaf-c447-4d42-a13a-12ede239049b", "value": "processor121.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef804f44-f7a7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684653616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684653616, "uuid": "9c5db6dc-1f5f-4e8f-8739-b10979a43fd5", "comment": "Malware payload (Amadey)", "value": "50030ec9738af2dafbd99d2d5fe3fb63", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684653616, "uuid": "95320d98-b4fd-473c-9986-86bfb1d03f13", "comment": "Malware payload (Amadey)", "value": "4c77f0c0d79473ceb6da0b94feb6a0cdc522417f25fc77107c2163f3c5583254", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684653616, "uuid": "52632635-8d22-4243-a9f3-57fd244086f6", "comment": "Malware payload (Amadey)", "value": "2a78cdaa0514d3877c9907c312af978369a86176", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684653616, "uuid": "d9fb8726-a5fd-4cf0-abb7-81eefeff82d0", "comment": "Malware payload (Amadey)", "value": "5ae7c6f7d20deffda2e136e7d9ea14ce303161e281b86154154afcc5a196802b5bad7d6216afe694160385f0702ce654", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684653616, "uuid": "25e4b6a4-0c1a-4a0b-929d-6d6fcb5f57ab", "value": "T1DA252342AAD82431D8B1337458F606E70B38BD515E38C6BE3346EE5A5D33D98AD36723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684653616, "uuid": "c73af051-038a-471d-9c5d-f5e4dc781e27", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684653616, "uuid": "e7854917-0ad1-4e1d-87a2-b862382bdc05", "value": "24576:dyvNd9Ee/BGxrNrqMYdsSqGVkai6DXoKZ/W+RObgEIJ56:4Vd9EgGvqMYdsSqGVkl6cKZ/1ROlS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684653616, "uuid": "eb8d93e0-22be-47d1-bed9-c2b24aabb8b2", "value": 1056256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684653616, "uuid": "f6374451-bf96-43ff-a499-fe66c6d80393", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684653616, "uuid": "e4e9d712-285b-4e02-ac2c-01b788bf9c66", "value": "50030ec9738af2dafbd99d2d5fe3fb63.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f693eb03-f7c5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684666513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666513, "uuid": "1c33729d-5330-440d-97e8-7c8803e0660f", "comment": "Malware payload (RedLineStealer)", "value": "4a1f639907406e75990f5929b6c5b0ae", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666513, "uuid": "e027dba7-7b85-4ad5-9b9e-e4492f5cddfe", "comment": "Malware payload (RedLineStealer)", "value": "4cc2d24e6893733a9a4b226e7e03cb99c27434407b7518d694e82a0a18ddc8fa", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666513, "uuid": "ed57d7f4-94b0-4d12-b15d-221cf46da1a1", "comment": "Malware payload (RedLineStealer)", "value": "ba6b1188bf9adcc35d9be5521fa1d1c9e0bc90dc", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666513, "uuid": "2e5b9550-473a-4e58-b6f0-206b64529a12", "comment": "Malware payload (RedLineStealer)", "value": "5a10e7f927935d6cb4a8d3bae3db7f1bee43b55fa731c32b74df32222458a089036dfb788b805bfc1fcc43ce6ad350ee", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666513, "uuid": "ebc04337-dc56-4f43-94e0-f7d839bbdcfc", "value": "T1EE25237BA6D89033E87237B068F62AD3073A7DA14DB9432B3748788E5D33A404576767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666513, "uuid": "7334dc74-bcf7-4091-aaf4-8ea1840faac5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666513, "uuid": "68347634-9729-4564-a323-3f4b1da2a661", "value": "24576:8yFDi94GLmObwqVUo4aBiq03cohKAfyq2OihEtYiWv:rFOb9EqqorufSOihEx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684666513, "uuid": "39ef1791-79ef-481d-9b61-b42b8fa1e36b", "value": 1046528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684666513, "uuid": "72b9a0e3-e075-4a92-83bb-2f42466e2e2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666513, "uuid": "3a043fe3-f2f7-4ac8-bc12-912a41549857", "value": "discord_token192.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e96f524b-f7d0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684671215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671215, "uuid": "988654ba-28f5-44da-b91c-ce1cb6a1e835", "comment": "Malware payload (Amadey)", "value": "8d3453ef1b3382d344e18c028018a174", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671215, "uuid": "35ef243d-0c8f-4be7-94cb-b0eda0c33bde", "comment": "Malware payload (Amadey)", "value": "4d0e97fe5e0ff32be0a5209b04d5964b883347d7c3ea65f45e5eb225c1de4e63", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671215, "uuid": "1cd5097f-65b3-49c3-ab47-0fb57308bc29", "comment": "Malware payload (Amadey)", "value": "e9069b1972943317ea7e3716eba17454b724669f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671215, "uuid": "e18e208c-6c01-418c-befe-18e372fac12f", "comment": "Malware payload (Amadey)", "value": "cc96e9da69659752f007de2c66cc39fb402eb5e8d04da2cfaeb441c6bae1167d99a43b73d0e58d9a3e73e97d49beebe3", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671215, "uuid": "1742e43b-04f5-48bf-9fd6-2000e553b3db", "value": "T11D252333B2D54433C8B853B069FB42D31A78FCB65D78867F62056D9B1CB2690997233A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671215, "uuid": "55b780f0-3860-45de-bf8c-f835dccec6cd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671215, "uuid": "648f881a-1861-470f-944d-3cdf76466913", "value": "24576:6yWYnJlKK1jwzqd0vLoN/ZCnM12Yu1vHo0UEezmeNtIy:BhJwwwzqc89ZKM12YMHNcmeNt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684671215, "uuid": "ea1454d2-daa5-416d-8cd3-22fbe39ac81c", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684671215, "uuid": "2f8b9597-c643-4814-849e-7e551548d360", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671215, "uuid": "9672259e-fb6b-4b06-8a6c-4528698825a7", "value": "Temp631.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac3642bd-f7b1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684657798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684657798, "uuid": "da01ea86-700f-4ab6-bde4-aaa86730e30b", "comment": "Malware payload (Amadey)", "value": "77a054d107cbdb7205f9a6469c0fa61a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684657798, "uuid": "f0df0c69-a81f-4db5-b87f-f115bac786d8", "comment": "Malware payload (Amadey)", "value": "4d2e80618bf17a4bbe858267c01c962a8823c4c5b21ddadaa133d161475f8614", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684657798, "uuid": "91e85e96-d4a6-4017-bc3d-eedc724a1950", "comment": "Malware payload (Amadey)", "value": "5d2ff3aa025fcb4bdfcf270a88a5d19b1f9b43cd", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684657798, "uuid": "77a2c523-5a72-440f-8e4f-ad98da1f0e7b", "comment": "Malware payload (Amadey)", "value": "d890822a27f4d884f7d0d53c69edf432fd4486a33f51c429f0d13e073c98b96beeb58b8447927f44f5947f28e9a20615", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684657798, "uuid": "7eb1f889-e49a-41aa-b6c7-f701d9b47197", "value": "T186252303EDD88023E5F45731ACF65B932E32BEE19E6983667B805D1B1C72684E532763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684657798, "uuid": "32be57c3-cc71-48dc-a853-3575d01f768e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684657798, "uuid": "5e80613b-8949-49c1-a133-2df6547cc421", "value": "24576:+y/j4OZnyP2j79zwhigZh8dWx6eejxHrv7us4aD:N74YPjZTgj8e6eQTUa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684657798, "uuid": "2a396763-23a7-4a42-8fb6-4d51192f16d1", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684657798, "uuid": "45978d60-57b1-499b-8a4a-5e78c92bb3f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684657798, "uuid": "6cb2bcd7-c481-404d-b965-c788fa121396", "value": "909000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "057aec50-f809-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684695314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695314, "uuid": "ba5cdc31-3869-4790-a6b7-d0afbcb09fe4", "comment": "Malware payload (Amadey)", "value": "9685d7c396a16d38106b2ad09c258e31", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695314, "uuid": "7dc7a8f8-3866-4367-8324-282e8abe1ce1", "comment": "Malware payload (Amadey)", "value": "4d721b2c5b5ea2ba718ebe7a7e61a134aec870acd8fb1e6a8752889b66173036", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695314, "uuid": "15dd9acc-8584-4622-834b-12bf0213d7ce", "comment": "Malware payload (Amadey)", "value": "51535b5a59bc1996929378c2ef0dc209f1355913", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695314, "uuid": "7bdc2807-3a6f-498e-8917-489e1425e78e", "comment": "Malware payload (Amadey)", "value": "2393c884992f880afe5046eec3357659706cf41f6229f88afbe938554a29bcead88dfa84f50968170b2b29eb9ea436cb", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695314, "uuid": "477629f1-bf34-42da-86f6-498c0890d0e9", "value": "T11B252352F9DA9462D8FC63F01DF943D30B32BC659A3883673202919E1D732D6A570B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695314, "uuid": "697afe4f-9473-4b49-aa0d-fa2380e6f917", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695314, "uuid": "710ef7d6-47b5-4306-bc79-e7ea81d18a44", "value": "12288:DMrzy90L7K83nXGs6WBYT2rdJv8leiyxjZH4RrfCES9cQpq3Als00QfgzAEM3Zd3:cycESwgrvKery2POQpNZdcMN6y3XUQh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684695314, "uuid": "ba2ccf73-1e80-4ca2-b373-ae499f60909b", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684695314, "uuid": "5d47c2b8-5f5f-4176-9ea6-aa7a7ee0582f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695314, "uuid": "2ed3cac1-110a-4107-ac0f-b6bc6c8474c6", "value": "launcher675.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "839bca63-f807-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684694667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694667, "uuid": "7648bdf3-ee19-4c5e-ab4a-03090ad43ce4", "comment": "Malware payload", "value": "639a462f401e756dc2d4932e5817d182", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694667, "uuid": "f0dd3d73-e17f-469e-bbb2-2f9d57121a75", "comment": "Malware payload", "value": "4d7f1d8e58a68eeaa131397babf259322e62f3e336bde692e155f700081e1047", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694667, "uuid": "ba442dec-55cf-4771-a46c-ab64462625e7", "comment": "Malware payload", "value": "d7fb8aa1369504607400eba1fd67fd739e0a3bde", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694667, "uuid": "56932683-587e-44c5-93cf-650b7aa1f0b0", "comment": "Malware payload", "value": "46059ce03953b71520a4ecda32f4ce5878509040cb2ad29f3c6a65a40f3f4720de91bcccd2be645d6082306590267af4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694667, "uuid": "a10be6b7-6ba7-42cd-9ea0-a9421b8aae25", "value": "T140252313AEDCC071E4B1177009FB06870A35BEE1AE34876727C7AA4B4DB2598647277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694667, "uuid": "cf6cd5be-6289-4459-b774-8231e0b47d5b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694667, "uuid": "9d1586a7-58fe-4ba2-9de2-30fec62e133f", "value": "24576:7yBqg57br2UzveFs7q1hvdDg+fT6S+7dzjqabs6RL:u8g9br2UKi7q1hdbN+7tqb6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684694667, "uuid": "c919600d-89c9-42c1-8f7e-45b93e66b3f3", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684694667, "uuid": "c36d8559-03db-49b1-b933-e5e902af2932", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694667, "uuid": "2c34fb69-c2e2-4f9b-978b-81c1ab94b649", "value": "2482860.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e2ac00e-f7b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684658419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658419, "uuid": "839f346f-a535-40e9-b1e5-36b381d56881", "comment": "Malware payload (Amadey)", "value": "96d68579239e7abe5604975ca912b5ef", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658419, "uuid": "3016405c-5f6f-46cf-896d-653e01867c12", "comment": "Malware payload (Amadey)", "value": "4d8dcce211eeaaf2bcde633fc425e00a688d3f2e9f49e07d311707a0fa5320e0", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658419, "uuid": "8fbbfa7a-f693-4588-97fa-94f2d6322441", "comment": "Malware payload (Amadey)", "value": "624aacfd3a6b5e087b1045dbe9e496b539f71d91", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658419, "uuid": "f0dc32be-d4fe-4242-8766-fe7fa9adf31d", "comment": "Malware payload (Amadey)", "value": "6daf2cbbd614262a1ccf5198a7479bb99ee2a5cb415c73ef7f073bd1835360c1bc3933b47722c30840401e55f31b9007", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658419, "uuid": "bc886087-24ad-4213-bac0-12fbc11e7b16", "value": "T104252312E7D98072DCB50BB088FB03930A75FCA2197D936B2B9199AD1CB3954B53533B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658419, "uuid": "a51d186e-537d-497e-bd68-c45d062795e0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658419, "uuid": "9976d387-35f8-475c-8ce9-232731f4e833", "value": "24576:yyLsh2a4yTEFIr8ycgB4sb/aE+ecCLVXxXB0/On5KmBBGIedTrsdp:ZAhzhEFo8wbyrt0VXDf5KGGrsd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684658419, "uuid": "718efb31-fad5-4eb8-a657-2a59457e9992", "value": 1056256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684658419, "uuid": "f1e83dde-c293-4405-a309-8f2e7c7b1876", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658419, "uuid": "1f021fd4-3270-407c-806c-dfaf94e9d0dd", "value": "client121.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e24bc815-f7c7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684667338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667338, "uuid": "223825f6-8d57-4388-a899-684f8f0a7020", "comment": "Malware payload (RedLineStealer)", "value": "fe9fbbf642164c8749137c05e6199fe1", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667338, "uuid": "f3b31907-88c3-4812-bdd9-ee3c0d1e3880", "comment": "Malware payload (RedLineStealer)", "value": "4d935f187e3f7ec3bd513791dea85808d735ac3d2268d24c7c4100ac36234a05", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667338, "uuid": "c101ff21-cd6c-4ed4-831d-51bd9aa48e7e", "comment": "Malware payload (RedLineStealer)", "value": "abf23c5383374d42e9e9176ebea461e8f28a6a23", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667338, "uuid": "c0bc5db1-c273-41f2-8ae5-1e9f52838633", "comment": "Malware payload (RedLineStealer)", "value": "babf469cecc7378cb49229e2e1b5ee5e0e429dbe18018ef8d330e5e76650957462cea1c31ee9ad7b7feee8c5231e82c3", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667338, "uuid": "b979787f-b379-4a40-84b5-ad8da8e02663", "value": "T12B252306AAED0473C8A10B70A9F626C70A75BDE16E70D31B3781E56D4DF2959E83133B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667338, "uuid": "b37b8902-d722-426e-b367-364eea730346", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667338, "uuid": "7f2efe35-65ba-47e3-a380-406db8092534", "value": "24576:cyQmSDZc+ewcQYxbZdxL0ohbVKbZwoDA8jUXsxGct9X6:LoDZ7LobFNKrMmUXOG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667338, "uuid": "3efd3697-5e3a-4933-aae3-ccd5fd8f0ff6", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667338, "uuid": "02eb19ce-84f0-47dd-8e99-f1fabe1cf13a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667338, "uuid": "e976d8b1-17f6-4f5f-b71f-e9704c3be2d1", "value": "installer593.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e08004e5-f81d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684704272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684704272, "uuid": "f1ca0048-ef7c-4b4b-8dc5-b03f9a0c5975", "comment": "Malware payload (RedLineStealer)", "value": "b27fb2bd4b4a839c5f89f074f174115d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684704272, "uuid": "33ef5756-5946-4ad3-a1d6-7d543e305dc9", "comment": "Malware payload (RedLineStealer)", "value": "4dca5e3abeffd6afbcdd382f365a74a685881959eb119c058f12e21cc0968194", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684704272, "uuid": "3c27206d-aa13-49e7-bad3-cfd67eafc0cd", "comment": "Malware payload (RedLineStealer)", "value": "3d86b00f8bd72e8b7ee9296f5309fb1c10fd9951", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684704272, "uuid": "abb85aaf-fc3b-4d38-b05b-99ed70799e94", "comment": "Malware payload (RedLineStealer)", "value": "145f20915357e3ff26db93d21d7f373b4192191fc70e67164ac44042c182a2ff246577a99ae278ccbb10ed2f7bbc8439", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684704272, "uuid": "c5f17459-df34-46e3-824f-8ac2ccb7a747", "value": "T154645C23AA868035FC2B95F847C699B951EC79701B9F40E7EBF59FDF4D90AC06620207", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684704272, "uuid": "b715e2c1-91a6-42d3-aced-6969fdca7c04", "value": "b46b7655f5ed701dbc7075afa681ec5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684704272, "uuid": "8ef4260c-2d69-46b7-8456-577df42dbd16", "value": "6144:TsEoNr4X4MlEZxkiSpYzZ7NT1rIkt56HkI:h4r4Xsxki84N03", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684704272, "uuid": "4cb39340-a0e9-4642-af48-0748c74e3081", "value": 316688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684704272, "uuid": "64abef11-7257-4dab-b147-f27885bf142d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684704272, "uuid": "7eb06c1f-9231-4bbd-a61c-0a732c1b43b2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f353529f-f7d0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684671232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671232, "uuid": "ea22e9a2-ced5-4314-ae98-774ac8aa764e", "comment": "Malware payload (RedLineStealer)", "value": "a0f73fa4a6ee133e60c3b41689e1bc58", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671232, "uuid": "86f985f7-b79e-468c-9ef1-62a9a4f0cc8b", "comment": "Malware payload (RedLineStealer)", "value": "4e934d60bcd0d3e341625334a7002b2d3b42887438fbb7c4ca36859ce466a9ea", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671232, "uuid": "29f7e8e4-f05d-440b-ab24-663124ba0d58", "comment": "Malware payload (RedLineStealer)", "value": "279e85096130802f55bf2155ced761a3ddf5aafa", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671232, "uuid": "e3c4c407-e2af-4a48-bc66-4f102430eb29", "comment": "Malware payload (RedLineStealer)", "value": "b6b11422dd01c9fc62c2ad5d65dcc9738fc70bc0a0bf5965afbdf22f53f67ca151ef6203f19b42fa7bf04783a28753ba", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671232, "uuid": "bf6bb90b-d4bb-4873-82ca-c412c2879382", "value": "T17A252307FADC9477D97227B088F507970B32FE70C97497AF2741A81A4C322886579BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671232, "uuid": "9662a3f2-c262-4e4a-9bf9-c2cb9eb35242", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671232, "uuid": "46ef4f96-c0a7-4df8-bf4b-c1bb55bc9f71", "value": "24576:tyKmgkHIq99qV1tT7n/lQR6V24VvfatNIPGU:I64IoqPtTLl30wJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684671232, "uuid": "9930eda3-1f9f-4d4e-9bc1-3d5c144d2d5b", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684671232, "uuid": "0c1e4e68-1ee4-40a5-b58f-fd1fd41e42e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671232, "uuid": "7008b03e-10d8-40b7-bead-13e84fbe06cd", "value": "engine827.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "895231e8-f773-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684631111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684631111, "uuid": "864762dd-4d4f-4030-b017-a6c27a7c211a", "comment": "Malware payload", "value": "822d1ee1e100a031258ce084051a7211", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684631111, "uuid": "3bc90ac6-0405-4cad-a95e-333099e3a557", "comment": "Malware payload", "value": "4f51e02a42c5c1029b84b4e73ab8a3ec4634fb6b819c22cf978599ba14107ee5", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684631111, "uuid": "14d665d4-f2af-4aa4-8614-89c0dbccc64b", "comment": "Malware payload", "value": "8e462f7bc57611267e553c81ba796bd57f59a7c4", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684631111, "uuid": "e3c7c964-b90c-4421-b24f-d32176a479c1", "comment": "Malware payload", "value": "e766a71a04201c39bb74f90f53aedbda0718dcd31c465e691faec7382fe2ec71747975805110eef8d512845e8903ed70", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684631111, "uuid": "ac64dc3d-d76b-4b6b-9f65-76cf40e13069", "value": "T1E6864B2B5596B6A5E0E123338BD593C19194B23B3E602CEFACD5AC481469DF343BD6F0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684631111, "uuid": "37db8f02-1f9a-40b4-98c2-675ff372dbc0", "value": "c983ca29445c3b0f29b987d079b73fc4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684631111, "uuid": "0e6af475-f040-42d1-b0be-69adc0a75f9d", "value": "98304:zrdbTWwfdcfxxQgcPEXFEoVgQjA7XPFIqbfvC3LO8+Ye796JZmhrq:zdzdkxQXs6u0XzbPoe79Cmh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684631111, "uuid": "f5bee482-23d7-425c-8e98-b60e9289d7d4", "value": 8078336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684631111, "uuid": "9891d568-903e-4518-a60d-e9dd9751e789", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684631111, "uuid": "012c6082-4360-47da-ac65-77965e1dc12a", "value": "822d1ee1e100a031258ce084051a7211", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6330c4b9-f7e5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684680010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680010, "uuid": "37df3fcd-7743-4e5a-ba56-54367b64ffd4", "comment": "Malware payload (Amadey)", "value": "6ed0180f02b281318901c1efdbf48e71", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680010, "uuid": "5e539993-96ac-41f4-b846-e1ccb43d8219", "comment": "Malware payload (Amadey)", "value": "4f539c976bd640e0f88e8275e2202de2cc7ebaa3e35f3f78ab3f40c08e81de10", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680010, "uuid": "9692d28a-d231-419b-b619-cae67dc96f34", "comment": "Malware payload (Amadey)", "value": "5a20a9d76e7dd34434da543349d07305925e1ccc", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680010, "uuid": "4bd4ad54-7bcd-4233-b26e-0fe89644820d", "comment": "Malware payload (Amadey)", "value": "62d9ba200d89cde20b37a61437f1b2e18573aae99e3028f0ac87ccf7c81c908b5590499082b108b11237a20ead70d69f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680010, "uuid": "a4c62f9c-7d58-4465-a717-399506869ade", "value": "T174252306EBDD5076D8B5237190F302030A72FCF19D74A776278658A96DB3388D9723AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680010, "uuid": "5d9facfe-b3aa-4d51-ab15-539e7d768292", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680010, "uuid": "27dbbb09-04e0-440d-89cb-5c27d8113d1a", "value": "24576:MySGmWErs7b6q/aZB147l82QbvzzTdUYMlGb8QYFNipyY:7phEw6q/Y147lNQbv3Tjmfip", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680010, "uuid": "921a483a-4de6-4519-8783-5de73e03b593", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680010, "uuid": "e73b9e94-2952-4d43-8544-769c70800d81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680010, "uuid": "d799732f-072e-4e98-b364-dea34d3f4cf9", "value": "calculator799.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c15567b0-f7ec-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684683174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683174, "uuid": "9750cf96-297f-46af-b284-bf10f460663c", "comment": "Malware payload", "value": "3a419f2232d7987f7d46420fec9ad87b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683174, "uuid": "5c96db86-5633-4bdb-84c9-58f77fbaf019", "comment": "Malware payload", "value": "4f5779012a882299c2e465178b810d5ffc687c44ef2fd02151f10b520cca3df8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683174, "uuid": "c28c402e-6800-4865-8171-ebeb0db91326", "comment": "Malware payload", "value": "fa81a63d90d7e138b0e67b3c0b3be43091e40e08", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683174, "uuid": "6ec38043-817f-45ee-b593-49576edc290d", "comment": "Malware payload", "value": "95b6408555b6da23f8843e49e0d2c2f982880e2173a0596dd044b503bf894b7fdc5590b2ab2e5fc8bebfb2031fd08ff1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684683174, "uuid": "ac08bb4d-e4c8-431d-bca0-ed88536c58b5", "value": "T153F38100B4DA367AC4A711FE1CAB7D46AEA07739306388FEFCB639B95950140B44E57B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684683174, "uuid": "7a2a3e12-7ef6-49da-a47d-847b917127e9", "value": "3072:tuszqf8wvphtZJcySXokM6atDGN5W4Pdb:tuXf/vftZ6yMokfaRsRlb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684683174, "uuid": "ca6fd45c-d72c-4cc4-b306-b2b91d817166", "value": 162520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684683174, "uuid": "a4e715dd-e286-4ca8-ac10-276df5f97c2e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684683174, "uuid": "205c50d4-0f4b-467a-be38-00e46810589f", "value": "3a419f2232d7987f7d46420fec9ad87b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a580344-f772-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1684630549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684630549, "uuid": "8781ea0c-30c1-4a1d-ae20-0fc9ebbfa216", "comment": "Malware payload (Stop)", "value": "3ba08fbb193152fd4cbab8a1d8ce8a15", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684630549, "uuid": "52fe0fa0-aea0-428f-8fab-dd28d103515d", "comment": "Malware payload (Stop)", "value": "4ff28482116fdfc17af3411d3f74e98c7cf78339a9c701b21e6bb04ffe407188", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684630549, "uuid": "52421516-9a23-4be3-9959-a40799b9597b", "comment": "Malware payload (Stop)", "value": "4265d391a235cab1441a83b1f4deb0629a5ea72e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684630549, "uuid": "16c54c63-6d68-4a54-b99f-9a3414d96fc5", "comment": "Malware payload (Stop)", "value": "8595a242a080ef98d337b75c43ce1e2d38cf4abadc065a253e77af783d648b03d8f2bf5b6b6ecb8f5a6b17aec28de91b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684630549, "uuid": "d3a9c1f0-0b36-4b8c-830c-d6fbebdd5f52", "value": "T19C050223D1D0E87DE5654675CE2DC2F8251FB861BF252BCB62182B5F19322E2DA7B301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684630549, "uuid": "06b04a75-bb4d-4cca-b323-d8398d6e8e3f", "value": "dc368f441a884fce22ecc585e2bd5326", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684630549, "uuid": "270dfa95-5de5-4658-aaf3-5655eac76f1d", "value": "12288:Jq5WClIelgTdYpe2Ku+r/N+KsUJzGq3fXoOEN07lutWclPN5z:Jq4ClIeuTdYpe2gnsaGqPXoOg0QtBV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684630549, "uuid": "65e1bf58-fdb0-419b-8688-f805dde5642c", "value": 812544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684630549, "uuid": "113e5c12-07c3-4f21-8b1b-e23c6047eb8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684630549, "uuid": "58fa1b22-7d58-4a1c-a00c-eca8f40b4b93", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6ffc757-f7c5-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684666433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666433, "uuid": "1994c16a-0100-4bfa-8e96-a42757e56fb5", "comment": "Malware payload", "value": "71193fb5ed92d1bc2cae2b36708a7db2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666433, "uuid": "62ee8400-c92a-4df6-8514-4ddc1a54ab1b", "comment": "Malware payload", "value": "50221fb24bd67ab5543f39194ca3d619b33b6153b452143c9a6cba1dfdc61246", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666433, "uuid": "a19cb786-3a4b-4d7d-9add-7997f02f1240", "comment": "Malware payload", "value": "f992de9a34fa43da22837a738457e6a997f285f6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666433, "uuid": "decf352f-f263-476f-adc0-77f5dc2beece", "comment": "Malware payload", "value": "c261f4d6a98b2ab79771e78bfd64b306da387fd3c5eb965a796f43771d0c519886e1f2ee4fb9ba5a772e38f6475adeee", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666433, "uuid": "316bd97e-faf7-4f1d-b0fe-cac19e7ad4f0", "value": "T190836B22BA361E23C0D5A07711F78721B6F053CE25A8C62E7D720E9EFF255406587AF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666433, "uuid": "7cb4856a-9f8e-4974-8636-0d72971a4912", "value": "1536:+xR2+EIh/3HPqkZVwqJ3L/dY4QvLhAAlT5BI2tB/wbZn2R:65ZbFvaFlNBJ/wbZn2R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684666433, "uuid": "7fb6a8f8-d153-4084-93ad-32da7390c71f", "value": 83984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684666433, "uuid": "97f6a291-371f-4948-9d8d-a62a7548498c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666433, "uuid": "41d326f3-c199-4c1b-8a11-c25742c41eb4", "value": "71193fb5ed92d1bc2cae2b36708a7db2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f1b27b5-f772-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1684630477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684630477, "uuid": "0128b19b-5c3f-4f6c-8c8a-0b41ed4e62bc", "comment": "Malware payload (Stop)", "value": "86a84cf5b2bf1ed5ff4c8de9e1b03f23", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684630477, "uuid": "acd3d7dd-256a-4b50-b6b5-c616ddbcf434", "comment": "Malware payload (Stop)", "value": "503ce4f0ef62cef18901ed98e96445f260395827252b40f001071463c128a6d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684630477, "uuid": "dcc1e55e-d026-4fcb-8d8d-8d5151156df4", "comment": "Malware payload (Stop)", "value": "1df9fd236581bfdef284bc94576e23ba28e0f54e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684630477, "uuid": "dccee454-407b-43a7-a8f9-1bf137a38721", "comment": "Malware payload (Stop)", "value": "bb96dca7ef0f9d64b18c09a26a5297943f6fffa0d123c6cab35833de161f7b471843b794ab6332b6b90a83ea47016499", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684630477, "uuid": "abd756c9-30aa-4191-802c-aaf09119e643", "value": "T105050222F1D1DC65E9564535CE6EC6F8262EB8617B591BCB33047F6B18311F28A3A30B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684630477, "uuid": "df91abee-fc21-4a18-b5c8-3f91d3a5c064", "value": "dc368f441a884fce22ecc585e2bd5326", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684630477, "uuid": "c3411764-ec08-4446-a88f-f3e2dd7eac2d", "value": "12288:11+bQf5xFafxmP1gRvSxBtG0AjD1k0yAfIE7RREdcCECzu:11oQfofI106A/ZkzAZSdcCE+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684630477, "uuid": "0c9a9410-763c-4d8a-a0d7-2e0765f70a54", "value": 813568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684630477, "uuid": "72e1e3c5-8ed9-47e6-a1d4-ed074e5cb061", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684630477, "uuid": "6be93528-7090-48b9-9838-872674b16ad8", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91590b94-f7d0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684671068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671068, "uuid": "cd3a6c53-d3fb-4c80-9d7a-ca322715bf67", "comment": "Malware payload (RedLineStealer)", "value": "606a569ae9742ee33034e0a0c0011d0a", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671068, "uuid": "871e7b94-b18b-4880-bffb-c4781b0af718", "comment": "Malware payload (RedLineStealer)", "value": "5076a1cc81c8b78c7d30b3bf65a8ae7945ee2e89013c18ca03ff90f55251c6fa", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671068, "uuid": "d044d593-968a-4cef-8a03-ce9c9bd4c46c", "comment": "Malware payload (RedLineStealer)", "value": "0864a699218b519796302769adc22704dd9357f8", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671068, "uuid": "72a5bd31-9465-45cd-8ad0-c32c6aa633d9", "comment": "Malware payload (RedLineStealer)", "value": "8a008235f63da210b44e647fd947f80c662d81646c96374017ede4fda7ec86f6741912af21304bfd8dcb06c9b3fd105a", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671068, "uuid": "e5c9e638-d37b-401e-b24e-b1b5b97d6fd9", "value": "T16B252313A6D85173D8B66B7058F30B831339BCB0C974523B2742D9AB1DA29D5AB76333", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671068, "uuid": "fdbfc575-d7d2-4d2e-8cf6-30805a0bcadd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671068, "uuid": "145138f0-84a7-4601-baee-03ca42d78df5", "value": "24576:ryFu3YHKXyLIbHqrj/EXuuDEDGpQmNTXVY0J:eFAYHKXMIbHqrj/6pimQ2VY0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684671068, "uuid": "492efc86-42e6-4835-a95e-0aa559a1f294", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684671068, "uuid": "8e349c46-09ea-4713-b003-55d21060dd6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671068, "uuid": "bce9b76b-d148-4df5-aa7b-8776f9eb5869", "value": "listener702.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec20c982-f807-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684694842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694842, "uuid": "aee5c2c4-498f-4ee3-8084-6db821f669d9", "comment": "Malware payload", "value": "02d16727a8b692b7c503b76f5adf7960", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694842, "uuid": "95dc9eda-cd4d-4d31-9a06-e1baa4b95839", "comment": "Malware payload", "value": "5168b4392eb0a828db2c91fe3528203ed117005e16081442b977013cdf680842", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694842, "uuid": "5dfa1868-f903-40de-bff7-c1ff9fa7c706", "comment": "Malware payload", "value": "d974251531b7c8a4d046eee816a647fcab4dc93e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694842, "uuid": "d6720730-a01e-4d2f-a35e-8ce6189c2674", "comment": "Malware payload", "value": "ff93f10712c40996cc8920e703a3271d2c6e7c9413245e6c141fb8635510d4822d0ec794f39270e900d9f4a772ce824a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694842, "uuid": "b663908c-44b9-4f16-97de-9472422f45e8", "value": "T15B2523936AED8072DD7167B02DF357C31A3A3CA14C31572E2389596A2D730E4A93237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694842, "uuid": "4c61b49e-0b8d-4bfb-80e2-d52a73d817e7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694842, "uuid": "46395f26-10c5-43c1-8a0a-fc79ff72fdbe", "value": "24576:DytuUQcCt3QIyknOlW36XTeFE75tk7TNyZ6D:W0Ml06D9G7TQZ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684694842, "uuid": "2171ecc8-c264-43c7-adc5-ba46c0d0d4e9", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684694842, "uuid": "53a08a09-c395-482c-b5c7-0dbbc1b8c238", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694842, "uuid": "c261a060-96ca-4bba-8808-7b87e0c8c980", "value": "extractor573.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "042bc7dc-f7b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684658375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658375, "uuid": "94c3d815-19c3-4ad9-991c-4a847160b61a", "comment": "Malware payload (RedLineStealer)", "value": "a202634886a2eddaaf69c9be115d6537", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658375, "uuid": "695f02ef-fdbf-4f05-a13d-b0ac8f13aa9c", "comment": "Malware payload (RedLineStealer)", "value": "516c27209743e2f8b96f632d22791680cb86ab3bc77b2fa992ff0b23f1f657d8", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658375, "uuid": "599a93df-aeb1-42c2-b786-3889f6705bad", "comment": "Malware payload (RedLineStealer)", "value": "10d828fc460f5a74be6c67bb2effecafc6113508", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658375, "uuid": "f89dbe80-8f34-43b9-9b48-cb745324998c", "comment": "Malware payload (RedLineStealer)", "value": "65b0ced27c8657ab48c4c183f9085d9ce9a4434b2f8e6151ea44f26e78580d5b2c4f3351d9b6da3141063368f0f891d0", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658375, "uuid": "467873bd-3033-48c3-b51b-56819a4f211f", "value": "T1A2E3D528279F8934D6BB493D6CB19CC076BCEC52A542D70A4ECDF1593A73B80DB116B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658375, "uuid": "75463cf0-01e8-4c65-bb83-fa6eb84bc2cf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658375, "uuid": "c2bb903c-968e-426e-9cf6-865a51c01ba9", "value": "3072:PV+m5chQmRSZQ1avem1eJwfUuMyNiOhjZR8e8hX:PjENURTIOhj7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684658375, "uuid": "8a20c561-82ba-4ac5-af72-f24b61f2c5f7", "value": 148617, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684658375, "uuid": "ce8ef29b-1b44-4134-9534-41fade3739ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658375, "uuid": "5168cbb7-9228-4bff-99c8-98a7d82e0094", "value": "242552902.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88dbbb7c-f801-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684692099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684692099, "uuid": "859cb374-766c-49e6-9905-1571e5367617", "comment": "Malware payload", "value": "df831ff718a0ea6bf47615704cd940a9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684692099, "uuid": "f4d32a7d-ec9a-4963-bb02-abe4f5653f7c", "comment": "Malware payload", "value": "51afc09ad92d00237bdb1068222e4fc87e002ca0d51b65ea232fa94739e2cfba", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684692099, "uuid": "aaa2958a-ce0d-470c-a50f-5720ab4c84ce", "comment": "Malware payload", "value": "89bc8ad171d03568fe205eadb299e6d53501ba4b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684692099, "uuid": "fa657b8b-1a00-4250-83d5-c956fbc13fdb", "comment": "Malware payload", "value": "a6d9888d2dcfc37421f3e1e6d95b7ed9e74fd15d6d01504a7e8a1aa807374958b9cf2132ba4eb30757c935d5fc722eb4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684692099, "uuid": "d0431765-7c36-4088-9f20-505abdb6ff62", "value": "T13583B61A6E218FBEF75C82384BF78A21A75933D522F0D685D15CED015F6038E641FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684692099, "uuid": "3a2857c3-b0ea-49b6-8992-306fad3546f9", "value": "768:D5X/YMkQd0w/yQMxsHsZoRLeIZs0WcJfEsUAVtcd2J2s2t22a22H2j2I6Cmust7S:sQnqfYEsUAFCajjBsuLfIhmqesTXs0j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684692099, "uuid": "601e771a-4fc3-410a-8ae5-1080d6e7b3cd", "value": 84800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684692099, "uuid": "81932849-7ebc-4aef-88af-e9b9ede42a4f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684692099, "uuid": "24aeb13e-c836-4361-aa5b-3907b8a728e4", "value": "df831ff718a0ea6bf47615704cd940a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9803166-f7c7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684667243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667243, "uuid": "f6a38940-eab7-46a7-b882-b09442c74611", "comment": "Malware payload (RedLineStealer)", "value": "c6c8b6552a4ed8529bfb92ade1ac4bb5", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667243, "uuid": "b73ca972-173f-4d5e-8e83-80e7883c244e", "comment": "Malware payload (RedLineStealer)", "value": "51f62007736a2f952153d79ad4dcb5b109c2911b0699fc15dcbf585a9baaf2ee", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667243, "uuid": "52c167c5-f4a8-41b7-8185-3c2f5c099d49", "comment": "Malware payload (RedLineStealer)", "value": "c2a9286cf3f1a102051db68c3c4fdc0a8aa68430", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667243, "uuid": "978708ae-55c5-4591-8135-7ca0bfd4b4d1", "comment": "Malware payload (RedLineStealer)", "value": "8ba41c1cafc38890141009694a7f3505809ea91677ffaf7fcce455745f73a5776cab61258fe286c5d32fe3a145f1ade2", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667243, "uuid": "b8311dfa-5737-4530-8d85-e8aef605964d", "value": "T1CB252305BBEC8412EEA56B7069F613A70B33BCB08D7C421B3641E91B0573759AE3536B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667243, "uuid": "52541479-5f84-400b-8cef-38dd581bfabb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667243, "uuid": "1e41b1ef-f6e6-4372-a10b-c7bfaf87c1a4", "value": "24576:6y6OVcm5CGtILg+jNNqiJLD1HgwkADTegIgXe0NKZm:B6OSZO+jThDdgnAIgXe2KZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667243, "uuid": "db0e4a72-b4b7-4d64-a66e-454667d1bdec", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667243, "uuid": "5258af12-f143-4e95-b75b-370d3647458f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667243, "uuid": "360a51a6-5191-4c01-8c28-fe284fbea488", "value": "DHL325.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acce6418-f7a8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684653934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684653934, "uuid": "b9211f98-c7a3-4153-89f1-97092f8693bf", "comment": "Malware payload (Amadey)", "value": "729141c12dbdf7a6263b8b72b225f66e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684653934, "uuid": "43783f42-6c6d-464e-b96f-9740fe0cc142", "comment": "Malware payload (Amadey)", "value": "5239e42a69cee04c5e29466258f7f58f253285af85091b277241bc1e55454e50", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684653934, "uuid": "82f92db7-db68-41c0-829d-4b4af7c9bbf7", "comment": "Malware payload (Amadey)", "value": "f4a4b159767befd59502636b0fa46a811c465276", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684653934, "uuid": "b7b7cf99-a445-4687-97f9-500972b455c4", "comment": "Malware payload (Amadey)", "value": "f45f367afcd7273c30f29955cfa4db0c6a5bc1e80073dd3bae5ae0b0fbaa9e0664bb517660852508516603453504651d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684653934, "uuid": "1fdf817b-6e10-4719-93fe-07d065ada5a5", "value": "T1D02523239BD85473E8B2277098F643970B31BDB5CC38C72637096CAA4DB2984AD31767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684653934, "uuid": "1bfca9e5-9e04-4657-9e7c-d6cfd9afa3c4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684653934, "uuid": "d4554a9b-8314-4f6f-ae4c-74309e5356e1", "value": "24576:sylyZ7qpid8e3f7qaIrN3WU3lrjixEBxp27uGbVu:bllidd3f7qhX3xixEN27XV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684653934, "uuid": "532e0e35-89bc-44c8-8c95-81f5fc56fd37", "value": 1056256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684653934, "uuid": "a0614983-65cb-460d-aab6-58b6dfa62602", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684653934, "uuid": "6a5bfe0e-572d-457c-aa29-2efea8d74d8e", "value": "729141c12dbdf7a6263b8b72b225f66e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfa1847b-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684680621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680621, "uuid": "bc7d15fa-a55b-4d97-aa5b-ead82ee87d02", "comment": "Malware payload (RedLineStealer)", "value": "75cff6e55eee986a6237f3e1f5f153ca", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680621, "uuid": "1f633a4d-9f1a-4539-80b8-cf0b0c616583", "comment": "Malware payload (RedLineStealer)", "value": "5275ba0b627a9acc90b6ab9d2e7c76996d8b77692095236ec1a7cd76d33bb9c4", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680621, "uuid": "5f1593dc-4709-4acf-b8ea-df30d6d99cef", "comment": "Malware payload (RedLineStealer)", "value": "0b33fb139c7101487939c6dc253bb3e76b0d9fda", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680621, "uuid": "ebd99807-c50b-4e90-b5fe-71b8e118a3e8", "comment": "Malware payload (RedLineStealer)", "value": "3596a7267e159167f632b034994f52f5a47f2da7cabc2d0fc74d36b81b9bd6c263cb048cf1632905bb42b88657eeacdf", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680621, "uuid": "16465f46-d2b6-48bf-9a70-4bcd01e92057", "value": "T1A925225AA3EC8072D8B51FB049B747C70F317DB19E78834A2A51591B1CB3AE09A36377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680621, "uuid": "3a745680-0f1d-4fb8-9f4c-dc8553ea99f6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680621, "uuid": "989f6b53-3c02-4d7e-9f1f-4346850cbc05", "value": "24576:eyRvh11oGoYKrH1d5TSRlsScFd3ZZ3ORW7nAcAngTdjlJ/KZ4Qy9p:tBD2PYoRuQScFdJZ3OR2AcJTdjl9PQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680621, "uuid": "e8132843-8462-418d-b06b-e0367f86bd41", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680621, "uuid": "06f85ff6-e5e6-4eb9-9ae3-920d2a92dba3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680621, "uuid": "0ce7e8d4-f60b-43ec-81b8-72ed897a9aa8", "value": "patcher777.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cac826f-f7c8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684667409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667409, "uuid": "bb309640-457f-4e9f-bcf7-6eedb074ad41", "comment": "Malware payload (Amadey)", "value": "f1ff8dbb3bb14ee11081a98febbd6259", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667409, "uuid": "28a5d94e-fe1f-4cb4-842d-b1a7cff86f1a", "comment": "Malware payload (Amadey)", "value": "52d0205463649a523756a110b373012d1cdbeedaae96e972f0115e803041aa3c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667409, "uuid": "4a980911-e09c-436a-92b3-5313236f41cf", "comment": "Malware payload (Amadey)", "value": "f04b33ca4e455683b20fca0d39d68416b835e7e3", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667409, "uuid": "e6ea8f73-412f-4525-91e7-88cff5e2e225", "comment": "Malware payload (Amadey)", "value": "89b381bf7c3b33f51f44577a4d676fe5a419c97a9098a227d6167b4ae95e18e9eaad0788dc92c3aff5ce0bb6796dc01b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667409, "uuid": "4bb3437c-05f0-47d6-bbf4-9ad812fe01ba", "value": "T1F625232397E84433FAF517B569F412831A39FCA1697883FE6742A80E1C733D499B1726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667409, "uuid": "b46e04af-0549-4175-9e28-c6855fcd9d60", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667409, "uuid": "6e9d588e-6222-4da6-a079-7042eb1a1703", "value": "24576:ky0+cdOGjiEoiJYg08u79Yva95OeIe7BzSYHL:zFG0t8WeyrhIe7BfH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667409, "uuid": "0c1269bb-d91c-4055-9cd4-0c61511274e3", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667409, "uuid": "081f4abb-d07b-4519-bb8f-6f9d4dfcbf32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667409, "uuid": "035b7fc0-14ad-4dca-80c5-f63492c22cd4", "value": "tokengen496.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d081963c-f807-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684694796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694796, "uuid": "ac3fa3bf-f2af-44dd-82f3-404c251ea5e5", "comment": "Malware payload (RedLineStealer)", "value": "6b24acbfd9b79d44b0c87eaaf3673bf2", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694796, "uuid": "14dee1d2-6fe5-443d-91c4-189b8140020f", "comment": "Malware payload (RedLineStealer)", "value": "532afa5fc5ded450bfb5c2a24d5910046b5b08032b51f94c9b3477287030642f", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694796, "uuid": "a28bdf80-ac9e-4501-a34f-fc371c3c442e", "comment": "Malware payload (RedLineStealer)", "value": "5ad64c6e0e5d509b24eb2dd6c1d69c3fa0c3ebf5", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694796, "uuid": "b0f93884-325d-486b-ab6b-805a53e685d9", "comment": "Malware payload (RedLineStealer)", "value": "b6415cdb10fd7ad97c71e25c08291804a143fc2a0010ffdf6a203ef06bb6134b7a385f3f66cb44c73893c70b77f6951d", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694796, "uuid": "258524c4-61d4-45cf-aacc-0d2c551c3d6d", "value": "T195E3E824279F8930D6BB493DACB19DC076BCEC12A942D34A4ECDF1593973B80DB116B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694796, "uuid": "82bba67b-2cf5-42a8-a5a5-7bb1e696b512", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694796, "uuid": "e75261b0-f9ef-4503-82e3-18c2052d16cb", "value": "3072:oV+m5czQmRS9Ynk5QXNhhRbG5h5Zx8e8h/:ojKtM5h5b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684694796, "uuid": "db8493eb-124d-4175-9a8b-cb5a3f4ecd90", "value": 149211, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684694796, "uuid": "477e330d-ae32-40e1-9dd4-dc7f11437a3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694796, "uuid": "e135a92f-685d-47eb-b8e4-f41ba450eede", "value": "converter910.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b961376-f770-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684629800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684629800, "uuid": "d1fe23d1-24a9-42f1-9877-328ab0144efd", "comment": "Malware payload (Amadey)", "value": "5ed9a9473557fbd5fde7d37561d8cba4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684629800, "uuid": "bb3ac06e-d0a4-4d11-a704-b193bcfda660", "comment": "Malware payload (Amadey)", "value": "549e18e5a293191911b6022e140b4381f4c6e3e9164f6082f6cba9c67186395e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684629800, "uuid": "6582f1b1-4786-415d-b5f0-040048b96f01", "comment": "Malware payload (Amadey)", "value": "77f977c1454103bb10ae5097c3cf6fa339e3a725", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684629800, "uuid": "e01f1e2f-eb72-4adc-81e4-44e55b65c6f4", "comment": "Malware payload (Amadey)", "value": "f41c185b9853b969dd39502e37612ff546667aa894b67f55cd8a98f1cde67ec33583a9c6ed74825da62646aec36234e9", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684629800, "uuid": "9f5fd08e-a26d-45bc-a9c3-fc867b7f0a8f", "value": "T197548D3271D2EC71E5668635CD29C2F8762EF8617F196ADB23446F6B18302E3D63A341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684629800, "uuid": "8c131345-fa44-449e-a24b-9896937a3a4e", "value": "bb27c4958c76443fcfe46f9765d838a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684629800, "uuid": "b8b52692-f1dd-4737-80bf-181ebc3580e8", "value": "6144:W8+/00n+axVpGKqvOIW2mPJStC6FhTlT2:WBnfxyvHZN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684629800, "uuid": "390d1d99-a598-4bee-aeac-898fc0bd2a9b", "value": 294400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684629800, "uuid": "fd4f338b-72d8-4fb1-9795-a4e971ce43f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684629800, "uuid": "ebeb1987-0a38-4e57-a7e1-76413dcbac06", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "645519dd-f7a9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684654242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684654242, "uuid": "a52eccf4-9536-41bb-9671-781eef40ab73", "comment": "Malware payload (RedLineStealer)", "value": "e1db6cbeb10d8e75842949e4b5c4a4a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684654242, "uuid": "e73b294e-08ea-4661-ba53-ba86f2f0748d", "comment": "Malware payload (RedLineStealer)", "value": "54b9648ca5b444ae817e0c8e978de3b940b3193b4d78d423df02205943dd4d0e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684654242, "uuid": "9fc13374-b81f-4ef4-8113-c59620f56b65", "comment": "Malware payload (RedLineStealer)", "value": "62b64692b9e7a9ff0ff3026abe3d17f4ec524d61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684654242, "uuid": "dfe983e8-58fa-46b9-b329-b7acfc551d6b", "comment": "Malware payload (RedLineStealer)", "value": "ccfddcac415c23acc48f7c519e76c6b3955dc1eaf1ea4183d2ac3a5ea783292c6095120a87a2b553afb25f8ba7b1fc26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684654242, "uuid": "98fb6cc9-150e-4a10-97eb-af9dd82a3b9a", "value": "T125252313E6C44933D87C23B118F227871636FCB388B89A577B06AC5B8DB22E45A75717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684654242, "uuid": "e5906745-884a-47ac-8616-56b213500127", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684654242, "uuid": "dd3cba4e-76ce-4711-be7d-193f4d6f2050", "value": "24576:3yPCCJZZ96oKqj5b55X18baFK0B40fZsYSs4Wcg:CPCCJZP6fqj5b55XeeFB4T5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684654242, "uuid": "5f28e69c-6bae-4c8a-8f14-d268eeff2461", "value": 1045504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684654242, "uuid": "78dc7b32-5451-425f-b56f-987b113c9a33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684654242, "uuid": "19f2077c-c238-4c61-a6c2-755302f39eb7", "value": "e1db6cbeb10d8e75842949e4b5c4a4a8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55b2ab40-f7e5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684679987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684679987, "uuid": "3157c910-7848-4a3f-bdb8-c0394f9f3ee8", "comment": "Malware payload (RedLineStealer)", "value": "6e4a0094678caadf4a71052459d54f09", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684679987, "uuid": "e82dde79-46ec-4150-a656-da0967f3be3f", "comment": "Malware payload (RedLineStealer)", "value": "54b9e1d9e6e47035b05a7ad17c08e64e6bc98ecf87dfa9ee777f2802894f2874", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684679987, "uuid": "a7a9dd21-ddfb-4bd6-99d9-c9aa11bdba42", "comment": "Malware payload (RedLineStealer)", "value": "96c29f7588768a82b0f991a3c0bde3d897c5c1b3", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684679987, "uuid": "04aca02a-ddf2-431c-b730-e52065b5efc5", "comment": "Malware payload (RedLineStealer)", "value": "e66f517bc28dd13e3115ee5e989cbe874112a96c463cc474d686bfa40bf4e2f879d6006d43bea9b77754da7aceb02c7f", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684679987, "uuid": "0d30afde-c3ac-4d63-b8b4-a759e486e2dc", "value": "T1C4E3E824279F8930D6BB493DACB19DC076BCEC12A942D34A4ECDF1593973B80DB116B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684679987, "uuid": "9a530fcd-b388-4b43-82eb-cd8323b3f6df", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684679987, "uuid": "d0f574f0-06a0-4dea-9364-d1068c456549", "value": "3072:oV+m5czQmRS9Ynk5QXNhhRbG5h5Zx8e8h/:ojKtM5h5b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684679987, "uuid": "430ae4ea-1a56-4fe8-ad8f-348a4ce09222", "value": 149164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684679987, "uuid": "ef358cd8-07a6-4e22-a3ea-a9b28497efbb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684679987, "uuid": "dbfc1a35-049f-4bd2-958d-a99078935354", "value": "backup856.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5ffdad7-f7c7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684667317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667317, "uuid": "dbebba3c-b63b-4410-b17d-ed060d34099f", "comment": "Malware payload (Amadey)", "value": "1b590a2e5b94f2fef0ebf93a95a08ead", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667317, "uuid": "03759f5e-d2a9-4ff5-bf5c-18477255f54c", "comment": "Malware payload (Amadey)", "value": "54ba1160e63860b501d96ebc35549f50a6aee89dc3764271740f6610b1fcc737", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667317, "uuid": "65d31a2b-35e7-45f7-819a-8175f6acad6b", "comment": "Malware payload (Amadey)", "value": "6b81d25a80b70c60f4f2a5ff4abb64ea714d83ea", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667317, "uuid": "ee569b0a-386c-47ce-87e3-ac40992d7ceb", "comment": "Malware payload (Amadey)", "value": "4f9dd71a4dd87fd11af53b6354816d6a84489e5182d5c78c0162641ac6787d7e1abdcebfe9232f5840a642334d041b86", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667317, "uuid": "c12e37af-3a7c-4e69-b258-103d6f8b94f3", "value": "T1FC252313BBC84063E8A917B48CF213570B32BDB12D3C877A2358B5674DB25E45962BB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667317, "uuid": "9a4da6f0-7eb0-45c9-8fbb-a0cc5d938bf7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667317, "uuid": "25ae4882-6e25-4542-aaa8-896073978bfa", "value": "24576:SyEUiXZHT/1TsM7wnOqntyJ/6/T6uVebKNsJL+o:5tiX5uM7WOqnK6b6uVeRL+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667317, "uuid": "80671645-51e3-468c-8a55-4cffa2d9e0ac", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667317, "uuid": "a87290de-cdc6-4577-88bd-e030b48d37e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667317, "uuid": "3931a2f0-4440-428a-bff9-66eafd2e5546", "value": "file958.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "551984f0-f7f4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684686429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686429, "uuid": "f7c3a840-4796-490a-86ef-a732edf2a2fd", "comment": "Malware payload (Mirai)", "value": "c461ede26e84243bf7b650aae4f25e26", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686429, "uuid": "efb9070b-a5b0-460d-b78a-ac29780b5041", "comment": "Malware payload (Mirai)", "value": "54c63e965b0955155083c5769257ff4e652df23c261cc079afc1246c56ee17fc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686429, "uuid": "ba2de3ff-1ec1-4781-8803-513f4a17f2bc", "comment": "Malware payload (Mirai)", "value": "aa08d0c64110bcddeb9753593a0833e7b15b51c4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686429, "uuid": "b4e2e97c-669b-4a01-a541-237911147d31", "comment": "Malware payload (Mirai)", "value": "18ba0148e3f439faae7977854b7fcb8d3367ed39d8ddb958e83f776f62c72592970f6b383333af6e57769be1b8826f49", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684686429, "uuid": "53b9254f-ba55-4be6-96ea-0b96f064f3e6", "value": "T120630956F8818B22C5C5027AF92E118E332357FCE3DEB2129E146F20778696B0E7BD55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684686429, "uuid": "cab8bab6-eb10-4240-91d3-eacf4c029daa", "value": "1536:dlneyKvSEkSYUde5d3W5BkGpa6agzVIoi5QVh+y3ff5VYoxj:FKqEpJUGNazQVh+y3ffDBxj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684686429, "uuid": "a8f3eaf5-8995-4fa0-9a30-96154e788152", "value": 70968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684686429, "uuid": "e9a2641b-2ad5-4e22-b01c-f016c4592aaf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684686429, "uuid": "769d71d9-a64c-4958-ac73-2a87b4a65911", "value": "c461ede26e84243bf7b650aae4f25e26", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e15fca7-f7b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684658473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658473, "uuid": "8b645ab9-c657-4750-b87b-e78a69945877", "comment": "Malware payload (Amadey)", "value": "7412a9ec787fba09d4927ab928cea1c1", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658473, "uuid": "f3cae9ee-447c-498f-b3db-e938ca4123d1", "comment": "Malware payload (Amadey)", "value": "5546fe0509e15025f83bc6836b890de7257653a76605e595e4521d9345b87a86", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658473, "uuid": "50121568-6a8d-487f-9b80-55fc5f79d321", "comment": "Malware payload (Amadey)", "value": "b0e3d721de3b4319768ca0883480e352d290378f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658473, "uuid": "046518a6-f034-494e-8455-3ea82c1aced3", "comment": "Malware payload (Amadey)", "value": "3846ce5352d0193e8a434de2fd4cb3b3702412055c9269174bd588138aeb9863724275ea0755ea2fc5079a3268388169", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658473, "uuid": "82a5d3ff-f3d6-4057-ae24-e2aae4972c3c", "value": "T1202523137AC450B3EDA22374D6F603D31B3ABC84AD78872E3B55B85A4DB2A45D071B72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658473, "uuid": "d9e97ef9-403c-4dff-ac73-92f5571d6c2a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658473, "uuid": "d72aabe4-7cbc-4b12-a706-08cc77d74576", "value": "24576:yyvO08gvajMpt9c+qKfG3gY4MEyBa3/LHEqm77dksEoh+:ZvOovaatJqKUgMEyBkHEF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684658473, "uuid": "c9aed7e0-2dbe-4785-a711-7fd370c5db13", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684658473, "uuid": "106c9fbb-9682-4199-bb1c-1f948537f22f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658473, "uuid": "adc53394-817b-424e-b908-125d5d691886", "value": "publisher383.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f078b969-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684680676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680676, "uuid": "03ce3a61-56c7-4c35-a39e-c3cf002feb53", "comment": "Malware payload (Amadey)", "value": "4157b540c20837cc342127bc8bc20af4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680676, "uuid": "a235dc0b-891d-48b0-9a17-56b8ffeaf1a4", "comment": "Malware payload (Amadey)", "value": "55a88b6b9b3e7dcda602064917e28a946ae5ea1607f2197675d10d72606a86c0", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680676, "uuid": "00158910-8678-4bb9-9cd6-a6c989b853c9", "comment": "Malware payload (Amadey)", "value": "8b3f28daf85fcd3e650e956304f0245e52db0e9f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680676, "uuid": "5d439012-47ba-4989-93fb-29107d536416", "comment": "Malware payload (Amadey)", "value": "fab5c9bdc99ce671eb31fb2517f9f889aaab0ed65a0ba243ec1f48a7038022fcd5bef594c90931354346ec6be2927016", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680676, "uuid": "5ef17984-22a9-4515-90e9-dea94ef2987d", "value": "T1E925230357F880B6E9B50F3058FA17A71E767C75AAA4435A2309E81E7E72594F430B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680676, "uuid": "a3c8352b-9d5c-4cd8-9a4f-2ae72fa6c86c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680676, "uuid": "b8c716ae-3e4f-48bc-a0ae-40e0547df361", "value": "24576:QykRD/NfqoGCLbzAvvEOFRQgRoQhUrMg:XkRD9qoDXivEMUQhUI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680676, "uuid": "6aeefe34-1edb-41de-ba24-04b585213b9b", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680676, "uuid": "6daace26-86ae-4452-b9a2-5ce845cc3cdb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680676, "uuid": "0ead3f13-1f5e-445e-99ee-2410c24aad32", "value": "token162.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f995bfe-f7ef-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684684191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684684191, "uuid": "5d77d3be-667a-4feb-9293-092e425c41d4", "comment": "Malware payload", "value": "a67d351958373ea3f40f03614a4b53a7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684684191, "uuid": "ce8b56ed-394e-46fa-bbf5-2a40b35b1be4", "comment": "Malware payload", "value": "568c4fa593553417eca9b037269b8ab3f72dcf470085d234a78b2ef3c162c32b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684684191, "uuid": "26385d4b-9043-4c95-8982-3101acdff9fc", "comment": "Malware payload", "value": "f060971dccb33a76d4e00b886eb0367acf6b632c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684684191, "uuid": "509e4c35-7f72-4c1e-a7ca-5de26266052c", "comment": "Malware payload", "value": "278fba5e7f9dcca870b3c09ec19c009e63f71d8c748c948ff7197ed5354a600a5c5c86c0fec900e87bc330c2d815d9fa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684684191, "uuid": "44e36f53-99dc-4d0e-be5e-c16173608e1a", "value": "T1AB634BDAF801DDBDF81BD77A4453090AB630F3D512831B3663A7B9A7BC721981D22E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684684191, "uuid": "cdf73f01-f8a4-4a35-a761-f63b949bd50d", "value": "1536:XYwtvE1wJXDYvXD8V5f41Mx0S3VdJH7S1fYq5QUp:XYwvEmREvXq41m0SV/1q5Np", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684684191, "uuid": "c9d8deb0-6157-432b-96ca-c04850a90254", "value": 69640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684684191, "uuid": "1b85c7ce-81b5-4c17-a50e-8f71df04129b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684684191, "uuid": "e2c9bc35-ec09-46f3-a32c-185d001f1ed5", "value": "a67d351958373ea3f40f03614a4b53a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "734395a5-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684680466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680466, "uuid": "f157b5c8-21bd-4ecb-8ef1-b86504ef7e07", "comment": "Malware payload (RedLineStealer)", "value": "de472f4abd0488fd0002d9830e24efec", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680466, "uuid": "a2531104-7efd-4550-b1c0-30a29e9f2be7", "comment": "Malware payload (RedLineStealer)", "value": "569862c1b5af7716f257eb9a06c8e29901d62663b6f86b63fa02d65a4ccb57ab", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680466, "uuid": "116efacb-b64e-4c10-879e-0f51f6539ea2", "comment": "Malware payload (RedLineStealer)", "value": "4ff4bb6e2e818617b6e2ce3500e1ecfeb7ad4853", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680466, "uuid": "73570fdb-1d64-4da8-8c5b-b73e421f1335", "comment": "Malware payload (RedLineStealer)", "value": "81e826196318e1c989b5e950cbfe1a4fb22a267ef0395cb41a84c2b9e1862eaddfbf6a19a2effaf849c9bdd9ab351060", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680466, "uuid": "ceb1fe28-06d0-44d8-8d8d-ed263f3b9ceb", "value": "T1F5252317B3E840B1E9A627324CFF52932635BC94C9F4C51F62A9AD2E6D72140A633773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680466, "uuid": "4c299d6b-239f-496f-8768-854cc902ccab", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680466, "uuid": "f97bbdec-7ffe-48da-a20e-e95b84b6e6ea", "value": "24576:+y2+JHxBrlqBqYdyXFfI7kztcuYrfh4bnw65o/b:N2+phqBqhwCtFQp6w650", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680466, "uuid": "70944a02-3fb8-4ba6-a740-7742a6cbc4a5", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680466, "uuid": "6d4cd879-b255-41b1-ad13-043724505a30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680466, "uuid": "11c078b2-4c5e-4afe-82c5-15ff5c6fc0a9", "value": "42345867.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eff4395f-f7c7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684667361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667361, "uuid": "fa68d7e1-0e9d-48bb-88de-5a59e2b301e9", "comment": "Malware payload (Amadey)", "value": "315f455c892122aa2aa693c31fe70ea9", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667361, "uuid": "8353e3a2-61f8-42c5-a188-c55350ddb250", "comment": "Malware payload (Amadey)", "value": "56a8fa1ce1e8e5c1f121ac2993a7f5bfb60037bae39e7704b4264ace30e3197b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667361, "uuid": "7c12d5ec-2331-48ff-8155-62821ba87c30", "comment": "Malware payload (Amadey)", "value": "01dedd5203b42a936c18a23dc958e3827fecf83c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667361, "uuid": "86fca87a-2d5b-460a-ac8d-b7887f15b29b", "comment": "Malware payload (Amadey)", "value": "25da8fb52e3802e8b234738187fd2f3cc6ac38ec502c96995dc4e6c9400cd5df5d22dbd6a9bfed12f8de57f9cda8b5fb", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667361, "uuid": "8db4a09b-2f27-4a3f-992b-909047832752", "value": "T177252341ABDE9533FCA933709DFE43D30A36FDA09631872B2751495C2CB2A5099B532B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667361, "uuid": "c6fab1fb-c7d4-414f-9a9f-2d2d80eecb92", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667361, "uuid": "ed6ede87-ee25-43f2-8518-a5b3eec06fe4", "value": "24576:BySuPaSD+ubcrknzq5tCbuzvvYjBoUtWrwbTwqd1ld:0SaD+ubcAzq7CbuDgArOTwqL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667361, "uuid": "2bbf2f1c-94d5-412f-9ddf-112729036927", "value": 1056256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667361, "uuid": "a4152ec5-0ecb-4784-8079-46eb90926787", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667361, "uuid": "f3759e11-317f-4e5a-be70-e0a74331e4da", "value": "multiplayer988.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "549bd315-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684680415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680415, "uuid": "59bd6e2a-f8a3-4b00-9215-ce6cc67dbbd7", "comment": "Malware payload (RedLineStealer)", "value": "9beb37199c8a1329c86981e8139a26bf", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680415, "uuid": "67b9ab07-6313-4099-8c82-96eda3de7c69", "comment": "Malware payload (RedLineStealer)", "value": "571b7b0236ce7b37fd52835c016c14cc3f2f74974d9648f11ff0e61cfc4adb8a", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680415, "uuid": "b748490a-be9d-4196-9aa0-34acfcf4f7bb", "comment": "Malware payload (RedLineStealer)", "value": "7f035b2d994adc259a79cf8fccbb66720c101365", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680415, "uuid": "f3d719ce-ec52-4a1a-bbfe-d9bfe7f6210b", "comment": "Malware payload (RedLineStealer)", "value": "753ff2a818763c6bf06d4a760abaf42c2ae18d022af6cacca07ac5630d15f942ae3a8241ace92820aa361fd592a8443b", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680415, "uuid": "077452d4-33a8-4833-9dcb-9bc7ac2bc20a", "value": "T18B252317B7E84073C860777448F653C71B7B3CE15935836B3AA6AE4A08726D0B63636B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680415, "uuid": "bfa52fca-986b-491b-8446-9e4a9a7eb1e2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680415, "uuid": "20c182c4-65c5-41bc-9f9a-5451f2a69087", "value": "24576:Cy3s6dclnwl9jpZjpNQOOeNpbKf1xZlV9OBJgcd:pHclnwl9HlvC1xx2Jg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680415, "uuid": "97fd5543-b058-4405-8fb5-31109721651c", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680415, "uuid": "553f1a8e-a8ef-4ee5-b6c2-299e975cdf6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680415, "uuid": "2ba111ba-74ed-488e-a279-94ada821f3ee", "value": "21324519.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1ccbdd5-f808-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684695255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695255, "uuid": "5a6833b4-7f19-474e-974c-cba00f05479c", "comment": "Malware payload (RedLineStealer)", "value": "f9768d2f580d49d45e1021281657c47e", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695255, "uuid": "7e813519-a0c1-4862-b0b4-0ca742370a86", "comment": "Malware payload (RedLineStealer)", "value": "5760ab38a244fcb6b3a80daf95b1b3006c4c90342b36660b2b4cea4de23b566e", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695255, "uuid": "fcef581d-63ca-45f0-b7f5-7c5955291e21", "comment": "Malware payload (RedLineStealer)", "value": "995876d48e960ebaeed1e8a2647aa07bc27757be", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695255, "uuid": "066fda33-5ced-4ffa-afe8-40f51eaf3101", "comment": "Malware payload (RedLineStealer)", "value": "0c5d3c388e0e6ad04a151f08aed7c7a4c065b97810821044f41046d6edb8d649c593477c2feb2ea0c4605333d776632d", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695255, "uuid": "fa6d075f-0c83-476c-804e-b5a688f55bba", "value": "T165252343EACCC4B6ECB2477075F602870B3ABDF0A960922B374EA61A5D7365135713A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695255, "uuid": "d89a01c3-dc06-4a28-95aa-53212ff39fdb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695255, "uuid": "6fc6b8da-cfd9-4524-b1b2-d2473b43db0d", "value": "24576:ayOP1lIoe983ZHJrlqZyxS9eeNgyUPQRpqV7IcEHmEuqSggQgI8AkP:hOPr/3ZHJrlqZ3xvcmpqVsdHmE+gwI8A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684695255, "uuid": "957daa77-d510-472d-8f8e-f287cb5c32e4", "value": 1046528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684695255, "uuid": "21c1ff99-e497-4694-9b8f-0f238ac472a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695255, "uuid": "aa26866b-fe10-46c2-89be-0ef2355a8372", "value": "NoxerCheats656.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3c08087-f7ec-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684683205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683205, "uuid": "ab87b099-08c3-4a7e-852a-319ac8c6b8b9", "comment": "Malware payload (Mirai)", "value": "bac85ab38c7decd67a7d1867116fc69c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683205, "uuid": "c5de977e-dfd2-420f-88f8-acc4c63f811c", "comment": "Malware payload (Mirai)", "value": "576196e82a46f4ec7286e775bf0c7c64e4503da2f6960a4e1bda6273ff33a94a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683205, "uuid": "baa84bb9-b5c4-4cad-9ca8-cc689d3b25d7", "comment": "Malware payload (Mirai)", "value": "23c07f27a38f2de5ac147e4b608cb9595d216f19", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683205, "uuid": "39d64f85-f7d4-4c4c-aaa9-80093a19d9ef", "comment": "Malware payload (Mirai)", "value": "6a3ebce3f4bf6a3dee4da6e2817a572da116cb721aecb66b22d53584b3895a00ab6ffd62b3a0ef185bd959373b0736d9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684683205, "uuid": "ddce1376-941d-43c0-b49f-a9db98e691e9", "value": "T118E3C449A8D29D16CAF31F7AF91F10A9DF0887DC93D7A123CC2D37F0319545A689A721", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684683205, "uuid": "2e24eace-d9bc-4342-9bfd-64a2fc805bc0", "value": "3072:ZW3gExnvKaLiyah8dRztiANZMjUHlw4/18NYcvF0gWJOBkA+JyDg:c3jxjLehoRzti4ZMjUFw4t8Nv+gBkAer", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684683205, "uuid": "39dbd0c6-4a68-414d-862a-07044f78982d", "value": 153180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684683205, "uuid": "58e3dd52-54e4-4498-a773-e57f5783d6ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684683205, "uuid": "9b1a0b41-9b1d-4da1-8136-b0d78b1270aa", "value": "bac85ab38c7decd67a7d1867116fc69c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6509218-f7a7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684653628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684653628, "uuid": "9b6ebb99-b32f-4570-8b36-f025cdf6f765", "comment": "Malware payload (Amadey)", "value": "aefa413f2d5dc88feee3b9fd7c98cf25", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684653628, "uuid": "20a7bc86-063c-46f3-baec-b307a962755b", "comment": "Malware payload (Amadey)", "value": "578000b48f5d0bf8b8f2fb9d1d3b55d5139c093c9c12b120977ce9ff589a9bb9", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684653628, "uuid": "3fbb3cc5-696a-4683-99e7-f43a15da513d", "comment": "Malware payload (Amadey)", "value": "0a3c78b6a94c64cf7a1c6dea5508a44e0d6c0d0d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684653628, "uuid": "6274b5c8-97b1-40a4-95f1-b5b7fc6e34db", "comment": "Malware payload (Amadey)", "value": "f113c65850c94e213a10af96a5e20db87c42660c7efebaab9d7aab09e05c17ad1a4725bbd6edee58697092503521f7a8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684653628, "uuid": "3cbb3a10-6319-4790-9bd0-7e43e05ef72c", "value": "T1C3252316E6CC5652CDE1677154FB06CB0B3A7CB08D78862B375A9EAE1D33C94A074723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684653628, "uuid": "a3e3371a-2b04-4304-9f9c-85dda77eb689", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684653628, "uuid": "233496b6-7d1c-40a9-8080-307ccbc43026", "value": "24576:Xy9HuVQ7AX4ga4qtznVbU8nz0tvjePlzmjvFa:iEXo4qh+azejsl6jd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684653628, "uuid": "08f25165-bd85-48c7-8abc-d38b50fbf44a", "value": 1056256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684653628, "uuid": "a4d8ec48-8123-4d02-ab7d-a9dfae8d5c18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684653628, "uuid": "3857dacf-c74a-4a12-ab4d-5afccfb65952", "value": "aefa413f2d5dc88feee3b9fd7c98cf25.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae76c796-f82a-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684709771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684709771, "uuid": "7b8f1df3-2699-4072-88bf-3f6d8e39205f", "comment": "Malware payload", "value": "863b22f4b5c6602f92c7ce5dfefee94f", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684709771, "uuid": "cfefc1cd-d80f-42e5-9678-bb54bf6eb9e9", "comment": "Malware payload", "value": "57bd2e91d8f8c824084bad0078d7d65eba6792f4fccb95b55f7081c419894ce1", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684709771, "uuid": "040628aa-a44f-483e-bff1-104dae5a5b28", "comment": "Malware payload", "value": "5bb957f33c054bf0b992fba798e6f0a05f9ac2f0", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684709771, "uuid": "e901654d-16a5-4b6d-a321-c7fe7e0a2ff7", "comment": "Malware payload", "value": "82c6482833dd6ba0bfc4e54ede9be8640ec1a7cefb1e6b21f189e1049f5486d99326c99fb82f4616fde4628de7e84a9d", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684709771, "uuid": "ab865a90-71a9-483b-8681-23a8ab3294cd", "value": "T1C3330903E856C0F9D45AC2729D6FD533E632B9BC5130796B0788FA722F29E31965EB40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684709771, "uuid": "be5e7781-92ad-4471-a247-3b6c0437c621", "value": "768:CgplhD19+0yAuhIlCm2RP0IuYebtkaBLtR40Nj5UEr:RjxyUCm2RzL0JtZNjZr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684709771, "uuid": "afcc458e-5521-4604-8d30-89e9cf7a3896", "value": 52368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684709771, "uuid": "7878164c-faa4-4d45-bb23-6d4354f07026", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684709771, "uuid": "5e573496-cd6d-477c-87ff-c9d55b632a23", "value": "863b22f4b5c6602f92c7ce5dfefee94f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53208582-f7ee-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684683848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683848, "uuid": "a98dce4d-c3b7-4d85-9cf3-5a7307790278", "comment": "Malware payload (Mirai)", "value": "1612dcfcc6709136d843d3305bd8e218", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683848, "uuid": "8d637da3-e8d4-4734-a9bc-bb78bea81bab", "comment": "Malware payload (Mirai)", "value": "581c3c56e706c6add9ad4821569445c4430266d5b4d0d012bb2320b5c5e41551", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683848, "uuid": "5c232529-997f-4e61-8a1d-e22a685874f3", "comment": "Malware payload (Mirai)", "value": "b862e40247bef13028208e887b4581f442b65820", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683848, "uuid": "44037d76-6dbf-4a67-8be1-cbfd190a9ce8", "comment": "Malware payload (Mirai)", "value": "4c211bad0755971df88f810cabb0ddcc9a1505dc2172761ade9d7e23a1c02b9f0638230bc1d2d4cea3fefa2f660c1fb9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684683848, "uuid": "5c659121-1a35-44fe-910b-cc4680f28cc9", "value": "T10DE33C56EA418B13C0D61779B6DF42453333ABA493DB73069928BFB43F8679B0E23905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684683848, "uuid": "8ce3ee9a-611f-474a-8937-86e221a0baac", "value": "3072:yJTc2PBSpmY7Oabvzj4dlRsh8ZQIldxMXkkTM/9zY:yJTcGkOabvzj4dLsh8/xMXkYM/9zY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684683848, "uuid": "8d0e6837-2641-4fab-863c-030dfe5afce8", "value": 150602, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684683848, "uuid": "56e7a1aa-c298-48de-bc5f-77099369d527", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684683848, "uuid": "763eccf2-1757-4a04-abc3-a4e75b9d9c14", "value": "1612dcfcc6709136d843d3305bd8e218", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4123116-f7a7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684653624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684653624, "uuid": "542d45f5-1f14-406b-8887-fd5cff1e6b5c", "comment": "Malware payload (Amadey)", "value": "60d69dd3a68a2cd3b02ba7ea1478c32f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684653624, "uuid": "2a794d1b-21fe-4e31-8e65-2f6762dc7c16", "comment": "Malware payload (Amadey)", "value": "58f9d44697d52e51f01912f4f6a27a2e4519e4dcc0afb6a27ab517800a54ab9e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684653624, "uuid": "a047924d-126d-49ee-a409-6b3b1982da26", "comment": "Malware payload (Amadey)", "value": "e45294669807f906fae9d184761c6f9cc1e559ba", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684653624, "uuid": "627760d4-e9ca-423f-b278-2c9c64e7e3c2", "comment": "Malware payload (Amadey)", "value": "b724abb8389effb5bae02f0a7b2277929dd833fdb3fc8678ac306fde30813a60459de6ec6e1bd72ea27e6cb8aca90eed", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684653624, "uuid": "04d367c8-5309-403c-9801-75847e7b6a97", "value": "T102252307EAD89423ECA813305CFB06970B3ABD518930973B6385A96B4D724D4B573B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684653624, "uuid": "0c448f89-0ff8-42b4-995a-b1e6e315a638", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684653624, "uuid": "63609015-e3ae-42f1-af7c-1ba34e8f14f2", "value": "24576:/yoyu7nJb3oqIAqeqwriAKauZH7omsbxq//ntNdqQ1Srw:KoyuVb3orAqurvutwbynvk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684653624, "uuid": "2c7ad78e-2601-4d84-8760-095184d2ae9b", "value": 1056256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684653624, "uuid": "8c46b9f2-c0cc-457b-8482-ff925759a970", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684653624, "uuid": "fbbb9b10-eacb-47e9-9d55-f3bbab5837e9", "value": "60d69dd3a68a2cd3b02ba7ea1478c32f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1704f131-f802-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684692337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684692337, "uuid": "c88d6902-22f7-4996-a453-fb57f47d82f9", "comment": "Malware payload (Mirai)", "value": "df4815910c87ab2b20c11385072b637e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684692337, "uuid": "2d3d8659-1d85-46fc-ac1c-c3f251affc4b", "comment": "Malware payload (Mirai)", "value": "5931845dba24f04177824c9ebcbebe36adbd4ade7ca7b8d27e5ee191c4505542", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684692337, "uuid": "834ef2e3-4819-445b-b849-4eb2faf56132", "comment": "Malware payload (Mirai)", "value": "4c2802a0febaaa6c481c8ac105923cb883c5a7b6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684692337, "uuid": "75e9c090-2072-4b7e-9921-c97a0d4df547", "comment": "Malware payload (Mirai)", "value": "2e95580764bdd3f20f2194ccd1f9797dcd66a5cd4e8153d59c5c751159801bbd492f2a5af67d60f136d9a31bd7566739", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684692337, "uuid": "d79236d9-bfe8-4f9e-ab31-f328f2a59ed6", "value": "T1E7633A32B9760D2BC4C5A47661F74B25F6F243C621AC8A0A3DB10E9DBF75A403157FA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684692337, "uuid": "1e24bec0-9d78-4f64-b935-fec6e06ce2a7", "value": "768:AEoStWHA34hjQzQO8trHR9TBO+NHG5VHMSjDNrSwB/VjA7t820X7uBbIM:AERto9tQzQO8t7fFNm5ZSwFVkt306Bbf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684692337, "uuid": "82efe629-79d6-416c-8639-b5764a45e736", "value": 67004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684692337, "uuid": "e534b045-42bd-4f9d-8657-23245dc819a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684692337, "uuid": "efec1f13-603b-4cf8-89f4-c2c9ed86a4e6", "value": "df4815910c87ab2b20c11385072b637e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73d99e56-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684680467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680467, "uuid": "7698c497-e3a6-4394-a03a-4e9bbdbc09e8", "comment": "Malware payload (Amadey)", "value": "f3f6b83d32b1ed0b0a998a53c7bb8f69", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680467, "uuid": "434b39d4-e74d-4bb4-b177-df6ee3b8656b", "comment": "Malware payload (Amadey)", "value": "59449e4997ce890caa9f23de6bcd8a296dff289282e2af7bca1dcedcdcbda8a1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680467, "uuid": "f20a3fcb-7be5-478d-85fe-dc3348cfc0a3", "comment": "Malware payload (Amadey)", "value": "59af66f6ce96a78aff62a05f9b1059f6fc417267", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680467, "uuid": "a7139414-2278-4a70-b029-cd8e29026842", "comment": "Malware payload (Amadey)", "value": "e5df50ad4908d57a6a05ad5545b7252f71ba397dd8d2a14501f71f8b6b3caa0b2624da9a394445b268bee94a1371fa61", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680467, "uuid": "55315d87-d28a-451f-99c1-9e28060cab76", "value": "T171252311A7C800B2D5F22BF048F942931A30BCC29DB856AB3745965F1CB3685AE7677F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680467, "uuid": "058670d1-0a2f-467d-9d0a-9ee4bd52ec85", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680467, "uuid": "5349ac03-6141-4ce1-a5fb-aaeb4185866d", "value": "24576:Oycu0/B5mNrs9Hic8K2sW1fbJbbh1D4VrwFTfPc3unx:dcu0ZYkHL8bfxtowTwun", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680467, "uuid": "28cc70c0-0562-4d39-8b33-19b964913625", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680467, "uuid": "e241c26a-c47a-4064-8bca-f1f47ee0e956", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680467, "uuid": "12bf6d1f-441c-4259-9ce6-9cb452fcf26b", "value": "423517.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53ea999e-f79d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1684649060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684649060, "uuid": "5a81bdef-0ba2-48df-9656-3f7bc4454bf8", "comment": "Malware payload (njrat)", "value": "92dae51f5bcb9e6251e72f4ab8921ffc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684649060, "uuid": "dfafd0e9-f465-4a58-a683-4f5b26154ec8", "comment": "Malware payload (njrat)", "value": "5a6f71fa0c01662f25e3a3de987861a3197a98437230d806354fa996de853020", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684649060, "uuid": "d7e5b3fa-3f2c-4bc1-b781-2ffc5b336bcc", "comment": "Malware payload (njrat)", "value": "1342b15d4f07b508078208abbe7271758385771d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684649060, "uuid": "48c6f593-fdb0-40a2-a360-7a28c1311255", "comment": "Malware payload (njrat)", "value": "ea39822c2eeb6a1e89db9b5830929fa034609e0310b09b1381236e3950672ca368cb2944ab7696dafc3c193f5af600e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684649060, "uuid": "718b9497-0536-45b4-8240-ecd0840d5dd9", "value": "T1CFB23B4E3FA98856C4BC17748AB5965043B491870423EE2FCCC464DBAFB3AD91D4CAF8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684649060, "uuid": "aff8eeba-819e-4e98-8d0d-49ed8e686732", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684649060, "uuid": "66c4ebed-13ef-43a4-977e-bc792b7f7589", "value": "384:Ac6CqbFYh3odrVCGiHssDB4b6i6fgpEupNXRmRvR6JZlbw8hqIusZzZwI:/IU0tw3Rpcnu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684649060, "uuid": "4d3d88b1-d1be-4e73-a47e-40677672c955", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684649060, "uuid": "a6d4bb53-fff0-4017-918b-5bd26039502d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684649060, "uuid": "74334686-d1d2-4acb-b239-0a101c544c25", "value": "xokHa2RRhV1q.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43644bab-f7b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684658482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658482, "uuid": "80c2d46d-db17-40b7-b8c3-b0d6cd850d42", "comment": "Malware payload (Amadey)", "value": "6b1557f82531456e58927f84d07ba70a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658482, "uuid": "d0a6a911-e7c1-44b6-b902-1d53aa73391f", "comment": "Malware payload (Amadey)", "value": "5a9e7074ac8f93f08c4cf186cad09ec83d615361dfa05bbd003fa912d073db1f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658482, "uuid": "dbca731c-3644-44b3-9221-564668730f07", "comment": "Malware payload (Amadey)", "value": "0c4ece5df4fb24a5b4452d0c23b6f836049db369", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658482, "uuid": "df04240e-fe2e-4045-868b-35272ca58a87", "comment": "Malware payload (Amadey)", "value": "16980a3c37274d454b906322217c09a1cf816a491185abe1b2fcd45ff1924a6c7bfbe52cf28042a5ee9760b6099e5e1d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658482, "uuid": "261d2757-9c86-42aa-b2f9-8682b0de856a", "value": "T1F8252317A3D850B2E8F56BB168F701E30A327DA05978836A3685D8450CB37C1F5B2BB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658482, "uuid": "a09ec954-c3cf-42c5-98b3-e89f40893483", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658482, "uuid": "1225b02f-61b9-4ac5-bff6-487a01c0a3a3", "value": "12288:VMr0y90ytwng3NrG+H+IMdd9eINdysCRqfZwRyq6n/9Ert+j86oofnWnBOjyMAJ0:lyLYEY3dd9eCMqxww/1Q2nWn4Gzbz+d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684658482, "uuid": "6b6fd3c3-7c09-42a1-bae9-649b225fee20", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684658482, "uuid": "125cd1ae-2eae-4540-8b4e-4f75a397a592", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658482, "uuid": "f1f041ad-5a4d-4abf-9d37-424f0987551f", "value": "resolver211.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00175781-f7d1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684671254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671254, "uuid": "2e4c3a0f-f641-4189-96f2-39155f1ecc3f", "comment": "Malware payload (Amadey)", "value": "db09e17577b821d32795e77657a5b87e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671254, "uuid": "0787cc70-056f-47e1-8179-a9ebd4cd25bb", "comment": "Malware payload (Amadey)", "value": "5aacc7189355c5f9df10d35be3089fb0c2b69abfc686b4ebf936061495752d70", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671254, "uuid": "7e3d7a09-2a32-4207-80b8-f3aadadb7eec", "comment": "Malware payload (Amadey)", "value": "161146b644dd76b0d8873e1606c64187f9e3103f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671254, "uuid": "67ef1283-d801-4419-8abc-df730c7e13aa", "comment": "Malware payload (Amadey)", "value": "dfc9a40215bb3fa857d1636aad10ff76a5b672e8b6d84c40b5741a8edc0edecf41000aca9f6ea211f4b6996f247fbc3d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671254, "uuid": "117627eb-e6f6-4df2-96ad-e4f2966e8381", "value": "T14425230ABBC95473D876277058F24BA30B327D21DEA9633B7245582EA873289587137F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671254, "uuid": "b3d19476-0a2d-4f99-91b6-d196b403ec34", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671254, "uuid": "7c03342e-f3c8-496b-a517-b2a56144e439", "value": "24576:EyT6LA8DeNruHALCqf638+Gau7LNVhBStMj3e+mZ:TT6Uq0iHALCqbTTLN9ji7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684671254, "uuid": "204087d9-8afa-4132-8b68-c25546e6f64e", "value": 1046016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684671254, "uuid": "1518a7a9-6b18-40dd-8c0d-d2cbd0ffd16b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671254, "uuid": "fe0a818d-f934-4a26-b581-784e477cc03e", "value": "renderer628.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5821862d-f800-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684691588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684691588, "uuid": "61a4a94e-15cf-4b39-b866-67d8ca883d82", "comment": "Malware payload (Mirai)", "value": "cb557afabd34784f3c8bc25d0c233040", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684691588, "uuid": "dbaa497e-becc-4822-8307-0d0089f5d5cd", "comment": "Malware payload (Mirai)", "value": "5baee17ba1cd287d014527b0a7feae7e40d1bd426600fccf6a8b18efc954db23", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684691588, "uuid": "232fb6fa-0fd7-4d3e-8e9f-47967c479325", "comment": "Malware payload (Mirai)", "value": "b4f3295e808741a0ce669e3eb3bdb62405e9e11e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684691588, "uuid": "486b46f6-2ae0-4cbd-9c06-ff0c2f8940cd", "comment": "Malware payload (Mirai)", "value": "3e0fa323980c73f60ec3186e36f963f913186a65a71579bc040f7afc7212974ba2567bba4ed68d3cec57b46b02431060", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684691588, "uuid": "1be21b37-0f59-42e0-9bff-2d761f487ff6", "value": "T142634A9AF801DC7CFC8BE27B4413060AB530A2A541530B3773A7FD67BD761A89926F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684691588, "uuid": "bced1e33-8721-4381-ac14-e9fc57dfcf91", "value": "1536:J93+JNOSrvsL8i94tcfywX0hucgBY8/WpbgwQ:73+7O8vsbhH0gck6gwQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684691588, "uuid": "bdc33554-8290-4916-ac82-b6802e883f15", "value": 70568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684691588, "uuid": "b271b7e8-6676-45a3-8ae6-0410eb4f34a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684691588, "uuid": "f089472b-fec1-4e3c-8812-38dd2c5ff36b", "value": "cb557afabd34784f3c8bc25d0c233040", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b426fab8-f7c7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684667261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667261, "uuid": "1a35824c-1f42-4142-950f-3d48873171a9", "comment": "Malware payload (RedLineStealer)", "value": "64c95faf1939a14b117b17f830bcccf4", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667261, "uuid": "ba896652-d3a8-474f-ae01-f7fe37cd148a", "comment": "Malware payload (RedLineStealer)", "value": "5c10bbb3e85ea96c7553f71ca9f5862947ae70b2f6117a4ceffbf2227f34d097", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667261, "uuid": "4f2754d9-91eb-4ecc-9ee3-cdf26cf6006f", "comment": "Malware payload (RedLineStealer)", "value": "fedf38dc71883b1e60ff4587b0ee067b5f8fa4b0", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667261, "uuid": "2e45dac9-f335-4ec0-9ed4-70bdcc6eca9c", "comment": "Malware payload (RedLineStealer)", "value": "24b316a3d642b91b0348fc59a9995580e4983b8b9668e1e986fc6f83a8a33a23332e7657aaec0afadb2e6f5998484509", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667261, "uuid": "c54dbd07-c6e1-49b9-9c2a-f21c7c2bd172", "value": "T134252363A7DC1036DDB2133059F745832F31BDA16D7992672306960E2CB3682D9B2B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667261, "uuid": "8859066c-1042-48e7-b8c1-0a970b56a9d5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667261, "uuid": "2380a970-076b-4dc4-a158-4fcbbe739c33", "value": "24576:cyMRr2eJH3VPq0e1izvXz5pCYOcDAmK9xOYXn:LASeJHtq0eo7PBuJxX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667261, "uuid": "d5af3746-4a69-493e-97c9-d1a20c78d1dc", "value": 1054208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667261, "uuid": "0b2e1110-4fbb-4b2b-9a0b-3d04702a9c5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667261, "uuid": "36efb86b-f733-4873-8226-deb39633395d", "value": "audio246.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7a4b40a-f7c5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684666461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666461, "uuid": "4be23fc2-165f-46e6-b6cb-b42598bd1bc0", "comment": "Malware payload (Mirai)", "value": "881b25e8a8468668128599b914299e43", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666461, "uuid": "7c3f6171-b984-4ea4-b3c8-2ae18837a07a", "comment": "Malware payload (Mirai)", "value": "5c32eb61acd018fbc7bfdc8f6a6a5827c5a207a5f5e0aa3e07394557aa565d43", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666461, "uuid": "24e901b4-8e2a-4580-b6f3-fa0799a64337", "comment": "Malware payload (Mirai)", "value": "e1e33e2166cbc336e0eda23f551f6af9823476dd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666461, "uuid": "63453dfa-9129-44d0-9206-0c1982394fe0", "comment": "Malware payload (Mirai)", "value": "b248e7d31bdd59a311856a5a7213d5734f1e79cd4ceb7b9bd9327b776e6a2011e218bc226d0585e57ebf437df7e69a82", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666461, "uuid": "a1aaf458-f2f6-4eb9-954c-2765a4b5686f", "value": "T14063F6753945F2ACD6E94078F4436EE91E1209283EDCD1E36087143BFF71B88A62DE5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666461, "uuid": "bb89e654-a2db-4016-8266-3e999f037306", "value": "1536:BWq4mXBnUM+mxqIKaHIZVBIVCCfy0K9UJRNW:dUM+/IOun3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684666461, "uuid": "7853fed2-1f3f-4e9d-9245-cdddf264b369", "value": 66944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684666461, "uuid": "d7cbcd6a-d1b9-4c1e-a501-7396d6b7f991", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666461, "uuid": "7679dfa7-26c2-4d39-82a8-680c8816462d", "value": "881b25e8a8468668128599b914299e43", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f62efde0-f7d0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684671237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671237, "uuid": "ddc10dfc-c0ca-4270-8a48-9202a31f1244", "comment": "Malware payload (Amadey)", "value": "351bdcb2d9eab5935e199bd553859f3c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671237, "uuid": "25aab0b8-7e87-41a1-8d79-80624e22a194", "comment": "Malware payload (Amadey)", "value": "5c4877676cb876e8859b1a325b13f8d094c920347e20bf479904332a6a4569ad", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671237, "uuid": "70f5b5f1-6507-4dab-9d5f-a723dcb9e97d", "comment": "Malware payload (Amadey)", "value": "bfdac780a456918404d2ff337003913ae0991eb1", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671237, "uuid": "ed09c14f-88c8-4935-bc4c-e4fc21194c25", "comment": "Malware payload (Amadey)", "value": "d88310ef2ed3ffa86d492da450992c0f2d48cae6b4d0ee9ee3f383a585a186a7dde4eb18f3e329ebd29dd4e6dcda61ef", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671237, "uuid": "24b17ac4-aef3-438e-9ca6-896251b30821", "value": "T150252353E2DD64B3E5FA137429FA075306397D11AC78439AB282E84A0CF3765A4B077E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671237, "uuid": "7fffa250-6eaa-4a8a-a7e3-0d0a2303b935", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671237, "uuid": "05b72f25-beb9-4829-81f2-d0c557c0956f", "value": "24576:/y12m+1dOG5nkj9qVJcxFwgt97C5z48HUTJLaVVOg/:K8jo9DTEs80TQB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684671237, "uuid": "e96b3943-26bd-4f9f-b64e-8dbbeff43f13", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684671237, "uuid": "dc4da987-e2df-4c6d-ac5c-940fabafa8a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671237, "uuid": "6ff823fa-f47a-4723-b026-44716ffba55a", "value": "input162.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd38c29b-f7c8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Vidar)", "timestamp": 1684667732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667732, "uuid": "917e1a73-f767-4d58-ab42-7c9a84ea766b", "comment": "Malware payload (Vidar)", "value": "c4d65dda5d6ce86e3297629c3c4600b6", "object_relation": "md5", "Tag": [ { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667732, "uuid": "a00b8611-da22-4c36-be42-80e1bf40eda9", "comment": "Malware payload (Vidar)", "value": "5c631beffefdbf081fb1fee93398a5752e4889bd00a4f767ca31b13b6ecfe4d5", "object_relation": "sha256", "Tag": [ { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667732, "uuid": "2a89ece3-ba86-49f1-bdca-4693f93e5457", "comment": "Malware payload (Vidar)", "value": "479ec702d6b6502a79b841ef65cc21241ffcd91b", "object_relation": "sha1", "Tag": [ { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667732, "uuid": "012efddc-3021-4978-bda9-ffc7105fd556", "comment": "Malware payload (Vidar)", "value": "aa14157485b668c89abdc60f206d58096bde2153d9faea5c5d5f41600793db831ef4d7bbeb384a2c9aaec90d172baba0", "object_relation": "sha3-384", "Tag": [ { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667732, "uuid": "d6bb8412-fc76-449d-9c9d-de8c30e338e9", "value": "T1A6643903A291ACA2FD26467E8E2EC6FC765EF8504F0D67DB63586A2B14711F3C672701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667732, "uuid": "e4bb1520-e8a4-4e62-993f-566d8b3c0bef", "value": "f682da34b918ddb61703d12aa2522a66", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667732, "uuid": "9eac3c7d-04f5-4e3f-980c-bf4dc6e7aeeb", "value": "6144:6RoAlgU15YLbK2kuVs4W3L0LQG792v6pUweuTc:FA11+K2a4W3L0zJ1jc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667732, "uuid": "f90253f4-6b25-473b-adb5-cdb5e88849b4", "value": 329216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667732, "uuid": "4d827a70-5ffd-464f-91c5-dcbde6189299", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667732, "uuid": "1d9c8a43-4352-4705-af95-6317accb7c27", "value": "234433512990.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19f98599-f7b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684658412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658412, "uuid": "23445181-0f57-418c-b579-f515048bf581", "comment": "Malware payload (RedLineStealer)", "value": "f2bae8e0d2aa9e0bda36d0938dd38f57", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658412, "uuid": "709ca8b3-81e9-4205-9c52-ee0eee6bc100", "comment": "Malware payload (RedLineStealer)", "value": "5c9c09ae0b169b14a212e16ddf3b098d3b1568b5eb4e8394f721822a8f81f486", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658412, "uuid": "711c0362-02f3-4bb0-a0de-a017c980dcf2", "comment": "Malware payload (RedLineStealer)", "value": "eccef26f4787c2b01ce3e676fafdc421d7b86a67", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658412, "uuid": "2fd41b55-c060-4ffe-84c6-bf5c4a63b94b", "comment": "Malware payload (RedLineStealer)", "value": "f2844a5ff0e58f2b88f52b033f0ce1e68cb1727833ead3c2d92a549893fcfeb5b155a59301c0e86e00f295f49cefe81b", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658412, "uuid": "829d9174-daa2-4a11-8ef0-391b84e3b16d", "value": "T139252307A6DCC0B5C8766F7149F603930B357DF29E7893AB7741A98A2C3369059307AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658412, "uuid": "47808914-14ce-43dc-b14d-d8da12b90579", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658412, "uuid": "da668592-7d15-42b2-b543-faa6fc662389", "value": "24576:ayeTvdUIn7m3hR0qAJOGH8Tf3UXYlbdJg25:heiIn7msqAULEXAdJg2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684658412, "uuid": "0c45e4a0-d329-4d60-84a4-16835bb1caab", "value": 1046528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684658412, "uuid": "90af773e-58f7-4194-ba10-f53435a002db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658412, "uuid": "28dcd78f-5521-446e-aadf-2d71cdb6d6b4", "value": "Unlock543.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c5f1660-f7b2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684657960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684657960, "uuid": "cd38ae92-c260-47dd-9bf0-37f1a3c78289", "comment": "Malware payload (Amadey)", "value": "52952b7112255fc972257bbda20030a8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684657960, "uuid": "3666faee-f08e-48d3-8efb-7286323193bf", "comment": "Malware payload (Amadey)", "value": "5d440c79228ef1d2762c47c2b08afc72ece6ca3ba71ddaf060b8056f23fc763b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684657960, "uuid": "8a7dc213-7950-4887-9d8b-eb7123a589d8", "comment": "Malware payload (Amadey)", "value": "607bf1a1b6ee12d96ceb7ac619a70d66f9a84ff8", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684657960, "uuid": "0b3083fa-05dc-4f40-afd4-35b4c77c7569", "comment": "Malware payload (Amadey)", "value": "db65825eb5794e31eef3192071b920eea0de3f670401c065467179b6c9ed50c25b21356444d0cc2a77cf9c14c3f86587", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684657960, "uuid": "88d63cf5-a390-4af4-a7f8-70b4e6d0bd62", "value": "T1A9252243EBDD8032D8B067709DFB02D31736FD205A78A2673B15AA271E73985993532B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684657960, "uuid": "6189ce4b-cc89-47cc-b6b8-4c92ba2ac768", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684657960, "uuid": "1361f061-1c10-4ea4-b64c-b27a7d2dc296", "value": "24576:9ybA/n9+HoALqEnqTbw3D+5ySdXZte+H0Jppe:YbiwHoALqEnBi5JHefpp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684657960, "uuid": "7a86f1ca-d778-436f-8a17-0cdca21ea332", "value": 1047040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684657960, "uuid": "b91157d4-6165-4108-b44f-64bf54538042", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684657960, "uuid": "d4b0914f-936d-44e2-9c43-2f46f15b2f2b", "value": "localization.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5326e02-f7a7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684653626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684653626, "uuid": "68680220-7e63-4607-8c23-b8601a377e7c", "comment": "Malware payload (RedLineStealer)", "value": "4b8f41c7f37a1f677c1b29b7929cba30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684653626, "uuid": "f28dff04-0052-49ea-a5ab-691cf3a558eb", "comment": "Malware payload (RedLineStealer)", "value": "5d6a14a28b8b66b4dbaf0a14adb13ceeffe4055198919469c35b49ab6212c177", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684653626, "uuid": "3cec94c1-e32a-41cc-8179-113775986686", "comment": "Malware payload (RedLineStealer)", "value": "fffa361041f01089760c3fc308270b5bba7fd95b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684653626, "uuid": "33c3c7f1-d130-4737-8cbe-0358783a1343", "comment": "Malware payload (RedLineStealer)", "value": "dcd7e366a796224f85af2ce0c8f367b97035c70dd3aa405eaab9450773c597cdca5ffd297db27c75f6bd8d94bd8ff606", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684653626, "uuid": "f770bbe1-a6cf-434d-b227-e0263be20970", "value": "T1C4252342AAE441A3FA7667B01DFA13531E36FDB189715B272B4969930C72740E43B33B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684653626, "uuid": "cb836566-bf9d-4153-a08e-883d36f1f91a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684653626, "uuid": "e90235fe-3e83-46ba-b087-5c9f769da805", "value": "24576:VyHetbh5zh15I+YqP5MkKntDjdcgQQu3HUxdn60:wHMbh5b5KqP5jKnLU3g6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684653626, "uuid": "225a40b9-ac5f-4567-a45e-dc70319ce385", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684653626, "uuid": "27fb8bcd-d76d-47f8-a428-892c94664573", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684653626, "uuid": "341a8bf3-cc4c-4885-825e-e7c400658b7d", "value": "4b8f41c7f37a1f677c1b29b7929cba30.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68f1e293-f7ee-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684683885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683885, "uuid": "59a38fe9-87ed-41b4-a499-792acc3a9639", "comment": "Malware payload (Mirai)", "value": "6a6ac14d4d0a96d1675f2882a90659c5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683885, "uuid": "726eee1d-8217-438c-b711-e94292e1f607", "comment": "Malware payload (Mirai)", "value": "5d8e3abc2311a4f1abb39a9b052f3f4baa864b65fbeb914dc0259ef567d1b10b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683885, "uuid": "2b07d7ff-6906-43d7-8f06-e33b34bfe1d0", "comment": "Malware payload (Mirai)", "value": "725a1aa942479123db696f667a4fa2794b2ca3d8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683885, "uuid": "85d9b938-44fb-4518-b632-6644b73e7065", "comment": "Malware payload (Mirai)", "value": "3dd977fd1917c6afc56827a28cc58dae9c834bc9373842900c79dcf7736f5c43648bd3a424339a125763751f0ce0aff5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684683885, "uuid": "281b2ccd-f78f-406e-9b95-3a71769b4785", "value": "T1E683A51E7E228FADF76D823147B74E25A69833C627E1D641E16CD6012E6034E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684683885, "uuid": "92e8ec3b-2a8d-4e65-9852-cd63ee88f2f6", "value": "768:2ty6IP7M/kq0INRhfuN2Eo9tl/de2YIwHKRH0I84EH6UTr7ZDYovZ73x/nL8y8QB:Rakdn2Eo3ePu5GTrRYo99Be037W+/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684683885, "uuid": "df75afb1-c405-45cc-a522-3f4cd536a53f", "value": 84780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684683885, "uuid": "60af20a1-b5c2-4607-b1ca-db3953d1b284", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684683885, "uuid": "8b29011a-7783-4afe-9f2e-c0033a85309d", "value": "6a6ac14d4d0a96d1675f2882a90659c5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20df1f08-f809-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684695360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695360, "uuid": "1de63924-a6ee-4cdd-9ca0-2ab2a3009756", "comment": "Malware payload (AgentTesla)", "value": "6f791f62373e409f67553d7ae03323d7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695360, "uuid": "f174f687-64d6-4c62-8cad-07308f11f04c", "comment": "Malware payload (AgentTesla)", "value": "5da5597436e2c7a33fbccb0c23a593f2bb137aa20319501f9fa6b09a38119227", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695360, "uuid": "f8da145b-0d53-4547-a2a0-bfe8c7b8c85b", "comment": "Malware payload (AgentTesla)", "value": "e32aa86bf37b038d76bc61682c4b5de54088abbe", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695360, "uuid": "42321cf7-a0cf-4d5f-8d32-b38a3ff07d3f", "comment": "Malware payload (AgentTesla)", "value": "0abfa5a8303ba3169bba87348655a872033e0d39e584495a0dd13c11e32a8203db1b4229347ebf82f41975af6bebc521", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695360, "uuid": "fb743d2f-2ae5-42a7-8335-bb2ea20dd344", "value": "T160F42388452A5F1D62049A936E856DD00FE199E3439CA701FF43B2E1D0DDFB32AD1BE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695360, "uuid": "cd5ccfe0-9d92-49e9-82c4-518d2d407020", "value": "12288:uOcuDQO5X8BugI0G0q8GHkyxvWCrKtQF1mscma1vDA1281OTsRwUI/m:uOmvI0995yxvB1ms/7NOFUr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684695360, "uuid": "93898d71-d14e-49a6-a32f-eed33ec9fea2", "value": 759769, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684695360, "uuid": "493b3609-016d-4fae-a745-b3a4a3ad2e8a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695360, "uuid": "ab475acf-b74d-46f4-944e-99fee19c265c", "value": "start504.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a067902-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684680531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680531, "uuid": "ed54c006-fc64-4356-b156-7e893cd3ff47", "comment": "Malware payload (Amadey)", "value": "470886f179fbda87a03f781f2e06d6b5", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680531, "uuid": "2f76f939-d0c8-41e0-b229-dc14dfc9a024", "comment": "Malware payload (Amadey)", "value": "5e27ae6fbf170b83ccf13313a351917d5cd34ec75c53fdda5021acee9dca47e2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680531, "uuid": "6b56e66d-abde-4f55-a509-d50f453ec9a3", "comment": "Malware payload (Amadey)", "value": "da00608a417df944eb172ef6dbc7a40e299bb40e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680531, "uuid": "81e3d3c8-5e0f-44db-9edb-396cdb95979e", "comment": "Malware payload (Amadey)", "value": "e7a55455b2fde4e3b5c7a05f5b17a0e36acbc821d4592d2e09a380573769a5c3f5853f1f1b498bd25b52e4acfd7586b1", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680531, "uuid": "c11136b1-069a-4592-8e18-ca4423cc0b95", "value": "T117252313F7E94132E8A317B04DF612C30A35BCE1ADA46A2732A5691E0D73691BC7177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680531, "uuid": "963a686d-21f7-4dd3-85ce-688528286b2a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680531, "uuid": "335b3bec-e220-45d7-8be0-5c51b7a9563c", "value": "24576:qyGeYegL2iZHMNdqu7p7xNXyprmcU1hsVKNPEYm:xcx2iONdqQVQ21hz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680531, "uuid": "3f931c43-b8be-4cce-99e3-00d6b73cebd3", "value": 1056256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680531, "uuid": "ed443ac7-ffb8-49bb-80c5-a20a9859fd74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680531, "uuid": "7419054f-c423-49b7-89b1-a03c324be32b", "value": "compress529.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ec5bed7-f7b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684658447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658447, "uuid": "9f3df6a4-1600-4c3e-abbc-e074f50f0ce6", "comment": "Malware payload (Amadey)", "value": "1c013fb7d37789c75a18584e2c0883ac", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658447, "uuid": "cbbc4952-2922-4d69-9a1f-3b2f674f6001", "comment": "Malware payload (Amadey)", "value": "5e6832579656e8e2d250dccbe2edfa752a341055b2166d8b4514acbd443adfcd", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658447, "uuid": "0bd138ea-f3bf-42cb-aba6-e12b9483f495", "comment": "Malware payload (Amadey)", "value": "de4ea171081d7dc8aa5e35d55981c3181a7fe431", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658447, "uuid": "0f146337-39dc-4421-b31e-35583f138770", "comment": "Malware payload (Amadey)", "value": "d352eca35983328f1e0c4df62cca800b14238fe10e5c9264c916b921d38c1a68dc8df03b08454418a745e220dc7f6eea", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658447, "uuid": "4e0cc992-72bd-4c50-8b23-4f916fead712", "value": "T1E4252312DBD90473FAB42BB029FA0393073E7DA18C24A66A3741DE5F2C73584667275B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658447, "uuid": "e15da845-719d-473d-a2de-c635592dd6fe", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658447, "uuid": "68f67a98-764d-45b0-a0a5-41fc844bd202", "value": "24576:fyCee08XVUfqsv23DNdPeixD1S2nWKyn42P5:qzgUfqp3DNHxDA2nq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684658447, "uuid": "ca4854e5-6156-455c-8862-8c824e5fd8cb", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684658447, "uuid": "58080b2b-e996-4c3f-9427-9c88e43fd032", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658447, "uuid": "65504760-c4c8-4768-97a1-f999d1ee77ce", "value": "helper941.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d77c9af4-f7c8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1684667749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667749, "uuid": "5f7a1155-dec5-4251-8871-11cb849826a9", "comment": "Malware payload (Stop)", "value": "170a52b8e7c2ff0ccf059bf820d4f461", "object_relation": "md5", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667749, "uuid": "7334fdb5-d83b-4f9c-857b-d5b885a566ed", "comment": "Malware payload (Stop)", "value": "5e75b2121f0a0419871b8dfdcdd276bb98d2d2f19adb248a7732e1dc127d4e71", "object_relation": "sha256", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667749, "uuid": "c39a9223-d362-4e2a-975c-f37e261a7a9d", "comment": "Malware payload (Stop)", "value": "bdadbc5d9188e57d2fa3acdf43c5bb73319bb5b7", "object_relation": "sha1", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667749, "uuid": "c005d23a-dc28-4889-9f29-ce88c9a04d8d", "comment": "Malware payload (Stop)", "value": "2deb05beb2cf5192fd67be2c669b58ac4d4bd3a51661430d6400e668a59f6d97526a47d7d252a81d946547c60b2afa83", "object_relation": "sha3-384", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667749, "uuid": "3b525b8b-f31b-4bc4-ba7a-edd9dac223a3", "value": "T1EA05E10352D1BF62E5214B729E1E92F8B6FEF5518F0A77DB6214AF6B04712B2C972301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667749, "uuid": "0e7549cd-27f5-48b8-a7f7-524dcda1dda1", "value": "c3945e210b1009128598ead2a7524d0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667749, "uuid": "b5f12be7-8fac-4a7e-a7b6-9c8c3efe8491", "value": "24576:mnn/XQ/5zCqQ/NqqUNDNLKrklG5cp0mUDp4wlhxU:mnfpULKr15ci1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667749, "uuid": "b927c92f-2226-42eb-b2ff-a7077eeaf2da", "value": 843264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667749, "uuid": "6ac3d307-a8bb-4bb4-adff-5f73959e39a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667749, "uuid": "dddc5ae4-eb53-45cb-85c4-e3af203baceb", "value": "99242893.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f6df4d7-f7c7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684667226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667226, "uuid": "a0eb8e38-0c7c-4636-ad66-4e3ba4c1789f", "comment": "Malware payload (RedLineStealer)", "value": "d7e2fc736ce304ba02e7d07f1b112bcc", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667226, "uuid": "3a9d6404-90d9-4f35-b3cd-f70af50d909a", "comment": "Malware payload (RedLineStealer)", "value": "5e7700f4a25383131d56ec319fc18b1762ecc18022bd404f3c9147db6562804a", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667226, "uuid": "9a63d4b6-b9d3-4feb-8838-60833ee17d10", "comment": "Malware payload (RedLineStealer)", "value": "7f7a8b0b6bc19f0d379a05fd39cde8566633cff7", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667226, "uuid": "167658dd-7784-4f4c-9a1b-b1d9a6a7f75c", "comment": "Malware payload (RedLineStealer)", "value": "8ef4be8014a933d193d05697832850cdc7f68aaff7ce5dbcd4a9a02d4133b9729ff059c679ff9c1ac8db5275234f63db", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667226, "uuid": "23749580-72ca-490a-84c3-e07531fe7b11", "value": "T155252302AFD951B2EDB057345CF202575A7AFCB4DC38D2673B8998A90C72198E632737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667226, "uuid": "36cb7c43-fc30-4533-9cbf-8425f90cb568", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667226, "uuid": "11853e7c-50ba-4645-9170-fb678a2ef8e4", "value": "24576:1yjrNoGeXoqVYC40eti28whC1v6zjgm4lHTLjDNLU2W:Qj9eYqV91wh2v6PgZlzTtU2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667226, "uuid": "871164ee-3081-4da2-9e75-d77506984102", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667226, "uuid": "5860654c-2ab4-4849-9c2d-1c4c4c7e8a2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667226, "uuid": "4309fc6f-6c0a-494a-98ea-76e4a721a4d6", "value": "4743626.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7785858f-f779-11ed-b3cf-42010a9c0076", "comment": "Malware payload (CinoshiStealer)", "timestamp": 1684633658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684633658, "uuid": "d468a6db-6724-43ac-b277-b92d6e53a23d", "comment": "Malware payload (CinoshiStealer)", "value": "4c492e9e4b10daf920cba9ac7415b183", "object_relation": "md5", "Tag": [ { "name": "CinoshiStealer", "colour": "#FAFB9D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684633658, "uuid": "039aa9e5-3667-49a6-a64d-8a0bd8751254", "comment": "Malware payload (CinoshiStealer)", "value": "5e7b9e6b42cbfc3461986432ab970c2817f5f09982250dd3e0f57d647c8de8b1", "object_relation": "sha256", "Tag": [ { "name": "CinoshiStealer", "colour": "#FAFB9D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684633658, "uuid": "aa0f9b38-60ac-437b-86aa-8ce224dc99b1", "comment": "Malware payload (CinoshiStealer)", "value": "2895971feff8fdabbc085adf88c5e55b85917e41", "object_relation": "sha1", "Tag": [ { "name": "CinoshiStealer", "colour": "#FAFB9D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684633658, "uuid": "6bfe5809-7ffa-42c0-9de8-7475f2dd0286", "comment": "Malware payload (CinoshiStealer)", "value": "313441f16b5b67733a4fffceb58bb4a4a4114fc8ffc683d5b8d90e96b9465bb0d7f0e93f1f40de16afec4823f01e8f1f", "object_relation": "sha3-384", "Tag": [ { "name": "CinoshiStealer", "colour": "#FAFB9D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684633658, "uuid": "62b4d2d5-bfdd-4c19-8fa5-26a0abb9566a", "value": "T17D94F39C725076DFC8ABC472DEA81C78EA6074BB931F4603906715EDAA4D997CF180F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684633658, "uuid": "6e4825fc-5145-4d13-b9fd-d1fd05bed4c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684633658, "uuid": "1e6dbe74-2a5a-4bff-97b9-f45e4927cdcb", "value": "12288:F1VdomZSBpo77XnRCLFdocWa4znrkIfjYGoLD/CqVwM1SOmThRkibEXoUIbepLzo:Ffdvb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684633658, "uuid": "aa15ef47-e1b2-40cd-9f45-de51b89b0813", "value": 419840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684633658, "uuid": "a1ce9e40-b466-44a8-8530-35b72793c5c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684633658, "uuid": "01986514-b09b-49e3-9876-a6cae23264ab", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75dc6365-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684680471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680471, "uuid": "acb528e0-45e3-4675-9433-25a945ccb351", "comment": "Malware payload (RedLineStealer)", "value": "8aa108f3e3c3a0682919855c06330c93", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680471, "uuid": "c3ae4681-45ed-489d-abb3-95a858eb4396", "comment": "Malware payload (RedLineStealer)", "value": "5ea9ba67e30fbaa7276fbfc60b2d636cc9191577e58dcdc732e585d82c4229ea", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680471, "uuid": "42d8dc1f-8ef4-407c-8573-5309b38d1798", "comment": "Malware payload (RedLineStealer)", "value": "9d2a4d4b578bd21df7fe5dd2677835642d869faa", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680471, "uuid": "00134756-fcf2-477c-a261-c44bc890fbfd", "comment": "Malware payload (RedLineStealer)", "value": "8aa27754e0d5aabf180da32b2d579b0df77170ad5ec2380d7a1d2adae956ad3d18fee0ef941928d184bee482542be30f", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680471, "uuid": "39d0cdf4-0626-4ed8-824a-d47ad1870007", "value": "T15725232397D86462EEA567B084F216930E32BCB05D78933B3749EC5E4DF26C89436727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680471, "uuid": "a299c501-18cf-418c-8612-3e3ddb9989b8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680471, "uuid": "2fa371bc-2d83-46bd-80f5-cdd5cff5381e", "value": "24576:gy20YhTBMKoxwgwAIqciRYWkL+KUJsIMT7P1O:n21doxwgMq54LLTIMT7P1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680471, "uuid": "99215fcb-5496-4662-aefd-32b98a3aa99c", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680471, "uuid": "c11225d2-2355-410f-bb47-837e5c0a5d50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680471, "uuid": "c4176440-ccc2-4ced-b3ca-bdd5a9feee72", "value": "4743734.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "031cae39-f7b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684658374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658374, "uuid": "310b7327-6b98-4d98-9db2-75b8603e926d", "comment": "Malware payload (RedLineStealer)", "value": "f26400346c00f7791998365c7d31dddb", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658374, "uuid": "2c1fe830-18a7-4c69-8a0a-30a4065506f9", "comment": "Malware payload (RedLineStealer)", "value": "5eac999d49d66034cc5038915e245f79ec925e46bcb2ef693dd5a65c34c697a8", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658374, "uuid": "083b81b9-2085-453f-ac4e-fcb92d0cf0b5", "comment": "Malware payload (RedLineStealer)", "value": "41913bb0005857bf16ab8346923ab99fdd8c2d04", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658374, "uuid": "2c5b9dd6-fac7-41a9-ba15-0b5166d72aeb", "comment": "Malware payload (RedLineStealer)", "value": "7fc38f535a74aabe01eb2525091f7b5d9310df8fdefac47ec646f5e03d759c889223e4631aa6d13cc912aaa3c2a5285d", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658374, "uuid": "a82eabde-2f7f-421b-a0f3-ef0d56d2dba9", "value": "T18CE3F824279F8934D6BB4E3DACB15CD076BCAC126952D7464ECCF0593A73B80EB116B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658374, "uuid": "375d6976-2cff-4355-a2e6-9db499b7f54b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658374, "uuid": "3506a2c1-993a-4d4d-9375-25c6d0927093", "value": "3072:vV+m5cVQmRSx9WCEkEhPW67V8BjVhtZN8e8ht:vj4oihwlVht3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684658374, "uuid": "0f62d380-0eca-4ea8-bc62-b6d0e83e1741", "value": 148638, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684658374, "uuid": "b3947c6e-1410-45b4-a7cd-8d0857834b5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658374, "uuid": "6151f4d6-ba14-4318-a6c1-259821a07653", "value": "234563467.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fce387e-f773-11ed-b3cf-42010a9c0076", "comment": "Malware payload (DCRat)", "timestamp": 1684630988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684630988, "uuid": "87234071-d385-4bb9-8875-0d4e43651237", "comment": "Malware payload (DCRat)", "value": "a106b6f4a85fce3e78cd71358c5f7331", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684630988, "uuid": "5ec85595-785e-4ff0-b43f-bb7d23f92f34", "comment": "Malware payload (DCRat)", "value": "5ee5e591bb2ef8a32f74e08936129f473c1d66a9c61ca454ad86fd6c9a3451d0", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684630988, "uuid": "a8686edc-e230-40f1-bfd2-7996dbae49ec", "comment": "Malware payload (DCRat)", "value": "b47a3709e418112e3941c6346d84a87cc27303e0", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684630988, "uuid": "c6577e10-3aee-4669-8c27-9516db510440", "comment": "Malware payload (DCRat)", "value": "56e5ee2fd385ef28a411994f36e368daa8036fadb673172e6f1f6959b58e87894336fbbbd803ff289344a7ee39ad93ab", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684630988, "uuid": "1de8271d-3998-46d0-98b4-05c3a5024c4f", "value": "T1E045AC03768DCB71C3210C72B5659EF0A7E97DA08A71549BF2CE7C1DEA33091E622B59", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684630988, "uuid": "a7080f94-8985-44d6-b641-14da2121b7f4", "value": "aac51396886833dc961fcd7aab7711e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684630988, "uuid": "7a4febfe-d951-431e-bf1b-935478f5bc57", "value": "24576:igZXoZUTVdt7Kkkr0tNH7zaWHXw6uyRZ3gVb1s7qagNqT083VxMa:hGCNb2W4hO7j083Vxv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684630988, "uuid": "5130f085-d1dc-40d3-91e7-1558ed46a141", "value": 1216018, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684630988, "uuid": "a5100605-f6b6-4da1-848b-2182bb401e86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684630988, "uuid": "700052df-ca1c-4aee-9836-062e49fddf0f", "value": "ChatGPT-4 Online.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2c1dfaa-f7d0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684671204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671204, "uuid": "08495bda-3e61-495d-be67-bf591173eb06", "comment": "Malware payload (RedLineStealer)", "value": "e1e37f6d441ec267b88b0df72987e75a", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671204, "uuid": "069badff-f355-448a-ae1e-0526ee81c4ee", "comment": "Malware payload (RedLineStealer)", "value": "5ef7e48f6eb182aaa7ba782781dfe420f5b36616c9b3f8fb153142625d7ef9fc", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671204, "uuid": "66f37a70-301a-4ac6-bdfa-5638874d80fa", "comment": "Malware payload (RedLineStealer)", "value": "1dc4d2afab32a07d99f1fc2e9e925dd22b8f781a", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671204, "uuid": "ec04faa7-632a-4db4-ad12-c9162ec80690", "comment": "Malware payload (RedLineStealer)", "value": "5fc97a0084bd68baa52b1c5b6df6486603c0bcc772012bb176ea4ad75959c2ebefe808eff037d1f4098dd8e9dad0411f", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671204, "uuid": "88a6b1c9-f796-49cd-b6b2-5e28b8863246", "value": "T1C2252312D6E96472FAB26B741AF702D70B36BC504D38533F7359A42A0C32B95A97433B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671204, "uuid": "77520f74-4988-4b11-8bcd-2a6bd67fec58", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671204, "uuid": "1ec297fb-03c5-4fb4-ba68-0ff5cbc28bf2", "value": "24576:SyIV5Oqye83GDC3qahXTVkx147Gnhp5+2DNIGgTbEjVC:5ITxp83t3qahXTvMhnbDYTojV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684671204, "uuid": "1275b471-ec78-4ec5-bba6-8c52df181c05", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684671204, "uuid": "36f085be-f508-45f9-9f2c-4db6f959aac2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671204, "uuid": "3a3809d3-a6a9-4a37-87a0-739d6a46cafa", "value": "4724670.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b9be222-f7d0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684671058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671058, "uuid": "616218dc-1a49-45aa-8fc3-4057fd7fb0b6", "comment": "Malware payload (RedLineStealer)", "value": "634f48747ccf9a11d98df5e9e7ad3f13", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671058, "uuid": "4c402388-23fa-4739-862e-c1d6c72da575", "comment": "Malware payload (RedLineStealer)", "value": "5efafdfc98c7bf74ed3b24ff3431aa7c65ebe1e22bfdea54327cee3b59b042ac", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671058, "uuid": "62469e58-1ed3-4183-ae10-7739ff22c748", "comment": "Malware payload (RedLineStealer)", "value": "5d306caeee72346b0959826ea96c109566762750", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671058, "uuid": "9e5cce78-ad6d-4b79-b292-365e99d1a040", "comment": "Malware payload (RedLineStealer)", "value": "6e0a304f6b4a8103af1db85a97471f66c1b2848788de7826677fd26dcf0359550c8fef7614eb89184b8153d0f2a9ddcf", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671058, "uuid": "d922c95d-d397-44db-bb1e-0b8a224d3d8a", "value": "T1502523176ACD4022E9B9137428F603D317B83CA59D3A572737866A0F1CB3AE89931777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671058, "uuid": "712824b3-7d0c-4b21-86d1-b0effc4cc005", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671058, "uuid": "c8e49df9-c4ee-47e0-af2a-2e9a9a7de091", "value": "24576:gyxocvQ1sYOCq7F8MkmpHiowNOnouZfyc0H9:nicvQ1sYOCqJ8m4owN4ZfOH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684671058, "uuid": "94310809-7de6-4da0-ade7-b71216044856", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684671058, "uuid": "6e07d32d-918c-4f05-b858-6f9edd00f893", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671058, "uuid": "f53df9d4-4519-43a1-87a5-9b96b904ec4c", "value": "file676.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdd2e8ee-f7c5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684666525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666525, "uuid": "cbc5668e-a974-47ec-b070-06eab5110806", "comment": "Malware payload (Amadey)", "value": "e22886a17a1de04a58ea6c6eb77b5b71", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666525, "uuid": "5da18343-9981-44b5-af77-a73251c01f4e", "comment": "Malware payload (Amadey)", "value": "5faaf8b003051ce4c7385ab6c17103dd17f216d6f0846359916d97105a3e2f0d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666525, "uuid": "195a2173-3222-40ce-98e9-78322e092af8", "comment": "Malware payload (Amadey)", "value": "b6b95972ca47fecea3ce9370b9a404755bbd550c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666525, "uuid": "5059ca41-fb1e-4015-8bc5-12556b55b76c", "comment": "Malware payload (Amadey)", "value": "e4a0cfe2ed6ac456529513c61c83a508662804d8b264917936217c8a1dfddbbdc38e363f0073711e038aefc81341a7f7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666525, "uuid": "a42c0047-a40f-4384-9cf8-91f95bae51be", "value": "T1F7252316B9D994A3ECB067B088F612831B357D900DB0937777A9AC5F6CB34E0597232B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666525, "uuid": "ef277206-1711-40fb-808e-b3ca4a67e159", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666525, "uuid": "d6335cc7-2c4f-4d19-b06d-b3cf031e34b4", "value": "24576:gyEhkjTSMPPvX80qdUe54VVAHbXV57gNVKvXIQIdOFXDUF0hCH:nGgTdE0qdL2iXV5ENIQQWOBUSw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684666525, "uuid": "335da4a4-e4ff-4e22-9a18-61acd96f2e83", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684666525, "uuid": "96cdee9d-fbee-44e4-beed-c91d261f6597", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666525, "uuid": "a15b01dc-9a1a-49c2-a3e9-51c2eec9431c", "value": "discord_token834.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60c04bc4-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684680435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680435, "uuid": "576c86e4-5ee6-4654-8827-074a35cfe42e", "comment": "Malware payload (RedLineStealer)", "value": "466d931b72895d615d4aa6b36807479a", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680435, "uuid": "89562d05-8ec2-4d97-b5b1-215708167f8d", "comment": "Malware payload (RedLineStealer)", "value": "5fdb268047dd353bbdb04d198a954a120848563a94ab929bbbfbc29a699d5fec", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680435, "uuid": "2eaad79b-492a-4ee6-baa4-aabe59dfbc56", "comment": "Malware payload (RedLineStealer)", "value": "11701f8e52536871620c6fa91f4c748a3d5f8cb4", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680435, "uuid": "66302e4b-5e55-45e2-8e1d-a0f11f8571f9", "comment": "Malware payload (RedLineStealer)", "value": "4415d20fd99991ec58e7294bfbd5191e7c564d53a8c87ac629a3709f24c09583afe2927adbd9b356cc9d4c5f044c40d3", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680435, "uuid": "438ddb77-9bcd-4a3e-9e96-df2fcdb96031", "value": "T1C7E3F824279F8934D6BB4E3DACB15CD076BCAC126952D7464ECCF0593A73B80EB116B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680435, "uuid": "47e57ca3-417a-41b7-b6d3-0e33b896d9de", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680435, "uuid": "896908e8-31ed-4667-b2d6-ff83d3916de2", "value": "3072:vV+m5cVQmRSx9WCEkEhPW67V8BjVhtZN8e8ht:vj4oihwlVht3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680435, "uuid": "d272e76f-199e-4a6a-a94c-d195d1d94608", "value": 148960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680435, "uuid": "14eb1667-4f5b-4923-88a6-0afbc169aed3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680435, "uuid": "96c6ca67-7b59-48d5-9014-682089d75d59", "value": "2454366.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2239d88-f7c7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684667284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667284, "uuid": "864f919f-0d99-44e7-87ab-d96bb61e1a90", "comment": "Malware payload (Amadey)", "value": "113cc9707827224c27681268bff214a8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667284, "uuid": "55bca4d1-75b2-4409-a67a-e99eb0391320", "comment": "Malware payload (Amadey)", "value": "60092d0d9b23bad1bb7954896066b8be5e69a9d74ab686a95280a410899d400b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667284, "uuid": "03709ae0-ad29-460e-803b-560443105dbd", "comment": "Malware payload (Amadey)", "value": "b682a816013a5a4fb683202fe9d2edb1cf82e38a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667284, "uuid": "c0734db4-21d8-4d23-b720-ddb7a5ff1e14", "comment": "Malware payload (Amadey)", "value": "3c0979ea90c816d4d8fb6aa22170cfdf4911d1dc921dc1053942452eb871e7a7f153b7a6feaa2b0ffd23a840a7c39025", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667284, "uuid": "6b7cf22b-7f7a-42f2-9f7e-4ecfb8fee09f", "value": "T1022522039AD89476F8FA17B824F2828B0636FC948D7DC71B62898C5F1D729A8587171F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667284, "uuid": "8cadf891-94c1-4ade-8e8a-0e8235cf88b4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667284, "uuid": "64ac98ab-ad57-4b77-8720-41068b9b0ef3", "value": "24576:myesCOP30D2BeKmqy3X+PyqmGz9PWzNfppaODCT2Fl:1eQf0D2EKmqy3X+Pyns+zj8OOT2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667284, "uuid": "d71899ad-ce20-477d-b3f9-e74cb36e58c2", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667284, "uuid": "8577ac52-4d6a-4d5b-8f53-7175e5177378", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667284, "uuid": "77483b6d-ec69-49ee-9e5b-8abb2eda18d8", "value": "client563.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49d77dd2-f7b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684658492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658492, "uuid": "e5d8b157-8d50-4e26-9d3f-cada70f074fd", "comment": "Malware payload (RedLineStealer)", "value": "ffbc6e94b4b05f0e81a6489fb7be20cd", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658492, "uuid": "404e0c7f-9a9d-4cbf-abdd-4bd5369b4bc0", "comment": "Malware payload (RedLineStealer)", "value": "6037ab6bd2cc94016cee131307a7b80bf632052c872f76632e855e4e57505c14", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658492, "uuid": "fce82587-99e2-4eca-a9ba-52a119e8ec14", "comment": "Malware payload (RedLineStealer)", "value": "2862ea287c73dff4332b46c87760de38d02016a4", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658492, "uuid": "f7d4c623-42f4-4bb1-9b2c-f9d70abb60d9", "comment": "Malware payload (RedLineStealer)", "value": "54c8b703f874da39ef7ca1eb09e9174e1c5397aeb9189f69aab4363750ccc6ec0f015c2a5e69d9735dc6f59ba16fdde8", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658492, "uuid": "eff3cf48-db0a-4253-90ef-9591c94c2324", "value": "T168252201F2ED9577E8B21B7048FA42830B72FCE65D78931B23586C5B5DB2590A83277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658492, "uuid": "c6365226-091e-43de-9285-a959894a82c4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658492, "uuid": "f8dd37b9-4ada-4845-b1a2-c1fd2fd36cdc", "value": "24576:iyocSC8thkFD9NuOvDoHb6Jyy8iXlmdd388+/tTqgt/6lGw:JoC8DkgOo+3jXsQVTqoSl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684658492, "uuid": "9adfb0d5-3974-49e6-8cee-1b7528d2f109", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684658492, "uuid": "47645df8-95cc-4dde-a878-658193f04c96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658492, "uuid": "e4992387-9ab3-49b0-a5a4-530e41250a7b", "value": "translator635.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4b1a56b-f7c7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684667235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667235, "uuid": "0386a294-8f58-43a2-ae21-c2375bf742ec", "comment": "Malware payload (RedLineStealer)", "value": "e2d2c3895ce7704bb8ca23294d882a0c", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667235, "uuid": "d43fbfd0-1b05-497d-aa06-46b42d722aa2", "comment": "Malware payload (RedLineStealer)", "value": "60b29c4a1537e119e3fa4b9b9e912c52181914d72da12cdf205901ca1b0774ef", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667235, "uuid": "c25c01de-355c-4f10-a006-f0ef6d906a2d", "comment": "Malware payload (RedLineStealer)", "value": "ddb17bf50863ee46e7e78079d61534189929db60", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667235, "uuid": "14e8cece-6bd9-4ec5-b2e8-61d76525caa6", "comment": "Malware payload (RedLineStealer)", "value": "14b10a19459ff462865c5f2dd6668b5e23cedeba79b64c41c9e6d767de642bcfc434da349953893b3212ce8740f9bf22", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667235, "uuid": "4dca8b43-a74e-4485-b626-4e0acbad4b7c", "value": "T14E252313D5DA8473DC75277058F606931B3B3CA1A836827B3791E95F8AB26E0943632F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667235, "uuid": "740a12a8-0eaa-42a4-8be0-a6a51e759f37", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667235, "uuid": "f64cbb1b-32cc-46c4-a6cd-e644352bba6f", "value": "24576:DyUqcdFc+qyZevdGDh24weQeF6R3Gu3TO3:W0dFc+qOeVGDhSeRQdP3T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667235, "uuid": "91df07e7-fecd-4db1-adfc-1ae120a5ce4f", "value": 1044992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667235, "uuid": "9f0ebbda-9344-4e82-aeba-4a261e958ee8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667235, "uuid": "7d44a970-510a-4be2-b7ea-972fa0e3b21d", "value": "909000681.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9030c032-f7c6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684666771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666771, "uuid": "441cea02-533f-44dc-b91e-693541986689", "comment": "Malware payload (RedLineStealer)", "value": "203aba96e9dd9ea94198e88660c068c8", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666771, "uuid": "4e81cc03-9878-460c-8b35-f2770d48a531", "comment": "Malware payload (RedLineStealer)", "value": "612351af0fb2669c3414b261d75d9022a904e07364a7bb2c21b91dabdced2f34", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666771, "uuid": "b311de7d-9b59-4c79-a5fd-4d19034333ac", "comment": "Malware payload (RedLineStealer)", "value": "235b3eacd990311027b87e42a2c45e5fb1de1afe", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666771, "uuid": "291a8bee-ff0a-4748-99b1-52944fcf03c8", "comment": "Malware payload (RedLineStealer)", "value": "d629b1bd7120c71ad7450a33d8c6b195eca9400103dc2712bc61587a0f19064bc723cd32a36810c9b1324c3ba8e8f859", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666771, "uuid": "686d25e0-0e02-41d7-aab9-d5e6ed3a5d25", "value": "T11F25230BE7C91162E5B02BF068FB03871B367CA529744267674A652B4DF25C8F9703AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666771, "uuid": "8dac7601-8d1b-4e4d-b792-a2d4b53366c4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666771, "uuid": "5ad1694e-7687-4dde-b73b-d6f7c141c66c", "value": "24576:Jy/s/R/lSLus0m7afe0QBDz0odPsocCEVF0/kaTbc:8/wSLu013PBbEVF0/kaT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684666771, "uuid": "5cbcb639-16be-46e8-98c3-52e72ca088cb", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684666771, "uuid": "683903bd-1be0-4e7a-b874-50a7f193b165", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666771, "uuid": "2d9138b2-269f-4c30-ba20-2def654f1137", "value": "preview289.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dba8775e-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684680641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680641, "uuid": "91dd563a-50b2-4fca-af14-ab73c63d7c17", "comment": "Malware payload (RedLineStealer)", "value": "e982f4a2c081e9658f17afb3dd783631", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680641, "uuid": "d5db70f0-e009-4930-814d-10413e7c920e", "comment": "Malware payload (RedLineStealer)", "value": "61b1b88f6ac4a8a0c9b1b5d75cd8d1c1417fbe3804a87a7bcc34d653c5911a6a", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680641, "uuid": "84270ff1-1c85-46d0-a431-b96f60ef6044", "comment": "Malware payload (RedLineStealer)", "value": "187f9229b397ac3d5522db2faa360c7d11769d0c", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680641, "uuid": "9166e80c-a2c8-4c8d-914a-6d5be124afbe", "comment": "Malware payload (RedLineStealer)", "value": "3f9970032593f7f97a8d4c091e93923bbe54ae567b50928a34594c3b21ec50fd9963b3a3c160e662b5e755c3642957d0", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680641, "uuid": "18c888d4-70f9-4d0e-9c6c-96c90ab94c03", "value": "T10E252213BFDCA536ECB91B719CF701970E35FDA09A39C35B6390A9590C71A40E62272E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680641, "uuid": "f6777dca-055b-41c8-844c-fb659cd02e79", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680641, "uuid": "a3b9f1ac-d842-49eb-93d4-91a174590fd2", "value": "24576:qydkvOWxPdBptOS6XsqMteyI6rX/gduG4/PjQ0ZXTtbE:xdkXL76XsqMgyIaXY03/rLpT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680641, "uuid": "b0c7ba75-087d-4b19-8014-a25bb860eee6", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680641, "uuid": "d694c39e-5f66-4366-aeac-a40b40f6fb3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680641, "uuid": "02d28227-bfe0-4b47-bde3-3d999daa7fb2", "value": "publisher710.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9545fdb1-f7c7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684667209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667209, "uuid": "ba87e678-7c7c-4d8b-a333-a78608fdd2fa", "comment": "Malware payload (RedLineStealer)", "value": "99326c6e1ec2edaaac919919840b06bb", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667209, "uuid": "1364b268-e774-40c6-ab23-1ae2894fa539", "comment": "Malware payload (RedLineStealer)", "value": "622ea6cef22716fb96b2dfe87e7aa573c48b493031aa2d5b3ca6b106089ae96b", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667209, "uuid": "2741a921-d50e-4af4-a80e-6a69ebfc37fe", "comment": "Malware payload (RedLineStealer)", "value": "200b0c19ec6350fec608e255d58eb4338d8f762c", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667209, "uuid": "45602fc0-8340-4e8c-8944-22d2eb13966c", "comment": "Malware payload (RedLineStealer)", "value": "bfedc4b6a922a7507db30b664975fa4c76ab59d57bd14d766246dd46aa289062796240ed494566545971e3b3ae1d2986", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667209, "uuid": "0998bd84-b9be-4ac7-a794-bbbf6b224f3c", "value": "T194252212BADC8A63DCF5A7B59CF603930A36FCB1AD3483576645E84A0D72950387873B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667209, "uuid": "e056e466-2db2-41af-a3e7-9ec5a8714f97", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667209, "uuid": "50147e0e-5531-4acd-86cf-f60af79ba09b", "value": "24576:Nyu/luxbV4jqdpu+pClilO8t2C4xthwQ3kzPSL:ougijqdplp02Oo2vthwS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667209, "uuid": "2a70d7c2-050d-4d28-bcfb-60f8062835c9", "value": 1056256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667209, "uuid": "f8e25b58-41e4-494d-a2a9-f8af1eac3ed4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667209, "uuid": "1b4cf6d8-3e71-4644-8d82-a2792596554f", "value": "26324408.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc8a5f05-f7c8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1684667812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667812, "uuid": "5e8ae30e-1368-466c-b258-6b1986adffff", "comment": "Malware payload (Stop)", "value": "281550746706e36c1c88850f60620078", "object_relation": "md5", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667812, "uuid": "eeceeef1-fe33-4059-987d-ad69a874cf77", "comment": "Malware payload (Stop)", "value": "626b97523ea1c89f3337be39efaa901c3a39d26bc108cc0c5d9e2eaffb2b79b4", "object_relation": "sha256", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667812, "uuid": "5b494dd2-ddbe-476d-97f1-780041624bf7", "comment": "Malware payload (Stop)", "value": "17c1d76385c142f13b44cababa2d6c85b2a7d575", "object_relation": "sha1", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667812, "uuid": "f57516a5-52c9-4d64-830c-e1d7101820e3", "comment": "Malware payload (Stop)", "value": "1bad31dece727b257e4c06d77de6d01b6ec7932f60959440e0f75f16ab572b54aac3633b5b713896d40a0462e69e20a5", "object_relation": "sha3-384", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667812, "uuid": "f896d17d-3d45-4eb5-a9bf-510283bda28d", "value": "T19E05D003A2D1BCA2E9614ABE9E1FC6FC665EF9504F0D2B9762546F2B10710F3DA72341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667812, "uuid": "8fd3e2d4-5b88-4e61-8db3-1f6c52b1a58a", "value": "f682da34b918ddb61703d12aa2522a66", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667812, "uuid": "70faebac-4b68-461f-8be9-ea3264a95e53", "value": "12288:LyUIne8H1reUEl//KaLYXrYISvJnuc77nxv7bL6vUUOEaBxuqeJexuuFjcP:ZQVrehBY8NvJntvn3UvJe0uFji", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667812, "uuid": "47538932-bb39-4c25-9438-8f4f25a86420", "value": 842240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667812, "uuid": "956ff981-00c2-4fb9-8169-579b13a2b7aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667812, "uuid": "25f4b5ce-853f-4fbd-90ad-d385b788edfc", "value": "payment460.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "590a2a55-f7ee-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684683858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683858, "uuid": "593219f9-8435-4f32-b7af-42ecaa78f6d1", "comment": "Malware payload (Mirai)", "value": "512081de0dd596d64f9856be331d6f36", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683858, "uuid": "4123b4f6-892b-4778-b38e-09e0ee276ce9", "comment": "Malware payload (Mirai)", "value": "6274d8a1753c5c2139c7ab3bf7c1e07d16543b0c3504f537339ab249314308d0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683858, "uuid": "e05b09c3-59dc-403e-ba6b-249f4fc62994", "comment": "Malware payload (Mirai)", "value": "0d49236782c211b6ccfe5ed5ed10d94079a2095c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683858, "uuid": "51ac00ae-f48e-451e-b158-3405bfaffdcd", "comment": "Malware payload (Mirai)", "value": "49b600c78be3628d7e139eae3a9c7f55de598aeb85614a2e4b4e68cad7805afe123f49369af84458ff8479f6fab7493d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684683858, "uuid": "071a4cb2-3826-4ea2-94c0-439e2e515383", "value": "T12E632951BC819A13C6D1127BFA6E028D3B2613E8E3DF73179D225F2037C696B0D27A95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684683858, "uuid": "adb8938e-f2f5-4e41-be4e-d7ce7ce98f97", "value": "1536:qNSlxYmii8N1U9uO//kWEjLPikg/QA83NRuxAvjW+:qNnK7ktnPikg//29j3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684683858, "uuid": "4fc7b06e-1a8e-4c44-ae0c-90b9e1bbc0c7", "value": 66924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684683858, "uuid": "1241be5d-6664-4dde-a461-eea77c4c28f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684683858, "uuid": "a0fa303c-5b73-4042-be9c-6c72ead611b7", "value": "512081de0dd596d64f9856be331d6f36", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ffc1870-f807-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684694715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694715, "uuid": "3a3331e1-2b1d-4aba-b4b1-e58f661b7bc4", "comment": "Malware payload", "value": "a15a5ec43c1fc178f809a533b87e2c72", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694715, "uuid": "a065ecea-20c3-4013-b8ae-89e8bcf0d832", "comment": "Malware payload", "value": "62853a90047c8b06a44cb0c0dc68847e02b058fba9842e609f382c5cba6f8bbb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694715, "uuid": "d6bc7917-8131-44ab-8860-19b6690827cb", "comment": "Malware payload", "value": "5304d1fb751ca67aa90b0432f92e7ba58514bdaf", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694715, "uuid": "a0603e1a-7417-4bcf-99cb-605b127b8398", "comment": "Malware payload", "value": "405c9e030e1cf37959712ba5f2cd0b2def18d3bfccfcdbd39ca81a8908c119dab1ad999ce0c2eb7e63b95024cdc30ee7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694715, "uuid": "1f20712a-3e48-4847-94a1-5bf8c80923b9", "value": "T183252303BAD85063E8B567B054FA07C31736FCD28D78D22B224269D75D325A8F471B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694715, "uuid": "b2d1839d-8d61-418d-9f6e-3251b54c6aa5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694715, "uuid": "d119e325-1620-4057-b238-a3356d53a9a0", "value": "24576:yyfZAyQIRIHqKrxp52d62BkC/g7dC8NlLA8H:ZhhQrHqKtp50XBkQg7g8DA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684694715, "uuid": "4385bb28-bf14-43b2-860e-845e561a6b17", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684694715, "uuid": "a2a7c4b6-cd0d-44d3-b441-6ff1e133b56e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694715, "uuid": "80615ef5-671f-415f-a760-291c1d7d1b59", "value": "99242935.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "346f8669-f7b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684658456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658456, "uuid": "d908059c-2320-4279-9e75-ec05ab35505b", "comment": "Malware payload (Amadey)", "value": "aeecbcd6bb185666320584faaa45dd00", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658456, "uuid": "a988a839-f893-4f64-a8b3-c0754f8df81d", "comment": "Malware payload (Amadey)", "value": "62b6e7cf7df3f792f95a22c2fd7eb63928aa38da05da74daf9e3f3962c286abd", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658456, "uuid": "8660579a-a7f7-4ad6-a00e-12ed69e9f3fd", "comment": "Malware payload (Amadey)", "value": "491b4e5847ce24d8029d04182640eb0f890e85c3", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658456, "uuid": "6f5be915-45ef-4444-9563-8a11eed6db3d", "comment": "Malware payload (Amadey)", "value": "c5311e437641b14d4b1fcbc7ae9fe832fbd7457ed82ccb40ac754c13989f77fcb48e4010658149f2d1b56d56b7232462", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658456, "uuid": "c486d87a-6298-486b-a350-60f951687c17", "value": "T1A8252307A7E49566EC742BB448F607E30B35BD206E7883AF1708A85E5C326C1B8B1737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658456, "uuid": "3f345f6f-22e0-4075-b707-c98af431a9f9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658456, "uuid": "c3492f00-d5c9-4881-a6a5-140f83f4ef8b", "value": "24576:By0xwQOi/N336qf9DjwuCep5WbaFzeyqTbJfp6DmcR:00Ki/Naqf9DMuCep5W+wyqTVfp6DL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684658456, "uuid": "12f296c2-1664-4672-b69c-c98a54b0f4a5", "value": 1054208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684658456, "uuid": "aa767fc1-ce08-46d3-b45d-26d1e915d6dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658456, "uuid": "8add5af1-2d9f-4bee-bd7f-0534881a5a8a", "value": "listener643.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e056d7a3-f808-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684695252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695252, "uuid": "0569bce7-5534-444c-bd73-f65495da148f", "comment": "Malware payload (RedLineStealer)", "value": "b6116407cd4b43b456e23fdf2facc1e7", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695252, "uuid": "906810be-0660-489b-a1d9-f7804c452dcd", "comment": "Malware payload (RedLineStealer)", "value": "62ed80c8da63ad77e41a480f21c18d05b6721d5d43b86b4b28e057d22eebdf2b", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695252, "uuid": "0e0543e6-9349-4198-9e37-2930c639075f", "comment": "Malware payload (RedLineStealer)", "value": "26bd2bc1e501d8925529f6ff15c6206414ab9f82", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695252, "uuid": "d7befe0e-3d53-49d8-aafb-9ab583346085", "comment": "Malware payload (RedLineStealer)", "value": "c3ee1aac14d3d6c973da92a7112e0d93dc00ecf500d32ac01f145a079385c38af4b40e51243f543c8664f3b92a386c07", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695252, "uuid": "7d9af9a9-a5e1-48ba-a8a1-c648cdccad9b", "value": "T14FE3D528279F8934D6BB493D6CB19CC076BCEC52A542D70A4ECDF1593A73B80DB116B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695252, "uuid": "7d0b703c-37c8-485a-9925-8b22f8e1c1b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695252, "uuid": "12c324ba-cdec-4d0b-9be8-984fb1db5129", "value": "3072:PV+m5chQmRSZQ1avem1eJwfUuMyNiOhjZR8e8hX:PjENURTIOhj7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684695252, "uuid": "dcb3fd14-995d-45ff-8ea1-fabe4fba3dc4", "value": 148654, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684695252, "uuid": "ac3a101d-9230-41c1-8df2-05006e9ddcaa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695252, "uuid": "a4c872ea-7867-48d7-8000-99f6fa6607f9", "value": "LightCheats518.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e407a38b-f7c7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684667341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667341, "uuid": "55bf05e1-dfb5-4811-800f-ae610bcf9183", "comment": "Malware payload (RedLineStealer)", "value": "87b043987f3f3a71692557dbaeab504c", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667341, "uuid": "b12a19f2-a5d5-4e97-89bf-530f1e5a3c11", "comment": "Malware payload (RedLineStealer)", "value": "634e8cc3c16f4eea1d7576288ea6bcab02f63258aeaeac8664d55a78760bf2de", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667341, "uuid": "f27df353-323e-4556-96fe-71da91fb81f2", "comment": "Malware payload (RedLineStealer)", "value": "a729e6fafbe79aa669a779da6eb98175a1c0fa11", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667341, "uuid": "7d5d939b-5a6e-4452-8cac-c9cfe6194166", "comment": "Malware payload (RedLineStealer)", "value": "7a65eaaa44f4bcd3695cebe0fdc59f35a148b0e89b4fa3d24b5d78bf8f017c8831074ccb5ab4478c8f54e36ba955ae25", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667341, "uuid": "3f5ac925-0678-4bce-a669-468805188bb3", "value": "T15A252313ABE89072C8B1473099F706C31A36BDB16D78433F3752B92A9DB2990957437B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667341, "uuid": "a61c9abd-98eb-4a4e-a792-217084b367a1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667341, "uuid": "afffdbf8-6266-4629-bf30-0cfb104c7cfc", "value": "24576:Xyjg7VgEmEDX3qVUdDa25ML1VgNf3KNrTyl5P:ijg7V3HqM3+hOwrT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667341, "uuid": "03a5d83a-8a11-49b9-a33e-264073d81a3e", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667341, "uuid": "657f6cad-5211-4823-bc37-1e2b4fdc9e3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667341, "uuid": "23bacc4d-39d6-446e-8a42-bc56dca39df4", "value": "invonce290.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65eed33c-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684680444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680444, "uuid": "bef5180f-3ced-4383-b0dc-1e221e4242f2", "comment": "Malware payload (Amadey)", "value": "203a3010cb59fc92e482f9e4a6c4f906", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680444, "uuid": "68641907-0247-4ede-9a7d-04400078a2ff", "comment": "Malware payload (Amadey)", "value": "639fb290fb7074d74e3cf9c329ae01949fb7268e1a654e55d28aa53513869420", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680444, "uuid": "c03a5252-b4b4-4d9b-b856-5e74d3bd8842", "comment": "Malware payload (Amadey)", "value": "26aa4ac8e4f6a9dc40dcfeb8b650e7625a78d01c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680444, "uuid": "bb685711-1143-4e61-a718-46e9b54c8534", "comment": "Malware payload (Amadey)", "value": "76939403270e730652bf3c37c9e9330ebdd5cb743589d704c7c696945a3545157295771925e7f30ad45fe40662b63db8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680444, "uuid": "60b26b0f-bdf5-4d04-9ef4-bdf9d2b599fb", "value": "T1682523136AE99436EC752B346CF712831F79FCA48D34536B23299C160C72A54A932F7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680444, "uuid": "1ab0a837-fca0-4791-89b3-d357340ed087", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680444, "uuid": "777b6f8c-c6dc-42a1-a8fd-19cf756350d6", "value": "24576:SyyOGVL+Psq9uP0Ap8LKdcUpGkBF9crYl4nx7LCp:57GIsq9uPrNjp1F9crYy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680444, "uuid": "9a77741c-af1e-49af-a159-769782903167", "value": 1046016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680444, "uuid": "588494a0-5561-4dec-a8ab-b2760fd6c523", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680444, "uuid": "639d217c-2381-49b7-966a-cbef20c2b060", "value": "26324675.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd37ccd9-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684680644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680644, "uuid": "988c82cb-c4d8-49e4-abf6-10e214df9342", "comment": "Malware payload (RedLineStealer)", "value": "a68e33e245254e2911e94f1211a50b86", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680644, "uuid": "f0232e4c-2989-47d0-b7be-0bcfaa4316d3", "comment": "Malware payload (RedLineStealer)", "value": "63ccff2bced3d71ac691f096fcc5d70fc8034fb08244f390dd003e150f393192", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680644, "uuid": "50bfaa0e-e9a0-4e81-891c-89808ffa937c", "comment": "Malware payload (RedLineStealer)", "value": "ea71cedfaa3647bea0dca9b19fe0867341f5f5a7", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680644, "uuid": "34e2bd2f-3bef-4215-947e-523c4dafa0f2", "comment": "Malware payload (RedLineStealer)", "value": "6cc82117330ecdae667800981759c37fa1755687d1a0d5f51ad4e89a904d38e23f6a6d6b7ec3a2ce5df07a6662c23763", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680644, "uuid": "07f16a80-8859-4d4c-980d-112ba1a4851e", "value": "T154252202EFE88072D97A177894FB87C70B79BE6688F4862B1745F54E0872A02DE74357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680644, "uuid": "b379a7ff-4c8e-411a-9420-d54eaaeb3d34", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680644, "uuid": "2c4ab1d0-584c-415a-a0b5-0bcfa5c085ee", "value": "24576:HyYhNmdJ8pH2mMqXW/UxNviK0zZ+VdiGb+Jf+:SYw0H2mMqXW/UJ0l+m9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680644, "uuid": "98aea5a2-d90c-4b8d-be95-93f56a47c6e5", "value": 1046528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680644, "uuid": "4cd77c22-df93-4f86-bc07-200493ccfca5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680644, "uuid": "80697ba9-57fd-42a7-86bf-fc66fd519965", "value": "readme361.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be4d6342-f809-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1684695624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695624, "uuid": "d9a0e651-fa7f-4377-aa80-6217210f04cf", "comment": "Malware payload (Gh0stRAT)", "value": "aad6f96ca500b4a2c5ed8bee80ff7f72", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695624, "uuid": "3f580f48-084e-4ac8-848d-b2cd8925bd98", "comment": "Malware payload (Gh0stRAT)", "value": "63d9ed8fa33a63b67ce052883c3cc390324b53b54c45545c90704208f0b65096", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695624, "uuid": "2daa0739-eede-40b0-a124-b0efb78733e5", "comment": "Malware payload (Gh0stRAT)", "value": "dc4a120831e8ddaf118605e52ee6f77d989ea471", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695624, "uuid": "84043c43-924c-44ac-aae1-1cddaf1c0e53", "comment": "Malware payload (Gh0stRAT)", "value": "b58ce9a57b4005be9c5889dac7f8b194f929ed3da300b5b25a6144ccf2f82150a128f2d85a435cf3295dbe33b5460491", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695624, "uuid": "c4dac565-24e2-410b-854e-fafc801a1a3a", "value": "T14316AE33FA52E0B1C185167009666F367A774F251D26C5CBA3E8FE26BC713629B33129", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695624, "uuid": "aaabf59a-84a8-4883-b849-f393608f28a5", "value": "bb9d495821e6e730a7a07045d899c977", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695624, "uuid": "854c9cb8-5450-4fcb-9321-c27ea6f36821", "value": "49152:NX4uXjo0ZQljG83V1T8ZOXRuZFoowSrgnyw5CxGV3ChyQ0qp:h4uTo0ZQZ32URuFbXMnyw5CZAw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684695624, "uuid": "ae7d2fe7-aacb-421a-be42-654e215c1ef3", "value": 4249851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684695624, "uuid": "006bc2a2-f6fc-45fa-88a4-8b02d38006f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695624, "uuid": "5ef9512e-ab00-4a1e-b711-18a2b382ebb1", "value": "aad6f96ca500b4a2c5ed8bee80ff7f72.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0d64132-f7c5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684666477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666477, "uuid": "155a6ba7-29e8-4975-a836-ab01c9678c07", "comment": "Malware payload (RedLineStealer)", "value": "939c4e27333ec3a12cba4ad406e49074", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666477, "uuid": "647e0cd7-7bab-423a-90bb-df2625c53f55", "comment": "Malware payload (RedLineStealer)", "value": "63fa1e96113b3fedd50929358400de72a159337dcfcb5735b7feaf5e0a765736", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666477, "uuid": "e663f18e-699c-4b56-b046-f34d8109ded2", "comment": "Malware payload (RedLineStealer)", "value": "9a7e29ea97e62186459e3aa5c5d6909d4322fec6", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666477, "uuid": "f98468cd-ce54-449e-b920-c85fa1a2442d", "comment": "Malware payload (RedLineStealer)", "value": "0b10b601c908a76371fa7aa0acfc8e1a04e80ccf647ee34ba3031d8224179ad6940a432f54fc76abb3d3e6a0de566b60", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666477, "uuid": "fea5d38f-65e1-486f-b1b8-573eee8df8e5", "value": "T198252303EADA4033DCB113B408F906571B3B7CE15EB982E6365AFC9A1CA35C5A57173A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666477, "uuid": "6343fa0c-77e9-4901-b640-b215f1aaf977", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666477, "uuid": "f83b23b8-c285-420a-88b2-d0044457409d", "value": "24576:sysx3rnNOLIqcR6YOsIa+2fpwXlCm9AJcbGeBTYIUIpZP:bErNyt9jT2fpElIJ0pTFZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684666477, "uuid": "85da067b-67b8-405a-9ac3-353c81401879", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684666477, "uuid": "f025e560-99f1-4af8-87e7-5a057cea3b32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666477, "uuid": "3e1cd1d0-2e63-40fe-b495-e778828c97c0", "value": "config115.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c33329a-f7b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684658389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658389, "uuid": "11a622b1-66dd-4dc8-b417-b3acfbc0fb5d", "comment": "Malware payload (Amadey)", "value": "68de4fa42c9b98715b516d7276eaf409", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658389, "uuid": "4d17b190-1c91-4e0b-ad87-6dadabd544ac", "comment": "Malware payload (Amadey)", "value": "645367485855064a6ac63a88c28f47ff39e4a26b9c164e8794c1f88289d27dea", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658389, "uuid": "f0dadb3c-e032-41ee-95c2-4b2211f94c55", "comment": "Malware payload (Amadey)", "value": "fd7988b81a4152af04f68341868b72c27b650c59", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658389, "uuid": "a02ebf9e-471b-40f3-8737-c4a228c222fc", "comment": "Malware payload (Amadey)", "value": "27927c9d0a283ce173bb49fd1ee5b9fe79b9ea51a5537441c750f7f1d58a43e3c9b8ef0ef1e025baef5e0183c89234b7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658389, "uuid": "a6ba57c4-ceff-41a1-b9cf-3dd96f40336c", "value": "T19B25238667E44572DDA63B7098F603430736BDE0AC35C63B2105AE9F4DB369098B13BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658389, "uuid": "b0ef7175-b0b7-462e-99c3-88a85cadaf77", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658389, "uuid": "28fea5d4-2b5d-4b54-bf47-aac7e1035653", "value": "24576:5ykNz+3k1qIR7X49BaSRuSN/eSD1uROTzd5zsp:sWzuk1qGL4eSRXPD16OTzdRs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684658389, "uuid": "d45995d1-c4d9-4328-846b-9f46553dfdba", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684658389, "uuid": "76e9cefc-e1e3-47f3-b3ff-8496e387feaa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658389, "uuid": "fe3ddd70-5f64-4684-bdcd-512c8d1deb92", "value": "35647589.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b9d79b7-f7b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684658388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658388, "uuid": "98c80ac4-b1a4-4942-ad7d-b48311210efd", "comment": "Malware payload (RedLineStealer)", "value": "55397f38ec7bd01b3918f1582bd44b4f", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658388, "uuid": "701658d2-df62-46dd-9f64-789db70ac39f", "comment": "Malware payload (RedLineStealer)", "value": "6484cad28aaf9380826dc4dbab412a4b23e8bd18c0c582a51d8f7e57f20c5e7b", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658388, "uuid": "663cbe37-0751-47dc-a98b-b21ff8560d58", "comment": "Malware payload (RedLineStealer)", "value": "e073a28e26c8f63b4c2b5ec9b9231f3b905fc41a", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658388, "uuid": "58be9f65-ef72-4de8-a7f0-e416ecacfe1e", "comment": "Malware payload (RedLineStealer)", "value": "99c7f4fea9c63939d782f2d235c3fe21e94f74a0b5dc920aa6fa8d162b5ee2c0431fed35eacc44d8e1f5c4cbd61841c4", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658388, "uuid": "ad5948e4-717b-4de8-a87d-95006a5e1607", "value": "T1ADE3D624379F8930E6BB4D3D6CB09CC076BCAC126552D74A4ECDF1593A73B809B216B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658388, "uuid": "ffec5f0b-7477-49ad-a1b2-178db8ba929e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658388, "uuid": "36ffc81a-24f8-4e74-80ed-fb4ffc6ae8fd", "value": "1536:o2BGlTP+mZP61sEYDmRSNIgcscLDuRwH77+u8oxQKHbuxGBNM740wuei/Qv+R+Fn:6V+m5cvQmRSN90+82iTi74h9ZF8e8hU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684658388, "uuid": "23b457d7-d50b-49bc-90e9-945c10e37885", "value": 148527, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684658388, "uuid": "d42c9389-cef2-43e3-bef9-d98568f050aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658388, "uuid": "b146723b-9c38-4134-8091-9244811f6364", "value": "35352497.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ddba487-f7e5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684680108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680108, "uuid": "7c29b419-b6c3-4718-8836-4767e6f3c273", "comment": "Malware payload (RedLineStealer)", "value": "5932603eaa23449d9e18c8afff821bba", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680108, "uuid": "a0258d6c-cff0-4e2a-b35b-f9147e169cc9", "comment": "Malware payload (RedLineStealer)", "value": "64b40a5440f9be1efe32c422f8fc0ee3ef328885e9b96298ef055b9ff3220385", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680108, "uuid": "f58d6df2-7f0d-4928-a171-df86397b10b7", "comment": "Malware payload (RedLineStealer)", "value": "c21ca3ad003762e533916922cea4ed3dae87c1d8", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680108, "uuid": "c7cd050e-06b0-4733-beb4-043acabaacbb", "comment": "Malware payload (RedLineStealer)", "value": "2a07149099e7aa582e8f9354b32888995821cb57e69fd1cf5c3bdb8baa561783c7a48c5a45fd8236103bb6a1dcab918a", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680108, "uuid": "9ac15e54-630f-43ec-8862-97cd0313e889", "value": "T1EC2522137AD90433E9B127B06CFA06570A31BEA2DE34D1172B8AA56B9D736C43D70727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680108, "uuid": "90c77574-927d-4ac2-8e1d-2400f7125c90", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680108, "uuid": "ebd14fb4-bcc0-475d-9618-8965e481588b", "value": "24576:5y5g788fMJbBrrW6qauDMW7g/IUuFkUX7+s:syHfMhBvW6qa2t8/qkUXy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680108, "uuid": "832bda0a-4066-442d-be33-d19e2642aa53", "value": 1056768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680108, "uuid": "1449b93e-4e1e-4cde-bd1e-7c80423cf3b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680108, "uuid": "95a5729a-d9fa-4988-b29a-73eaa5ea9289", "value": "publisher587.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0a1946c-f7c7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684667308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667308, "uuid": "dd74c208-cae8-4b08-85ea-77cfd0135a47", "comment": "Malware payload (RedLineStealer)", "value": "045ca852861d3e5ffc5be99ebd87de30", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667308, "uuid": "48c1ffa5-99f7-4630-8847-fcc76ec738b3", "comment": "Malware payload (RedLineStealer)", "value": "64b4e54c61d3dffdb008eb6aa95cfbe5dd38b171a8ab623121f9d2d6f30ffb37", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667308, "uuid": "6c071cf6-26e3-4bbf-93f0-3b0420c49c55", "comment": "Malware payload (RedLineStealer)", "value": "a916fe6a6387a4f53fa4305d075828c504a1f09e", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667308, "uuid": "c0b35adc-7d23-4710-9c50-fff7bacfd4c2", "comment": "Malware payload (RedLineStealer)", "value": "5c8e233a7a99e3a209ad3b4c42cc862114e8ed40595325c7fe70f369880a78d1ae1c0b913905db30676961d48a7dfbbd", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667308, "uuid": "3b3856b7-1b23-4393-b2ba-554047bb5a47", "value": "T14D252317A6DC4123ED7423F048FA079B1B31FCE54E64C32617C2A9892D726A4D6717BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667308, "uuid": "6b2b90f4-efd1-4b14-afb4-d70e3f2156d2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667308, "uuid": "18d6a916-b264-488e-a32a-feeb843d17b3", "value": "24576:8ytCBsZ8CRh7g1445oqe+WmkanX+dbXz:rsByry1JzLX+R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667308, "uuid": "34396f9f-1b37-481a-ab41-1342797e1129", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667308, "uuid": "dac5fdad-5120-47cd-99c2-b95756382453", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667308, "uuid": "1344279c-5baf-499a-8be5-41d644c37e64", "value": "effects902.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4bb5e7c-f7c8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Vidar)", "timestamp": 1684667798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667798, "uuid": "bed73210-0a77-41d8-8603-16845c008dc4", "comment": "Malware payload (Vidar)", "value": "55282168913af40d9ecd565c55c538a4", "object_relation": "md5", "Tag": [ { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667798, "uuid": "4a842e28-b347-4852-a7c0-c795c664b104", "comment": "Malware payload (Vidar)", "value": "64d5c80cea4e5bbbd58b1c0e1b81c95473c928db32def4c1ba094c8d0dafbea2", "object_relation": "sha256", "Tag": [ { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667798, "uuid": "98f583ba-4596-429b-a6ae-0548d0ac4da4", "comment": "Malware payload (Vidar)", "value": "993f073da27eee89b779f8cdf3cb5880428d304d", "object_relation": "sha1", "Tag": [ { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667798, "uuid": "1391f30f-fd96-40d6-a51c-8a82e7e6225a", "comment": "Malware payload (Vidar)", "value": "bc5de44ea536c6736248adbd0c1ca4e50776889b7cf736f26fca2aca60fe950ae2ccbefe3f84f29f924338819d6304ab", "object_relation": "sha3-384", "Tag": [ { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667798, "uuid": "b9e640c4-a9f1-4a56-9870-ae0280122d20", "value": "T1F405E002A5D1ACA2F926467E8E2ECAFC726EF4504F1C2B9762487A2F14711F3D673741", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667798, "uuid": "3156bd9f-ceeb-4c62-a07b-fd47cf366c46", "value": "f682da34b918ddb61703d12aa2522a66", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667798, "uuid": "9acf80b8-416f-4c8e-a522-57a652808784", "value": "24576:qcqx6C2MfoOrNv3jCfWuuc+rdpEkClaShj:qlxB7CfWuwCl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667798, "uuid": "978cfc8e-a1aa-4c48-9849-4ca0a3b9a59c", "value": 841216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667798, "uuid": "14041ebd-df23-41db-b927-dd1ee4f5903d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667798, "uuid": "a16f8fec-1641-40dc-9503-cec229d74d0d", "value": "installer530.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10351c15-f7b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684658396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658396, "uuid": "e2385e58-464a-4bf1-9c07-3b93a7b92492", "comment": "Malware payload (Amadey)", "value": "1067fd202dd980b14492811f4016304c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658396, "uuid": "bc10d5c9-e685-42b1-a630-c15b3fbe5bb9", "comment": "Malware payload (Amadey)", "value": "64d7a9b192f2d21ad06844c929711ffc179585a6859c3eb75372596b6569fb9d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658396, "uuid": "024b2915-5b44-49f1-967d-703dc0c7dbc5", "comment": "Malware payload (Amadey)", "value": "ac6d1f313a5ce8e2d2b212de52bdb8739758ec76", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658396, "uuid": "1867e46f-f43e-4479-92ed-650ac707d127", "comment": "Malware payload (Amadey)", "value": "c3ff32cfb920dfbf8de475d6ce89d1aff2e993826b4adc717f9f89af8db87fa1540456ac85aaef774e5ad0a0f22f27b2", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658396, "uuid": "3018566f-1aa5-44ba-b643-53d948074f50", "value": "T167252342ABDD44B2DCB9173064F2829B0736BCB04971C6AB3716DD9E8DB37809931B97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658396, "uuid": "a4feba32-a332-4074-9f3b-5591ea90fdd5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658396, "uuid": "0c43ebb8-ec04-4a7b-983c-d4dd97fcc085", "value": "24576:Qy4ZyyK8LAl747WLqCYHGDvDaOC8gpC0cHEROrcj9aU92kbl6v:X4ZyynLAl75LqCvDatKHFcj9195bA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684658396, "uuid": "0dac6dff-2c17-4701-a780-4c8e0bb77348", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684658396, "uuid": "218b8f73-7f54-452c-ba01-61247f6ee866", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658396, "uuid": "afbdad13-360d-4140-82a4-b8606f2a3a6a", "value": "7463534637.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97c9ae91-f7e5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684680098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680098, "uuid": "94aed09c-b0a7-4e7e-8750-b97a142aeeb9", "comment": "Malware payload (Amadey)", "value": "2510e5d147b2ce9ba0d93c7e3d4dfa54", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680098, "uuid": "4903ab8b-6e4d-4448-a7d4-785e34c3e260", "comment": "Malware payload (Amadey)", "value": "65013a48dca32c49f2d895cf5fc4ba2589a739b03e014d3aa25e2bd78e358323", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680098, "uuid": "fc4fed4a-050f-46d4-89e0-32f73e4e00d4", "comment": "Malware payload (Amadey)", "value": "a5933694bd850e45c1c57c2c76c19dee8e6e92ec", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680098, "uuid": "b202a778-a72b-4fa7-b8f4-ee1cea89c29a", "comment": "Malware payload (Amadey)", "value": "3f8b8a5ed12eaded5ae35f9383dec87fa8d5529283595c00596a3d5664cb3213c119a4f567db24a7c066eb4de77c0744", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680098, "uuid": "e2d66eb5-b83f-4b1f-9541-5f5910cb2438", "value": "T162252357F6ED656BECF8073098F603871B35BE910E38972A23849A4A08B39D5D43573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680098, "uuid": "f7e8b6b8-f45a-4e6c-91a5-b63e3fff6c47", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680098, "uuid": "3ccf45e8-75fd-4e49-a4f2-cd44a617b069", "value": "24576:lyvkx+UBg0392JMeZZb7lhB+p9baK0PkeT6CR5NgYAcizVBEyv:Aa+C3AJMeZp7F2D0P56/+izVX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680098, "uuid": "09c629ed-71ab-4c7e-aeb5-6de9ebe24d76", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680098, "uuid": "d8be4396-a703-4666-92ff-5c2c73d1381b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680098, "uuid": "da84569a-760d-493a-b655-a12a99012b3a", "value": "logger494.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "098de228-f7c9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1684667833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667833, "uuid": "5c6b7774-ebe4-4aa5-a6c6-9a068f9fe0b3", "comment": "Malware payload (Stop)", "value": "9d9ea753f4253f24e0e20f695fca5dac", "object_relation": "md5", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667833, "uuid": "5ad68eae-e1aa-4fed-a798-b5c82807fdd8", "comment": "Malware payload (Stop)", "value": "6539aa04acca8afc6099c414182f73b939e8151adc7093087b1460b199657310", "object_relation": "sha256", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667833, "uuid": "57219572-1f5e-4428-acb7-864a4949d486", "comment": "Malware payload (Stop)", "value": "69dae6a6f96f3795ec74ef4cb098047dd9bf2c05", "object_relation": "sha1", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667833, "uuid": "76d55345-8ee6-49a5-aa57-cc48847f56e8", "comment": "Malware payload (Stop)", "value": "8e0a8cca60a018d5e6191d37edafe7f0a32585b3eb5045ad4d6189d0d814b6f710da1836fcc5c3090504b79a1623833d", "object_relation": "sha3-384", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667833, "uuid": "d4ad4807-ba9c-4be1-ade7-dbd89658945e", "value": "T17605E0029291BD61E52256728E2E9BFC721EF9608F097BDB22187BEF14701F2C573716", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667833, "uuid": "2a27ace6-5d6e-4597-b42a-88cbb86dfe17", "value": "d3185d759d0419b7cf5b47864af3fc7f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667833, "uuid": "1d66c6aa-622f-4604-9fcd-f1f8601e0682", "value": "12288:3aOVHsQohw9TrEzpdlKVt+cBG+cb72PiwXYxJJrXcYV9wiNE6yT1CLxIYbx/6+:3DHsQMcilKLpkTb7Uox/oniN/mUbxi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667833, "uuid": "9babe973-7bc8-44d5-9d65-9c692cbaddfb", "value": 847872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667833, "uuid": "4941c1e1-c390-4a6d-ad21-592e8c0859b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667833, "uuid": "81d603a6-d505-446a-bc6c-becc0f2bdea2", "value": "world511.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0b1c652-f7c7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684667228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667228, "uuid": "4b019fd8-2b83-4a10-bffd-167a873a2b05", "comment": "Malware payload (RedLineStealer)", "value": "96ef35dbd32346dcf1f2efb0af6f9a48", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667228, "uuid": "0b18e443-5649-4714-b6cb-b0ea3103023d", "comment": "Malware payload (RedLineStealer)", "value": "65d47c5a9222fa164f17c5190796231a94f415b94aeb13970538d28eb3475485", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667228, "uuid": "70bf1e9f-0152-48c6-9920-1cb55f658a1c", "comment": "Malware payload (RedLineStealer)", "value": "532b8d0bc919a47ed365d5e69c1725e0f9b4e21c", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667228, "uuid": "01b46e84-b7c9-4651-9978-b652917d2965", "comment": "Malware payload (RedLineStealer)", "value": "5e2a803f8284c0f12cdb2f1f16ef3940bcbed49ac69e9dcd35bb7e033c158a28b7d2bfc04c620fa3380a36127a7647cf", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667228, "uuid": "c0fa2c2b-2780-40b0-a243-34ae9e8e67fe", "value": "T1E9252316BAF84562CCF523B045F703D70A767DE09D68932BA354A8490C731E1DA3A7BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667228, "uuid": "940addc3-fcf1-41dc-8eaa-14feea273393", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667228, "uuid": "2b123f75-2c1e-4c2a-93f5-012d63da4436", "value": "24576:cyWLUmFMFyhzEdd/tRk5kTYYpe218ndQujyh3Sk5xG0HV:LIUmFRIyKTV1WdQdh3HqM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667228, "uuid": "291c24b6-3a46-47a5-a6c8-b8dc49c52b8d", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667228, "uuid": "e667e862-3b43-42fe-8d4d-6e17274e6e36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667228, "uuid": "a399f567-a6d9-4da5-ba8f-fca3fbe89ea4", "value": "62263263216.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19522664-f7b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684658411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658411, "uuid": "88683f2d-2a63-45f3-96fa-2a1ccaa82461", "comment": "Malware payload (Amadey)", "value": "bfdb89efed95d63a9c23eb2ce5b88106", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658411, "uuid": "a288bab4-7b64-40c9-9e3c-cc58a6434461", "comment": "Malware payload (Amadey)", "value": "663c4089d8bb1f9c81aff255cb8073483c39119039a7f6a3eb72d3c2f6a35fc3", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658411, "uuid": "71d37d82-786b-4339-9d6b-ef93a6d932fd", "comment": "Malware payload (Amadey)", "value": "a1f1bebf879cad1c3f738d7f499840574a6fa307", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658411, "uuid": "947d1267-7529-488a-8edd-997f0c8152b4", "comment": "Malware payload (Amadey)", "value": "d471b6c08535847eee67e28df8ca00adb509b1aa87b32b5e6b17be6a9a4ee24e54d1ce4d4847192012d068c7a07bd01e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658411, "uuid": "80e2e040-def9-462e-9af6-f007c7d2a7b9", "value": "T11D2523126BD95033EAB917B068F606A31F36FCA04979C367330A684B1973B94793173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658411, "uuid": "990540d5-fd88-4c64-a0e7-fd085e0ed275", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658411, "uuid": "7afc6d50-c097-449a-b13d-0bb080f3fb18", "value": "24576:Uyx/GOUtKcnE1vaq23FS5yDJ3T1je3tam22T9ijS+c:jJGvKbFaqEFoyNGaUTcS+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684658411, "uuid": "3e210d3c-2aa2-4512-be31-e575ef855228", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684658411, "uuid": "cbbe5ca2-8605-49ee-b432-6c847fd38347", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658411, "uuid": "e0a456fa-50f0-4311-b1df-b33d39a12d7a", "value": "UI688.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be77c4b6-f808-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684695195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695195, "uuid": "a745630b-c134-40a4-8fbd-5d4e4aa835cf", "comment": "Malware payload (RedLineStealer)", "value": "07d2e573594f8919fabfa4c575265618", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695195, "uuid": "19ae60f1-abd5-4b44-a2f2-a3086a03a442", "comment": "Malware payload (RedLineStealer)", "value": "6657d740628c442485203e4023179310c34667846020332f6934fe348bc8a2e0", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695195, "uuid": "caa4f742-68ee-46e6-a229-900a3e370b55", "comment": "Malware payload (RedLineStealer)", "value": "bb8cf089f3411b09184e8a71819504b22b2e2858", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695195, "uuid": "54327596-e6db-42ce-be41-21ed30ef1765", "comment": "Malware payload (RedLineStealer)", "value": "bd117a801525d42b2af70f69dba76b94aed73e346bea0bb7bf0fffb4b3e8b42987b1e9b9a52bf8cc8c420bec81b62b4c", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695195, "uuid": "25539f49-340c-4fb1-98b5-82a1030c60f4", "value": "T1FF252317EAC89467ECF5377015F706D32A34BDA15D38430A26956EAF9C73A94C83232B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695195, "uuid": "0240b226-a599-405c-9b5a-d44affe62d30", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695195, "uuid": "f0d72275-b080-4645-b079-6724da4170a2", "value": "24576:ayXyn/1oca+CHq/0qvsS/IzpQMSwqpEiWn3D2rbsBq:hC/68CHq/vESgYw+W3Dd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684695195, "uuid": "e11b1be2-48fa-41f4-a814-f28bdf190005", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684695195, "uuid": "b2c5c935-515c-4eb1-9912-bb9563eda1d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695195, "uuid": "7ce6d515-f350-4130-b850-513cb906f5c8", "value": "1212324317.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06c48df2-f7b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684658380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658380, "uuid": "526443a1-4bb3-4f76-8243-129b5cd79601", "comment": "Malware payload (Amadey)", "value": "f80e94163399047a9837b08e1d760ff5", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658380, "uuid": "d548e66c-6f2c-45b5-ac25-61ba8fedd3e6", "comment": "Malware payload (Amadey)", "value": "6659d6b4214deb2ab6fb7069f974a63aba670162c4a58d041695f2e6a3275033", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658380, "uuid": "098a88ad-81de-4dc9-9c1e-d2ab92f07a38", "comment": "Malware payload (Amadey)", "value": "3178c6cc333e36301fbb4c0561618a69312fe126", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658380, "uuid": "362957d2-449e-423f-bd1e-0fd49a0dab32", "comment": "Malware payload (Amadey)", "value": "999671716fc98b8108725cb01235836e81a96da411a510927a978dc155f1abb6dbe49d373af6ae7b196f52a76755e739", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658380, "uuid": "5d26d6d8-5fe9-4d9f-8dc1-092250a3232e", "value": "T1732523069AED657AC9FD073085F603E30B363CB15DB9839D17D9AA4A0973E82E47071B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658380, "uuid": "1ff5bf82-6d83-4392-9f2c-4925fba4f2c2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658380, "uuid": "425fe36f-116e-4cb1-a6f4-ec8876e68695", "value": "24576:eyl2knGB+oiyLT8fdmVSgoi9502w+TpHfTZzNVWa7k:twkn3Q950cBfTZ50s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684658380, "uuid": "3aef6223-19d3-4ded-9f87-871dcae18812", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684658380, "uuid": "753f8e2b-7ee1-4934-b219-add8f508c2b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658380, "uuid": "100bdf3f-d31e-4ac2-98e1-6ab3f7d3c721", "value": "2482744.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ad1f9aa-f808-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684694921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694921, "uuid": "cff11ab8-dd60-4e7f-a2c2-b2b81b189a0d", "comment": "Malware payload", "value": "5f378d518314b44f7bc06adabeda7911", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694921, "uuid": "3e45405d-824d-4a3e-b89e-5fb4dc6ed085", "comment": "Malware payload", "value": "67346953f0da322f88e65128284f2762024ae2446bd58aa0856a84a119ae8525", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694921, "uuid": "76c3c1d8-5323-46bf-b633-e95a6e974e3a", "comment": "Malware payload", "value": "8610115d400ba713cb20b72aee29a981f07f5e0e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694921, "uuid": "ffd22a47-b4e5-427b-9b62-3223f8b401a2", "comment": "Malware payload", "value": "9c7d96a7101d3618c61c90eecc9b7ca78514127ca37351a60d69224f2261aac90b15e5e4fdcd18614876fc529b7d5e3f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694921, "uuid": "d48d3fb3-fe24-4299-ae3d-f0a2d6e5413b", "value": "T14E252307A5ED8052CCB453B088F742E30A3EBCA1AD7D535B1685A69F0DB33D46571B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694921, "uuid": "4b6607ac-4739-4da4-bf31-4ca2d9c37e24", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694921, "uuid": "5aab41b8-714d-4b6d-89bd-852ae7cdf580", "value": "24576:kyMlxPBL3lfQ/5YBFxX7xHbfNqFTjIHrr4:z0xi5wFV7hNqFXIHX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684694921, "uuid": "7df9cce4-da17-4afe-b066-46f288b7731c", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684694921, "uuid": "0c5fbe8d-e3d1-4e67-8325-98da0cc2cbb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694921, "uuid": "f3b1f8eb-5b4a-4c4d-8c80-8e63f97e64f6", "value": "reader630.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21063ee0-f808-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684694931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694931, "uuid": "43097d28-f1fb-4166-b88f-f0ec090e8830", "comment": "Malware payload", "value": "a1b59173359669dbbc954486d70f86db", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694931, "uuid": "9aff1c5c-67e0-4d61-b589-bbcaea2a8cb6", "comment": "Malware payload", "value": "675c62cbd94c0c0df33aaa221ee9912b2c32820048eac31337b858a999744bcb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694931, "uuid": "41e9bf20-3475-4ac3-a8df-86c618f796ae", "comment": "Malware payload", "value": "db40c6fa8c04566607c6fd91a6049187293751dc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694931, "uuid": "7b6d1827-cea8-4745-abad-783d64be2063", "comment": "Malware payload", "value": "07ca92e0536efb99a69f5ff331702f85c7f9f7eaa6766d90284e30b812f4669c52880688ac30d0850e4b72eee0da1911", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694931, "uuid": "0071cc4a-21a9-492f-8904-7d2ad309bdbc", "value": "T1FB73A61E6E228FFDF669823447B74E21A75823D523E1D685E2ACD6101F7034E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694931, "uuid": "e9714291-2d29-4cd6-9f7a-1976d34f9107", "value": "768:dRkuXr4wSXotot8WxEetG5Walh7TamRR4lj4bCQoEdWuiRfyaVMewwRMKHHNANTH:Mw9WmebkR4lkCQFlewwVuT1l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684694931, "uuid": "84891634-b60e-4e3e-9b85-ed4eee9b76a6", "value": 80704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684694931, "uuid": "bca62433-780b-4e1e-95d9-32a463b772e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694931, "uuid": "2919b05b-1ef8-418f-8104-28bf12c707a6", "value": "a1b59173359669dbbc954486d70f86db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "775d0ee6-f7f4-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684686486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686486, "uuid": "59694184-a206-430e-ae6d-5b10516a3061", "comment": "Malware payload", "value": "d202239ecc5a4c01021b49dab454f7da", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686486, "uuid": "11d1c0e7-b19c-4930-ae3b-c60ba2922624", "comment": "Malware payload", "value": "680bace3b446fd8a9c82f7d026e40073a530251637b45e4f44a1865f3844830e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686486, "uuid": "a73dc62f-3314-4f64-8386-3b791719c56f", "comment": "Malware payload", "value": "22e4c2c1186ebbd29f4e4c817b864680e355c07e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686486, "uuid": "f068244a-64e7-4ce7-9b0c-183e0c38da33", "comment": "Malware payload", "value": "b5aece448aae30c3b281b273758efc267b9540b06353d37cd32b76dfd9683eab4a38a76be95a804cce75ab1374c885d3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684686486, "uuid": "117033e0-bddf-4117-8276-75ce0a757d55", "value": "T19B434A02B30C0A07C0A31AB0253F5BD197BEEAD022E4F684756F9BA69671E375585FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684686486, "uuid": "c9122a68-49da-4e67-9a55-ebcbb9dc0495", "value": "768:qsB1TlZL/FoCRuzRPp7WoGsnJuJ3DPimj0XZ96m1NdSj8dm+lxeFRzt5SswxGIx:f7+CEFGXTP7Yv6edpdm+3GzrQxG2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684686486, "uuid": "0f8561b2-bd60-4c12-a8eb-1b2becaa2e9a", "value": 55864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684686486, "uuid": "bf35c627-8f4a-44c7-a8e1-f5d310cb838a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684686486, "uuid": "4de61219-8097-4796-8834-227a693244a0", "value": "d202239ecc5a4c01021b49dab454f7da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e7f5058-f800-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684691545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684691545, "uuid": "bed3e2af-8ec3-4d98-83f2-4d582d5b66c8", "comment": "Malware payload (Mirai)", "value": "dce571f22da561210efc7c063a28af9f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684691545, "uuid": "2fb6bf63-e9f1-4b7f-b275-8d7b96f88517", "comment": "Malware payload (Mirai)", "value": "680c59c9c7648c2a2d5b0ed8f3582edc438014c8798afd1e523f766a29fa08b1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684691545, "uuid": "05f44ced-4360-4c11-9f7d-6af87f96717c", "comment": "Malware payload (Mirai)", "value": "6f16c82b5c919075d65dadb1e7677653509bba46", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684691545, "uuid": "18937c41-3406-425f-9d1e-0bda347d01ee", "comment": "Malware payload (Mirai)", "value": "be02aec4a7320e1dee35307fff1d43880aa04eff7b945bcd6be951c0137569e4eec3f132eac4e7c4cc9a30b945e2f408", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684691545, "uuid": "210b261d-0653-4b40-a63d-771186c0a84d", "value": "T12B03F1496FD0A9D3FEB04835E9A1510337A279B970EA359105772DF12EE95E2012DEC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684691545, "uuid": "9b754f9b-958f-4d2a-816c-4ea716c84237", "value": "768:C8FbhqTCnvBghihPXxQ/T7INXcqwNGdfBjpmdyK8C+dSq3UIKE:sTeAIKYhcqpJFmWdVv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684691545, "uuid": "48f31967-b233-47bf-b144-eb653140320c", "value": 41052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684691545, "uuid": "9ef6f8e8-b7ba-44de-8dda-ccd2cb0b2996", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684691545, "uuid": "c9ab0604-e95b-4a8b-b271-f4038326560f", "value": "dce571f22da561210efc7c063a28af9f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55660c2c-f7ff-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684691153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684691153, "uuid": "0e4b1cef-6840-4905-aa25-9d0dd3091532", "comment": "Malware payload (Amadey)", "value": "69f144abe0583dd5114f02a557e3021e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684691153, "uuid": "485ad4a2-678f-4af5-ba0b-1529a4457420", "comment": "Malware payload (Amadey)", "value": "6895a896b31bc619dad2dfef7da85d2d5b056d3194494f558601a47bfb22de7b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684691153, "uuid": "7656e6e0-4570-48d6-a414-b179d376f598", "comment": "Malware payload (Amadey)", "value": "7b028b3e835846b50c51f2df2b757795ca3adfa0", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684691153, "uuid": "a18310da-fc46-463c-9b43-ab2bfc7d2b59", "comment": "Malware payload (Amadey)", "value": "f17cb4c7c0715cb4bd13f217931dd1bbadc6398f847d2a543101cbfabefe5c6062e61f27837d7d1f4515f0a01b224fea", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684691153, "uuid": "cd68cd57-dfd1-48f9-ba2e-8d2524cd6f47", "value": "T17E252313B6E490B3DCB12BB885FB05831F347C91991C836F26169D5B1CB368466B2B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684691153, "uuid": "6f2ae165-ac23-4e7d-ad68-b8a4ff1a1c06", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684691153, "uuid": "55b7f1ff-c742-451b-923e-066a7ff3980a", "value": "24576:xyqjLpfLhGkos1qeqFBb0N+1o9b2X3FUpi0o6:kqj1hGkt1qZBb0GoF2X1UM0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684691153, "uuid": "bbe3b260-9a5c-4512-8c9a-91eb46660402", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684691153, "uuid": "d2ce8dbe-60e9-4961-ae7b-f2fe6982571f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684691153, "uuid": "20481191-2d18-4af6-8b71-2061e98f98c4", "value": "66234612.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d76dadb4-f7ec-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684683211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683211, "uuid": "68aafb87-2ed1-4aaf-a6b7-19515905753c", "comment": "Malware payload", "value": "1c08bd13a359f672d7415227eba61771", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683211, "uuid": "5473e9ba-bf85-4e6a-be07-cf3650f93f69", "comment": "Malware payload", "value": "68b7424ac06c1f8efd21b8beb81ba277e4a1929ba0654e498de0262a04ff6531", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683211, "uuid": "7838d5c1-0936-4461-8cdf-a37a0a34710a", "comment": "Malware payload", "value": "4c23e97bd5c14d8a21428b25cb2b63e308af8fb7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683211, "uuid": "92a32dd2-4b70-407c-be26-ed4e17128a2b", "comment": "Malware payload", "value": "a7d7ad4808d956190865dfef3e67f18b1e03e62e9c5ea3a27b6c251c0e36c21523f457c3727fcc406fcccec446eca523", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684683211, "uuid": "c4cf3723-1a7e-4106-80e9-8ec7547e06c6", "value": "T14793398785719EB3C042AA7925FB89740713A8225B0F1F68612D9BF8070BDDDFC9E725", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684683211, "uuid": "2d26d4fe-4c52-4fff-aef1-6facf7dd8472", "value": "1536:TeDM+Vlabe0Ff5soS4yfaf+dfmoDs2tSYVm+:Tj+Vlab/DDf+dm0s28YVm+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684683211, "uuid": "eeefc563-f726-41aa-872a-a31124b686f9", "value": 96317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684683211, "uuid": "e7cbc568-f4dd-4613-8da9-92ef92f045f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684683211, "uuid": "dd30f1ac-fa31-4800-8cf2-3ee935afe08d", "value": "1c08bd13a359f672d7415227eba61771", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8a0cd18-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684680609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680609, "uuid": "e501b993-f01a-411d-b165-e5459902d3b5", "comment": "Malware payload (RedLineStealer)", "value": "0ff0f6535b5ded24686bf86d3535e157", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680609, "uuid": "5c2e43c2-72de-4b53-b37a-5d50ded2eed9", "comment": "Malware payload (RedLineStealer)", "value": "68f3a7f6d2b87936c4f74436cca5e3233bac5cd4586246acd2fe93532daa82a6", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680609, "uuid": "9df56085-d779-4212-a9fc-6430e0461317", "comment": "Malware payload (RedLineStealer)", "value": "93bcdea7eff536571c53c0dc4d3c006f3938b531", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680609, "uuid": "a9b97977-32ba-4cc9-8efc-65ca92872b74", "comment": "Malware payload (RedLineStealer)", "value": "d5db7eea3d22483d9cff57e6a78c2894059ecd926d1b672e499b5dfd1b33b80a6c46866b360cee06a88622a220ed3f0e", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680609, "uuid": "07733be3-6268-4b70-8b60-d99ef50414cb", "value": "T1D9252303BAE44272F832AB7058F603830F3ABC549D78573A6B918DAF1C32995D572767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680609, "uuid": "69b5b64e-9708-4fc8-a5ee-8bab39426261", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680609, "uuid": "01c61493-2ba3-41e6-a03e-6103acc90853", "value": "24576:sy88bkGPO7Kqnf2Gwgm8yV9lYRQ9f5jrIZy:bCGP3qRTsDlYef5j8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680609, "uuid": "24f8a7d8-2b12-491c-bbc6-5bd27a6979df", "value": 1054208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680609, "uuid": "8105addc-5fdc-46eb-89f4-3b3c1fca5f0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680609, "uuid": "18a405fa-39a9-40d2-a0b4-e78bd51b8038", "value": "mapper433.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3023aff-f7ff-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684691284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684691284, "uuid": "717ea5a3-45bc-4c49-a4f4-ee288bfd14d9", "comment": "Malware payload (RedLineStealer)", "value": "c779f0e815c7c69acc021c75bb515b3f", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684691284, "uuid": "a8532451-421a-427d-9265-04f7c4257225", "comment": "Malware payload (RedLineStealer)", "value": "691fb88d6b978c122c9cf015a7adfcd6cf0efa2a368cd0716c7241b8632247e3", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684691284, "uuid": "a00a2707-0ab6-4b3d-bc11-4d121093d5ac", "comment": "Malware payload (RedLineStealer)", "value": "8d366e261c75b73714e9cbc3b3fcaf26c1820e7d", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684691284, "uuid": "4186e7c0-479c-46f5-98ad-7f001bf15634", "comment": "Malware payload (RedLineStealer)", "value": "b49271f64d8f0696cc46e364aeaf92dce0dfdcfecb38cb8445b743a999fe8b7f3b1da3db750623c7d0dd877f1c3d622a", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684691284, "uuid": "dae462b3-555a-48a6-86b5-634efa7948b4", "value": "T1A1E3D624279F8930D6BB4E3D6CB19CC076BCEC12A542D74A4ECCF5593A73B809B116B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684691284, "uuid": "bd4f7ef0-abd1-4bad-a587-3d1dc186e991", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684691284, "uuid": "3612552a-6653-4ca3-a078-177254452537", "value": "3072:2V+m5cNQmRSxWWAcP+DDXedh7Z58e8hk:2jwCUudh7z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684691284, "uuid": "37872034-2e5a-4ac7-b80b-718e052d1372", "value": 148814, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684691284, "uuid": "85950490-8fb6-40ec-8285-1c06ac258792", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684691284, "uuid": "d8477346-aa66-4724-b9b0-55c204aad9a7", "value": "server930.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d0c6b9d-f7b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684658498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658498, "uuid": "e2ad77d3-276d-4b30-af6b-8fc532e2878c", "comment": "Malware payload (Amadey)", "value": "8aa36058b7ccc50f46b07ce07546120e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658498, "uuid": "9483e8b2-3b60-4397-a674-189b9b08af50", "comment": "Malware payload (Amadey)", "value": "697aace7715910b0975de2da49c6a54999745c7cc987d88c7ccf81851f07589a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658498, "uuid": "e5a987a2-272e-40c3-b691-7244e1280e05", "comment": "Malware payload (Amadey)", "value": "91c850e66d1fa9edf6bf9a4d249e0f4074718cbb", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658498, "uuid": "a8b4b9ac-26ad-425b-aee3-3cfb8a069895", "comment": "Malware payload (Amadey)", "value": "e2e9b1c67f99badd6ec52cf69bac5a85e3ab0d792b4588cf211e9b55a028b6255ccde6ac6be6a2e03556a2026e6c785d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658498, "uuid": "c5e88b28-20da-4496-871f-8b27ecc78ff7", "value": "T1EA252323EBC844B2ECB5377068F606D31F333D414D688A5B3785954A29726E8E476B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658498, "uuid": "1992c8fa-d0ea-4d50-bcc2-4c138fe89ba5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658498, "uuid": "91a53a6f-94d7-4398-b672-0e82f6943d69", "value": "24576:syvpvgEDj1+Di0SqzCanx91RplfYFTdZUpLTqDWuHO:bvRgEDdqzRDXoTgpLTqDWu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684658498, "uuid": "1a8168a4-9cb8-47ed-9131-d40d9a88e55f", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684658498, "uuid": "cff8303a-859c-4472-9410-60f12710254d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658498, "uuid": "38f2a465-5f18-4de2-a3af-94f719b2a0ef", "value": "watcher402.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "246768ca-f7b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684658430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658430, "uuid": "0ae8b7ca-62bb-409a-996c-f35a5af78c0b", "comment": "Malware payload (RedLineStealer)", "value": "360aa62def8f7448805079d9393b8b04", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658430, "uuid": "20b3d78b-bdd7-4635-b40e-151dcaa25989", "comment": "Malware payload (RedLineStealer)", "value": "697ced9331aa4d61d01ebe97b390e1b3675f111283d89f1dcc24c9eb2a83c0aa", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658430, "uuid": "8ea5044b-d864-4200-ae2f-72cf22beb52e", "comment": "Malware payload (RedLineStealer)", "value": "66c093f4950f36dd46dcc9b224c7186cb718c766", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658430, "uuid": "3207cd9c-74d1-46ce-b0c0-082d63ae9b6a", "comment": "Malware payload (RedLineStealer)", "value": "c70e0fff0b52ccfb64930740fab5f836956ddd7766ca9777de832dd2a0d2a8ec03de57a1a0dbba117a14e926b45aa607", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658430, "uuid": "59517b11-b821-46cc-a04e-10a26bc1ee0e", "value": "T106252357ABE96071D4B02BB45CF603870F757CA099B4868E62056A4F1EB3BD0B0717BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658430, "uuid": "927303da-11d8-42c5-b9cc-a75e688fa275", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658430, "uuid": "6f6c1326-b756-4aac-b224-68c0b19f804a", "value": "24576:/yn+QQJuRs8PSrJSe3ALkE6vUk7zB/mO0C8UIbV+fAvtjTAmEU:KPQJuRs8KFSQBMkHB0CIbVDvtjTAm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684658430, "uuid": "f25501b9-2682-4e9a-acab-f4846165ceb3", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684658430, "uuid": "0b05ed8b-33ec-4374-868a-34e28d346df1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658430, "uuid": "2e76c9e2-8b90-4f46-84ed-73b5fb35748a", "value": "debug347.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe42297a-f808-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684695302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695302, "uuid": "39b63155-bb3c-4684-b23d-ac27af42d6cd", "comment": "Malware payload (Amadey)", "value": "72bb96e7b511dbfc1df3d6cabb02afdd", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695302, "uuid": "e8a4ce46-3077-4fec-9126-a2f74d603287", "comment": "Malware payload (Amadey)", "value": "69f2aa08421f5d40aa7319026cc7295078df9149c6004364b162ae949d0b07d6", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695302, "uuid": "c8e6900c-3203-4002-a71f-c9845f16ceb8", "comment": "Malware payload (Amadey)", "value": "a83b7dbc2cf0e37c5b0fa627b2e908f2ed591f58", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695302, "uuid": "7ef4815c-16e7-4f63-af9e-d56728a7e73f", "comment": "Malware payload (Amadey)", "value": "c694f087b08eb2f27b427015e9d100c1423638256106a8125f6b3e27de49d01c69fdc8d846ff51419dfbd4bcd92323cf", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695302, "uuid": "d97f81b0-3d49-4893-9e11-a7156eb09f5b", "value": "T1792523536AC88062E4F7373468F502E30F3ABDA19D7893263752B94B1C722D4A572777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695302, "uuid": "75d08d79-3855-483d-b552-6e08d41648a3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695302, "uuid": "86e6f607-af27-4dd1-80ae-4e946f49004f", "value": "24576:Syn3lng2TmbShvl8qy0s+eaCiuwCm27JJo+o:5xgOmShGqU7Ou7muo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684695302, "uuid": "c5f15b5e-9d19-4b9a-b86c-9ab4d1866957", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684695302, "uuid": "d8d33dda-72d4-40e2-9869-d3641eb40643", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695302, "uuid": "e497c1b1-b348-46f0-8652-a4707639c525", "value": "gameplay158.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebd972ad-f7c7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684667354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667354, "uuid": "01ba1112-e010-42ff-8f46-38ab12b92c59", "comment": "Malware payload (RedLineStealer)", "value": "9f25cc6c4b20dbae1a932fcdfa2e0ce1", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667354, "uuid": "82ec9b11-a515-4876-a4ac-a9ae565b0104", "comment": "Malware payload (RedLineStealer)", "value": "6a567029ba36a17868376b1301d55c1c4b26fa54a087e744f210959e104d6c56", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667354, "uuid": "0199d5f8-d24f-4f31-ab7c-f5375e414f1b", "comment": "Malware payload (RedLineStealer)", "value": "fb6ac4b034bae4e599b36d6055f8d19b8cdd5ac0", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667354, "uuid": "89a7db16-9ab7-4040-b769-a6ec6619cf1f", "comment": "Malware payload (RedLineStealer)", "value": "100dfceb1deb23d65253b6b507eaca435bab9acf4892be4da715b184e6c1d4158a592b2350c2728577b2077b8f0282c1", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667354, "uuid": "ac5b1c38-5cce-4b30-a4c3-63da250f7061", "value": "T168252315F7FC24A6D4F46BB408FB03930A317CA1497D439AAB48EA4B0D72995E0753BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667354, "uuid": "c21f480e-1059-4022-9b1c-2779c1241fb6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667354, "uuid": "8ef35fbe-7eec-44a5-a28e-1ca2c95db4ae", "value": "12288:RMr4y905yy0fDNRC8PciGwtibOqMOt7lsnYNdXhcUTEdc6uhKtPiAaJBHVC3n9wE:ZyDRBkiB8b3BtBC6VhJT0qA+kwm6P0n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667354, "uuid": "d5c59d2b-3193-4a2f-9678-a1d105817b40", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667354, "uuid": "557a15fe-ed05-40fd-ae1f-e58ccfe56731", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667354, "uuid": "d935a58b-d6b9-4a06-9c97-690d3d2e56b5", "value": "logger829.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efdeccbb-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684680675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680675, "uuid": "6478614a-c626-4514-afe4-26fc9351d112", "comment": "Malware payload (RedLineStealer)", "value": "82ef28afc5afa2fd11c8f4dd84d0d2e8", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680675, "uuid": "4516fc55-fe22-4800-9d78-c98f16bea3a6", "comment": "Malware payload (RedLineStealer)", "value": "6aec7c7fd990f9bb5394927726b6884d8093fe092a309ab11376da1b2581f7f7", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680675, "uuid": "0a1abf75-ebe6-4c38-b35b-7f477c25d889", "comment": "Malware payload (RedLineStealer)", "value": "232341a6a53628cddc53a66a4becc52558805763", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680675, "uuid": "8d97055e-7add-46bc-afd8-d42f7c5954c5", "comment": "Malware payload (RedLineStealer)", "value": "4a7cda5a82982e291c8ca84eb30804a644ae47809967e43db79ce3991ab561a5c697736cbfce100ae06c773106034e8e", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680675, "uuid": "b02b05f5-1830-46a7-9b3b-5b99c4c48195", "value": "T12D25221296C58472E9B13B7568FA56430F36BD60CC65CB7F3B998C4A4BB36806832377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680675, "uuid": "a86419ba-de17-40c9-9f95-f9670f5cfa96", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680675, "uuid": "4020201a-5ed6-4391-8e01-b0349261658d", "value": "24576:qyHgl5bkLjU+5qRd2rOLSBzmcPybR7P//o0:xzB5qRd24YmcPyt7P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680675, "uuid": "61d45c02-e9fa-4cd6-bed1-30a23ffbc79a", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680675, "uuid": "b73654b3-f146-4c50-baab-24042c4a6749", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680675, "uuid": "b555f61a-3bef-4e5a-abd8-ee0b6fbf0aca", "value": "token123.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efa817d8-f7c4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684666072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666072, "uuid": "29d4cb69-d1a1-48c4-9d47-0cc2b9ca7685", "comment": "Malware payload (Mirai)", "value": "3ea44a9bbc579e014a410ebbffdafc81", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666072, "uuid": "fb5b0c0b-b50a-44e5-a409-bbf6b7f95757", "comment": "Malware payload (Mirai)", "value": "6b4b4672fb821209f9008e736e2d4ccfef5f96d65716964d8a1dbb208a798e1e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666072, "uuid": "d2b71cfe-8d03-4dc8-9a0d-2bfbd9380c43", "comment": "Malware payload (Mirai)", "value": "991c4970b52ec61144c39179b85a1dde37237ea7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666072, "uuid": "b716c4c4-ed17-457d-9f4d-e8b90c3c510c", "comment": "Malware payload (Mirai)", "value": "4e4d103976ac4b8e9a53f52f1a327ae8e120863bee3a1b18f152f6e27097fb558a644346d109512e0ba39bd39ee13c52", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666072, "uuid": "e7a03506-7b95-43ce-8fcc-3141ff5ab034", "value": "T160534BC8A5C3E4F5EC001D79307AABB1AA77F53F2035EE9BD79E25639942203E10169D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666072, "uuid": "8686995a-8e54-44c3-99c9-eb5727b9bc87", "value": "1536:b5VYYpXIqVkxmxRvXMFnKiahjGKO18Hq6PWkSYd0+j/KUAm9f:diYpROxmxhXMFnKlRGHCHqYnd5/eq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684666072, "uuid": "4846e492-7699-4af2-8b4f-5baeda41f748", "value": 63664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684666072, "uuid": "86d970d6-23d4-443e-84f2-785000b7389c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666072, "uuid": "8a73ba66-c1a0-432d-8ba2-395329c9e678", "value": "3ea44a9bbc579e014a410ebbffdafc81", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4f5be22-f7d0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684671235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671235, "uuid": "d32f4d42-47e0-44d0-ab2a-d40791785398", "comment": "Malware payload (Amadey)", "value": "c5837bb0b54537492c2519bd81610546", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671235, "uuid": "7c38d57d-ac40-4844-a0bc-9f5bc88f3556", "comment": "Malware payload (Amadey)", "value": "6b4ed2f3e71e5ccaad655cccd39397052202dbf5a618f6d5ad116f4e9a6cd9e2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671235, "uuid": "4b2dd0c4-8bec-4a37-a858-9cd3a14a06b3", "comment": "Malware payload (Amadey)", "value": "e76211a6c2a62b672c3ee98c6e8ba744f45f851f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671235, "uuid": "59294e0e-61e7-4280-8aa3-6466347ec5fe", "comment": "Malware payload (Amadey)", "value": "22b5dfb548dfe27d2aedbaec7eb9616da9d9abeccb22f5db7e468bc08fab379f40f6a94e0ce42ebefda3e8c2162e9fb5", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671235, "uuid": "d86de6e4-d228-4be5-8b6a-34c17ccdcb29", "value": "T19C252327FACC4673C9B25BB11DBB01431936BE709D75431A3B9A9A560C72EA08873737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671235, "uuid": "aaeff7d6-5dbb-4fe5-bb9e-09b847732818", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671235, "uuid": "397d843b-1d4c-4b6f-bfef-f9f8feb3c0be", "value": "24576:AyLddVdgp/d2qPDaWuOx3Ft4IM8YGkJ6zhErVfvS8ku:HJdY/d2q79vx38vQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684671235, "uuid": "4e5eb65c-7aea-420e-916d-aa4aa4228394", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684671235, "uuid": "896cf2d6-d77e-4cc6-8463-3be569bca03b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671235, "uuid": "34d36aed-4542-48ca-b2b5-4f91b4830af2", "value": "helper405.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50391752-f800-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684691574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684691574, "uuid": "eea62ab5-86ed-437b-a85a-55a78a099dbd", "comment": "Malware payload (Mirai)", "value": "be4ac4221f68727d71c6645f8b7665d0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684691574, "uuid": "a4f5b53c-3f1c-455d-88c4-b9529a7e09cb", "comment": "Malware payload (Mirai)", "value": "6ba81eb8f1612f87b69f922e60f0dfa906eb731651672f15a178e5b761fa1341", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684691574, "uuid": "c2b0367d-f3e7-4513-911a-b1ff0e5b3ca9", "comment": "Malware payload (Mirai)", "value": "2f47fee5674488247af64793611381ce834d2f29", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684691574, "uuid": "bad0e59a-0c6b-4467-a9e5-d6b91c90efed", "comment": "Malware payload (Mirai)", "value": "4b727aef7cf43e26e5a08808bd408b2be011a644ca3081884dd36f8396ec408ca663257dc9e8dc8a2ae3075ea3498aa0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684691574, "uuid": "10abdbca-6bef-4c3d-a37f-9ba56edc2f65", "value": "T1DF13D7D5B881B639C3D15B7BEA6F019D3355ABE8C0CB7753C8281BA0B68681F1E13B45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684691574, "uuid": "fba62a70-859d-408d-8d5d-936d8e063359", "value": "768:03PHWdzuq04G5yzgQWAUALcyF5JfmLMulHKrNGoKi3hLyHyuDz701rBPj3NyytAS:YHjqHG5yRWArLpmLMjN73hWDU31M2B0o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684691574, "uuid": "cf7a340f-c380-470d-b386-173bcf546756", "value": 45464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684691574, "uuid": "a2cd2319-b4aa-414a-9358-4c64c82152c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684691574, "uuid": "a374afc9-9f60-4764-9a64-8e7b35600545", "value": "be4ac4221f68727d71c6645f8b7665d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "025fa675-f7c7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684666962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666962, "uuid": "e11459ff-04c0-453e-80bd-8521bcfffda8", "comment": "Malware payload (Amadey)", "value": "fd5cb9d5d57a375303abc1ff763ec17e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666962, "uuid": "596bb714-efce-4e77-aad4-3a88c741230e", "comment": "Malware payload (Amadey)", "value": "6c1586dfb81897212e4891f2f7381716ce8e821e4f35ca5ea2cbc3ee423d5ac6", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666962, "uuid": "baec2b62-447a-41e3-905f-9288126cc1f6", "comment": "Malware payload (Amadey)", "value": "fbd33132717a451e5dd13ead079d9b2b1c1aa484", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666962, "uuid": "333c1fce-5566-46de-854a-347fb5a589f9", "comment": "Malware payload (Amadey)", "value": "238fcb2811b26113159fc241a6d283711ceacbb9dd997d3f76d866c2750fbb84448212edec973cfeedd0cb9ce2eb3102", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666962, "uuid": "7c1c8898-6cc3-455c-80c6-9b4fb4ab8010", "value": "T19D25221BABC94031ED7527B064F203AB0331BDA15DB4D1AB3B82D95B4D32A995D363B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666962, "uuid": "84e6da80-7360-4a5a-9002-3907eb8de250", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666962, "uuid": "02f45548-e7e9-434e-bbec-b5bfecdd8c37", "value": "24576:By3lVLE4vlS/G/2DqgJMqweaik8SjrTZt1tIsaADJZLFk+K:0jm/jDq6VwMATZt1ieJZLF3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684666962, "uuid": "e7cf13fd-2f83-4af2-8156-236b0d74eb39", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684666962, "uuid": "dcd05ac3-31ec-40b9-ac74-02d28478646a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666962, "uuid": "474a91e9-e5cb-410d-a989-ab3019e7d5d6", "value": "translator384.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1c1a458-f808-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684695228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695228, "uuid": "e8c66005-4fd4-4db6-9290-6c47daaf2003", "comment": "Malware payload (AgentTesla)", "value": "f9650e7d6e96dd7f86b98464aecb555d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695228, "uuid": "c832c074-f686-46fe-a87c-1f327bdd9ff9", "comment": "Malware payload (AgentTesla)", "value": "6c5c8da5c12d4155f5f1dc7c1daf6d1b8095464c2b1e4b473dbebc15067cff95", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695228, "uuid": "79308f20-5cfb-4535-8d7e-f0e28bfb5603", "comment": "Malware payload (AgentTesla)", "value": "9f6c473b40ad211805a5fa53abed5d7bce8c9fa6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695228, "uuid": "04dacf60-0b9f-469a-a18d-a4aac8be2616", "comment": "Malware payload (AgentTesla)", "value": "6921710226d13d7f56a75443357ea32bf4f985d1c111f607b898c6f21c874ad2a7b3d08a7c92145cf1fa10f6ce668640", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695228, "uuid": "700080a1-1af8-47a0-94a7-77cfb1ecd7af", "value": "T1D545A111E1CAA494F3FB7F3043AC72D73B2BB7BD6920985D1349866D21DA8408DA477B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695228, "uuid": "36c4ffc4-db9a-493f-be2a-6bef40400fc7", "value": "1536:K0emHmd+CKN/SoY+oYFt6C2yadzJCPKFLhO2DzPbb0D0JkZrIWWCFBs:GmHmxw/kYFqdzJoKFT/PP0D0J2v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684695228, "uuid": "0276d40f-e908-49f5-96dd-695379032d73", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684695228, "uuid": "d2cbd9cc-d020-4d7e-ae59-994da2bc0adf", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695228, "uuid": "dcf8b8fc-c8c9-403b-9ace-4ed3a93cf6bd", "value": "3535634304.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "710185fc-f7b1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684657699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684657699, "uuid": "cbe9347d-bbf4-41a0-83d9-21e5bfe88548", "comment": "Malware payload (RedLineStealer)", "value": "b1ac9d8410d95f49356c921cb30bfad1", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684657699, "uuid": "901d9bae-b557-4af7-9b2e-a0c7b635f6c0", "comment": "Malware payload (RedLineStealer)", "value": "6c7819630bd86d0eb458fa779d56aed4e9e847bfa23456e7337aa86f373d8551", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684657699, "uuid": "a5a5b70d-38e8-406d-b87f-962c321ebc52", "comment": "Malware payload (RedLineStealer)", "value": "a27613bd0cf38f7c243812bbe5c3c9097c8d66fb", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684657699, "uuid": "82d7eeb1-6568-4c1c-b372-b1422fcac558", "comment": "Malware payload (RedLineStealer)", "value": "517b73d7c526b303ee7cd5ec16beba42e0800bd7a360994c573bd2724d7fa3c498e5a1475f7333978f9e545b799f6e77", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684657699, "uuid": "4c765535-ecb7-494b-8d47-11edcf7410a2", "value": "T11A2522666BCC4073EABC3B7005F706470A36BCE75D7893471396A98E4C72B85A8B5327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684657699, "uuid": "e4f943ad-8082-4298-bb80-781a4189af2b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684657699, "uuid": "ad7f24ef-f28d-4bf6-b385-2865887cb540", "value": "24576:oyFxPz7Jy2mOv1d0F/9o49kSY+y59otxGy3fM6QjVe:vH3JHm5F/9o49kL/W7f4h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684657699, "uuid": "d63867a1-5dd9-4518-83db-f487f02dff6f", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684657699, "uuid": "68e78977-a26e-4b46-ac94-9ef48ccc9cd7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684657699, "uuid": "40752ba2-1846-4bdb-bb4b-4462044c9662", "value": "2454.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ebdd990-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684680512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680512, "uuid": "291afb82-1b2b-4877-af1a-c62efec2cedc", "comment": "Malware payload (Amadey)", "value": "15af9b3bbe68bb1d2674a2340bfcdf86", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680512, "uuid": "00827fc2-bb01-4a8d-b4bd-7450cdf30766", "comment": "Malware payload (Amadey)", "value": "6c97347705bca3f946ab8d804557cd845d07d44f06caa16585268475e891fef4", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680512, "uuid": "643cecaa-ef86-40f8-8543-49ea1f4e0fd7", "comment": "Malware payload (Amadey)", "value": "d73eb27413bf1e71a6a610638fb747c0fec2c427", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680512, "uuid": "061dddfd-6a0d-474c-8952-c3126baee248", "comment": "Malware payload (Amadey)", "value": "d63fc04161402baa26165e25a6d23e3cbf1691bc04d5e73b440dec54aa596b77c727ee430bc2ed59463fdd29877bb870", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680512, "uuid": "17a74ef1-fd3e-448b-b25b-4ce69ff6964f", "value": "T1D5252243EBDCC472CDB61B7055F60A831F70BE71C870466D3B91A9164DB3A9928B3B26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680512, "uuid": "53e77776-1472-43a5-8c50-bb9508a7bcda", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680512, "uuid": "ec5b6e14-3cb7-445b-b031-01d6d7f381a5", "value": "24576:syKKr0AylmBHOdNqNCrGN/6zwVzFQE8NquiDAI2aYacki:bKsylGHOdNqMGZB2E8af2/Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680512, "uuid": "28bdd2bb-40f5-4fa0-990d-62a318b1ef3b", "value": 1046016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680512, "uuid": "2c28b7c5-3cde-4bcd-af00-eaea22851d7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680512, "uuid": "46e5b04f-537c-4b0d-97d7-bbefa7bee69c", "value": "agent734.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd043406-f770-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684629963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684629963, "uuid": "b0b20e96-7a24-4649-8cd6-7c2b1b61e3dc", "comment": "Malware payload (RedLineStealer)", "value": "9727b8175690071c56deaa9f7998c98c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684629963, "uuid": "cfacdb45-04b0-471b-a4d6-08c1d5ac0ec3", "comment": "Malware payload (RedLineStealer)", "value": "6ce9d31df6e7b5ea2b7386b9de4d30c2d64cda49472d6732e437f5a86ec0ee20", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684629963, "uuid": "68dfd6b1-f4b7-49ca-89d0-06042408513c", "comment": "Malware payload (RedLineStealer)", "value": "763a52a38cdabed6dac7697a49c07847d5b0faf4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684629963, "uuid": "27212c61-5c7d-4cf3-9e36-8959f42054ac", "comment": "Malware payload (RedLineStealer)", "value": "17ca5c631468a792cff2a00b03973c8ef6468fc3cd1318135637e71a15d772c418ea000be8adff24a228182ec31e5541", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684629963, "uuid": "b1bc5835-36af-4178-9231-8561c167d1fd", "value": "T109252352BAFD25B6E8F00B7088F603D31B367C65CD34936A2695DC5B08F25C698317A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684629963, "uuid": "9aa1f4e6-0d90-4dec-8a6e-ebcef59acc27", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684629963, "uuid": "aab41c71-1897-49ff-9dc9-73643ded7515", "value": "24576:gycEQf4r8jBMysUZBROgLBJyJfflIFDwuGFm1l/3Xnr7:nczY8CYROqJ14FG53Xnr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684629963, "uuid": "3c13ba1c-a3c4-4a64-aa2c-0a2494f4d342", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684629963, "uuid": "efb3009b-a6a6-4250-9d10-ce68abf91e12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684629963, "uuid": "939268fc-b9b0-4311-b103-b38c6a37bb3d", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d98ffec4-f7c7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684667323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667323, "uuid": "20b6c0c8-4a68-4a36-8113-d57053f25e45", "comment": "Malware payload (Amadey)", "value": "90a97c70bcd5fa9116c3ebaa09892ea8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667323, "uuid": "e6ee7b64-d10a-4ec7-a8a6-14951b435359", "comment": "Malware payload (Amadey)", "value": "6d050aadb83a70cd936d8e28b59eeee1b271cac82f330bd67671ff6f2fad0321", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667323, "uuid": "ca3f730f-ccc1-4065-a1d7-47d56a1837e0", "comment": "Malware payload (Amadey)", "value": "02a647358c426357fb46e402ca6d76ccde1b2b0e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667323, "uuid": "eb684396-1690-4bb5-9c21-b7fcc68e07df", "comment": "Malware payload (Amadey)", "value": "3add603b4deb8802b1150f7567b5c7b12491b9408104209abf99391ab8facd016af37f50951081e6fea6afd69bb040f6", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667323, "uuid": "75c9f3f8-ec00-4954-a4fd-b1381fde27f0", "value": "T1DF252393AFE81476D9B9A77429F716C31A36BCB0DCB9833B271464060D7368458B273E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667323, "uuid": "641c1ae2-cdd5-44a0-9a5c-1f71a02f18bc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667323, "uuid": "cea62f6a-8282-45c1-a8c9-da439884cd09", "value": "24576:2yyEA7aKUxgukg7xJOU+vNTbuaX3V1ogOzCp9TwjKrlf+:FDUUxgu7xURFTianV1ojzW9Eu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667323, "uuid": "3a538544-038e-4c3d-9f09-20494d9b9e32", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667323, "uuid": "c24c7d9f-27d6-496a-9d8c-21661bf8442e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667323, "uuid": "f9b1fa6b-3dd3-4665-98f6-89ea7064a31e", "value": "game257.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "643d52e4-f7ff-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684691178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684691178, "uuid": "3b4b77ea-394c-42b0-9af6-fedd2fcd27d7", "comment": "Malware payload (RedLineStealer)", "value": "d80398b068304f276ba07b60bf8dd7b5", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684691178, "uuid": "90368817-2077-49bb-8870-ceaad2df526f", "comment": "Malware payload (RedLineStealer)", "value": "6d5d593b4c6e7f681770b485be19129926d82ede864904bcc3c6ad355490059f", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684691178, "uuid": "6d694086-a1c3-4847-b092-1d66f9b06d7b", "comment": "Malware payload (RedLineStealer)", "value": "c692e09278773424d382807bf13392acb2903f52", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684691178, "uuid": "aefcf641-f1f1-4ff8-a172-d4c0ac972bf8", "comment": "Malware payload (RedLineStealer)", "value": "3006a735034c36d60f690f513aec6f0e9d3f74ebeff83dfa2ec18920540bbf94c66604cd9f9461e6dc410a3c9eeb70a7", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684691178, "uuid": "66c393d2-e9a1-457b-b491-629d325664f9", "value": "T105252353EDC9D072D9B1273058FE17970F34FC9098B496CA1282E58E29736D8AC717AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684691178, "uuid": "536f3f52-9727-4d26-b87e-1d7d164f7790", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684691178, "uuid": "a5857518-0f05-41bc-9eea-0e6de1a72094", "value": "24576:iyKkqM3vgpMn6+qOzYJnpcf+DU58YJ3kJplebaWiIxm9:JKLe4pMVqkwnpTUKYaJfeba6Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684691178, "uuid": "43299934-bd44-4fae-b15e-55ba599621ea", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684691178, "uuid": "de8bfe2a-9898-40b7-9ff7-55e18063d30e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684691178, "uuid": "daa51e16-9c8e-47d9-aa53-739227d40234", "value": "66234806.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab157630-f7c7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684667245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667245, "uuid": "b54b9008-75cf-4801-a3b4-a944eefd7699", "comment": "Malware payload (Amadey)", "value": "73e18d4c7b7d46a103cd676c4ce6df7b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667245, "uuid": "332c5332-901a-4511-b5ee-f3516cb989b9", "comment": "Malware payload (Amadey)", "value": "6d62dd031f22928b13e8fa887ff75dc49a4f983c920008bb8421e86bdf039a2c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667245, "uuid": "fea007d5-ab23-4e49-8145-9b552c69f2a4", "comment": "Malware payload (Amadey)", "value": "5ce4217096587e749f2103e2ff2823324ea04779", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667245, "uuid": "d6d787ed-ee5f-4045-966b-b3c2e162d5c5", "comment": "Malware payload (Amadey)", "value": "9306cce948b7176992f39b44fcafa8f5d6e2ca04ddd180340db75ab9f0bbc25c2921fcd5c12b5afc2fa1104235d00d0e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667245, "uuid": "1a01eb35-cab8-459e-906e-26bee2b09ab3", "value": "T10B2523579BD5A272DA751B305CF6039B0732FCA25874831F228B0A5B9CB2698F171B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667245, "uuid": "12e7d4ab-b139-4fd7-9147-0f356cc0c819", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667245, "uuid": "4e6eb894-66d8-46b0-b2f3-960df9d6dd6d", "value": "24576:YyJ1pnb+R2Q7hk7CelmXXr42KlUL40VxfzI24:fJ1pnChuFlmXX7QGHVxfzD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667245, "uuid": "d5238000-3068-4ad7-ad1f-835b330042c2", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667245, "uuid": "d02634da-8673-45be-a935-70ebc3ad6a1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667245, "uuid": "7192ecf7-ab47-4e42-a4b9-d24be7d2e0a1", "value": "DiscoSetup532.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66c05170-f7d0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684670996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684670996, "uuid": "16d33ac8-b565-48bf-b82a-5a65f97ca8d2", "comment": "Malware payload (Amadey)", "value": "914e34d8e12818193a7f6251b8f1294e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684670996, "uuid": "c4975fc4-b2d4-448d-a10b-580e89d36193", "comment": "Malware payload (Amadey)", "value": "6da3d5a5a33ea74c4d81c6d5cbedaf8a21e59b23a27797e13856095fa8dab563", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684670996, "uuid": "48e89276-aef7-43e2-8f79-5f37b2e0d1b8", "comment": "Malware payload (Amadey)", "value": "d531c471219fce9b00d6d895e69147d9a813ca60", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684670996, "uuid": "4a227dd9-1ba5-4b08-8618-e4702224dc48", "comment": "Malware payload (Amadey)", "value": "246768c1389e307262c285cac415ceb4420fc5b8a882d1320bb4b165ec208f6800ced0a262e4e0fd05a1f9b774e5c8e4", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684670996, "uuid": "4f274815-78fb-4deb-8bbb-0baa4197f86d", "value": "T1C9252342BFD980B6DCB6177058FA07830B767DB0CD79835766C9A95A0C32B81BC36726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684670996, "uuid": "0327cca1-b733-405d-80cf-17be83c06550", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684670996, "uuid": "4307725c-78cb-4657-8044-42a8c7ca64a9", "value": "24576:hyuoYOC3N6wITq0TCsuB04/SLWNcRtdfx:Ux3/Tq6E2jtF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684670996, "uuid": "28196cb5-1a6c-48de-9694-38d24bfed9b4", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684670996, "uuid": "f315f076-9662-4b5e-8ac2-735ceb00d3af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684670996, "uuid": "4de24776-1af0-414a-84dc-cc99418db7cc", "value": "Doge707.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8afe93e-f808-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684695239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695239, "uuid": "b0795d6f-574d-4cae-92e7-e2a34e742c22", "comment": "Malware payload (AgentTesla)", "value": "02ea34533272f916fb52990a45917913", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695239, "uuid": "ef29a13a-a701-4803-aa1c-db728bb0a2b1", "comment": "Malware payload (AgentTesla)", "value": "6dd45a770648da5f5996ac7b28f604493b44f8b1ba7458cf60d3a1ab7cf18590", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695239, "uuid": "98b61595-92e6-420e-bedc-7de773885d46", "comment": "Malware payload (AgentTesla)", "value": "bd68a7c84b7d7a65ab19419ddf6a2a2b44fda0a4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695239, "uuid": "d01ec88f-dddc-45a7-98a2-135ff0eb31df", "comment": "Malware payload (AgentTesla)", "value": "c83383b8f1559298e1350b9f75efc617e4551f5dae386742f224b370376f7904cc687a9869c0add76e0135f10086db50", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695239, "uuid": "72807c65-0f2b-4eae-a11b-d125e816f8cd", "value": "T1CA253312B31C56F9E5A6ABB97D23019656B63F258D45FBC4BFC12920613338CA321ED3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695239, "uuid": "1fbb138f-9cb2-476b-bd47-afa51a77527a", "value": "24576:2xDVAu0gy5oaV/lEVSL24t4rmbe3Bw5m9YvWcdyFoBkkAxqV:2xDGu0gymI6kL14rmbCmU8xYan", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684695239, "uuid": "375a385e-df0e-4dbc-bd3e-a0824fb5b09b", "value": 1000448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684695239, "uuid": "05bd7138-83b1-4ca8-a170-52ea70973005", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695239, "uuid": "5b8eab5b-cde7-4cd8-b884-41ad8fc2a5f5", "value": "646745784459.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96bed46d-f7f5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1684686968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686968, "uuid": "f2289949-c990-4c3c-ba37-0da2519f2e63", "comment": "Malware payload (Gafgyt)", "value": "1ea724fc060d1579265f65bd4d231c92", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686968, "uuid": "16e964a1-3c39-4e0b-b674-b3c1a5547015", "comment": "Malware payload (Gafgyt)", "value": "6dd4f78be2947b9500ec4f83a53d502ca1a396f90ad8b4423897fb49a9fb2fd8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686968, "uuid": "69ecf96f-cc85-4e21-b249-d3da477c913d", "comment": "Malware payload (Gafgyt)", "value": "e97b010e05b145e8a15b3022ccbd08766537eded", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686968, "uuid": "1fbad916-99b0-4d73-a150-3caeefa5a3ba", "comment": "Malware payload (Gafgyt)", "value": "08141581b7b7b4e113ee4c3c99f169482edb8dcb75a007f1d25cc089b4de8940d07fb9fcb69b8a9887db7ff0c4734a78", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684686968, "uuid": "fc05fd23-1631-43c0-bf49-b22a75d7def7", "value": "T15BA31744F8448767C3D327FAE78E439D77351A6457DB33116A39AEB42BC2B982E29130", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684686968, "uuid": "0d129bf2-de13-4b28-bfb0-288ed8106f5d", "value": "3072:Plf1jKRi/VYf84Yfk7XTRUmpEqQ45vVXY0X:vjdVC7Yfk7qmpEqQ45vVXY0X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684686968, "uuid": "950f6fef-f37d-40e9-bfe4-dd3e46090cd5", "value": 105111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684686968, "uuid": "edae3e76-40ba-404c-85d9-aa0c7fd491ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684686968, "uuid": "ec9f5638-a158-4896-902e-4e2bd02f07c3", "value": "1ea724fc060d1579265f65bd4d231c92", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7331438-f7c6-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684666863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666863, "uuid": "ec612a8e-7904-4435-8602-6a7884f2ed47", "comment": "Malware payload", "value": "a5af70c231f652effcf5e1235b7891fd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "RapperBot", "colour": "#FA5B6D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666863, "uuid": "7b4e8a98-47b1-4e76-aecd-0d05c0cf87cb", "comment": "Malware payload", "value": "6e09788f61ff2ae15d6d0e2a4a7e66f9dcd0db92b26a90f06be8390c791789ac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "RapperBot", "colour": "#FA5B6D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666863, "uuid": "45aa283d-de2a-4f59-bd64-f277878d863e", "comment": "Malware payload", "value": "4f96952177c1124fa9040c977ae9e6f5a536ebb5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "RapperBot", "colour": "#FA5B6D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666863, "uuid": "ab347201-8f7b-4461-aa29-39e87aaabedf", "comment": "Malware payload", "value": "4d070dfa9bcd365439af583f16ea9796762270b3888a4f2babbdfd2c8ed7e576bd3d9186a03626d98435a6f03a46c32e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "RapperBot", "colour": "#FA5B6D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666863, "uuid": "fee46e38-77ad-40af-a514-fecac83445fc", "value": "T1B6C32A0E6E629FBDF269873947F34A31D39873DA23E19349D27CD4106E6028D541FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666863, "uuid": "c1de1c2b-44a0-4126-86c4-de5231148553", "value": "1536:XZ6A3RCXbp6yPbvukBT0G0Kncqio3GQk0mOE8KyIitUfaljTjqCFMBpU6+RIT20T:XZn0bp6yzL7dq0jTeCiBpU6nq0cezz93", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684666863, "uuid": "cb7d62e9-2b98-425c-926c-f6d15bbdbfc7", "value": 129064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684666863, "uuid": "896f6904-b310-4dcf-a778-a0ef39aba278", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666863, "uuid": "f3d7dcec-2d32-4102-aa28-fa190af779ab", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94dc0e6c-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684680523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680523, "uuid": "03a337af-c0a3-47d8-bc29-c5a883bc0bdc", "comment": "Malware payload (Amadey)", "value": "cebfd37031b15f3f43e297013281de9b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680523, "uuid": "642b49b9-c45c-4b14-a88e-2659bc244356", "comment": "Malware payload (Amadey)", "value": "6e54fa2e62b6462f599cd0db2ac4dc4572e4f545096aa4210cc843986313984a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680523, "uuid": "dccde91c-d196-40f0-b72f-694dcb17eab2", "comment": "Malware payload (Amadey)", "value": "a1fa5cfdbbf7220481a17834ff624bbb951dccf1", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680523, "uuid": "1837fb6d-abdb-4d0a-8291-e8eaa02728cc", "comment": "Malware payload (Amadey)", "value": "fe15b04f3f6d4f609e0d4a8b0f5332cdf6e0f4f7f22bdcc6737688393382c607a56b07b4d69173101f7b99e51d1c5ab8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680523, "uuid": "bab87951-a3d0-49e9-95c8-399537c1ff3c", "value": "T12C25231377D540B7ECB027709DFA13D30726BD52ADB9930B26869DAA39B36C01939723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680523, "uuid": "1a821822-3a4e-42ef-9c2c-f16d55532d7c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680523, "uuid": "7c2165e0-920c-4310-a649-8fc390522e34", "value": "24576:VyETBTxynlieqq0jxqReyaXnuKfbjh//Rkk:wYynl9qq0MReyaXnuqb1R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680523, "uuid": "ceab6164-2b86-4d4a-b0e1-fe43618e4078", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680523, "uuid": "353a395f-9a66-40e2-aed1-7ec63b7e496e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680523, "uuid": "d3de5f38-9c58-4cc0-b902-b6a1fb2374ba", "value": "calculator578.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1339b41a-f824-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684706934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684706934, "uuid": "fdced05d-207a-4257-ac00-f4ae3889f531", "comment": "Malware payload", "value": "52064560daf536c37e8623ab6d8952a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684706934, "uuid": "0225cfef-4341-48e0-b880-48539ddf7068", "comment": "Malware payload", "value": "6e9c7aa9ac904cf92481f19856e1e27e8a894b11929a12ef0a952de3378da107", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684706934, "uuid": "80e71027-61e6-4fad-8e4b-a9e05c9c0b7d", "comment": "Malware payload", "value": "c7b838d852aac8695fd9a4256d445b13cd8c9822", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684706934, "uuid": "05555e97-ffe4-4746-b512-1f62944603a2", "comment": "Malware payload", "value": "a56938979b6f88ef8b9fafb547e3036f9c5ddab721028f005d18ca5f02cae0e8ace05ddfdcc7972eabbe712861a2637c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684706934, "uuid": "180fe2c6-2bf9-47db-8d56-891959084b12", "value": "T157252302BBDC8533DCB657716CF306930A71BD708829179A3B19F8096C72D95A8B277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684706934, "uuid": "db324170-153a-4a5c-b9ff-da8a0728acd9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684706934, "uuid": "be1dc0cd-bd14-467a-9470-f95ee2f2ccaf", "value": "24576:mytwGrS2EiSQzquepjKafgm0MQiNP9h0nFg6:1twGe2OQzquYKs90MQyP9f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684706934, "uuid": "8a6b6e58-0fb9-4480-8adf-c5cf5c22d147", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684706934, "uuid": "849ee69d-34b9-4a8b-a29e-9254fc6523fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684706934, "uuid": "0a18ff1a-c048-438e-8b11-4f2191878b74", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05c287c6-f7c8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684667398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667398, "uuid": "3acdef4e-ce43-4f01-93e6-97022931c6f0", "comment": "Malware payload (Amadey)", "value": "079b17de4d718d31e1dd54a109c26dbe", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667398, "uuid": "009580bd-233a-49d7-94c7-9fe76a053ced", "comment": "Malware payload (Amadey)", "value": "6ec52049ae81a4b62df9b984c341a269e40d6d1e45d08b6e851d9794bae58a6f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667398, "uuid": "67b1270c-118c-4910-a1b7-820a7f3c7394", "comment": "Malware payload (Amadey)", "value": "f900cde1be565b522a49e5b0fd1f986718ccc5ba", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667398, "uuid": "53b87601-166f-4ede-9868-8ad07a9c6bc4", "comment": "Malware payload (Amadey)", "value": "a30abee963355662ba320949022b5e643284983ca0a7af742f24ca67d60a6737117056deda664948a2b6b137f1480bbd", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667398, "uuid": "5db9aa78-4d84-4015-b439-a92550a61ee0", "value": "T1A5252303BADC8222D5E533701CF302831B39FD92D936867A3645ADABAD725846471B7F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667398, "uuid": "bbc00130-840a-4951-bbc4-ccf3c791640c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667398, "uuid": "381bf3d3-419c-454b-846c-5946ceeff0d9", "value": "24576:ayugwiNTkbHuyeqCsV+xgHMsWyxVqby0uZDgZzO9kCI:huVSTku3qCs4uHsNyrEZzO9k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667398, "uuid": "cd0c636f-fba3-40d6-bab7-cdc6de806ec1", "value": 1054208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667398, "uuid": "eadfb94d-8ee7-458b-8058-ffd810c5ba03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667398, "uuid": "84e63358-4912-4c10-95d6-8fe91453ed76", "value": "reporter795.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb86c976-f7c7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684667300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667300, "uuid": "56e329d2-d539-41d7-a2fc-d82cf47d09d9", "comment": "Malware payload (Amadey)", "value": "e94c4d0bbb6a20df0e097935aabd4861", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667300, "uuid": "23c467da-9c5f-4731-84c5-ff6c064d8e1d", "comment": "Malware payload (Amadey)", "value": "6edc526a1ff84bb60ac1b54e3ced823a6d00a9a38acd69f58457e3db7e281247", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667300, "uuid": "96ce30fd-816d-4fb9-bebd-afb8675a2d80", "comment": "Malware payload (Amadey)", "value": "c3a3e54129000446ef0bd5c3610b08ea2f5b6814", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667300, "uuid": "e7382ad9-60c7-4cb8-9543-967e819deda8", "comment": "Malware payload (Amadey)", "value": "2c36dcd1e7b5e297a26569a773c2d0684590839f8fcf8df3dfc4a5defb0048eaaefc8977011468d7010f1fb9f849d028", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667300, "uuid": "a3096a80-bdde-4ae6-8c8e-bf4d1848d579", "value": "T121252353E6DC54B2D6E50FF084F702832D31FC60AE75923F268AA51B5C72680E6717AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667300, "uuid": "c1f9264b-7d68-4b06-b207-89d68a4fa58c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667300, "uuid": "e7c53632-5f09-47df-bd63-74f8eb4e8ed3", "value": "24576:YyCLrKfLekfCKBB+U4z2Wv3xSxUsMeTmXkzMRo:fSrKbfCUBCp3gxTmXYM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667300, "uuid": "2ba129a4-97a3-49e1-b917-06306a76af35", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667300, "uuid": "bce4807b-8954-428b-adcd-cafb8ee493c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667300, "uuid": "41ec4414-5157-4794-b212-eaab16194343", "value": "discord_token735.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae4c7778-f7ed-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684683572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683572, "uuid": "91dc6846-3247-4c0b-8c13-051cfaab7cb4", "comment": "Malware payload (Mirai)", "value": "85ac6617bced623e61005af70cc90c17", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683572, "uuid": "645608b4-5a59-4584-ac95-4de390c4580c", "comment": "Malware payload (Mirai)", "value": "6f197c79836198a269c6bc46df922f6cfe50ba068972d4fe2c99a1f3abd241ac", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683572, "uuid": "69fda4dc-2948-422d-b1e0-4d31bccdf740", "comment": "Malware payload (Mirai)", "value": "89e5a5cca1ab1f70fbe3411b6bda69bb2842d2b6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683572, "uuid": "aff4f1db-3f7b-4b42-abcf-4f527fcf50d6", "comment": "Malware payload (Mirai)", "value": "6abf257e11681eea5e9a067b94e44f78f022e250d6e0b6295f5bc437fbb341a0e2bbf8aa449a985fc1f1f68ffc567bf7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684683572, "uuid": "7298e851-25fa-42c9-9bdf-759640221684", "value": "T1D0F3B598A8929E15C9F71F79F91F10A9EF0887DC93DBA123CD1C37F0358541A68AE721", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684683572, "uuid": "b7d76b69-be2b-4a4d-9816-53c7df657ccf", "value": "3072:0YkCUCtTnJdKLharfu42jr4aQ35V8zZlwfX7U53bb0cNFnOFDmxRA+JyDg:YuTneharmR/4aC5VeZlwvQ5kewFDUAer", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684683572, "uuid": "86f1e528-86da-4562-865a-335e52887d02", "value": 165168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684683572, "uuid": "83b3df40-f5b7-473e-ab7c-f0990ded8416", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684683572, "uuid": "34d59b6c-664e-49d5-82d7-ccedfd7e00e5", "value": "85ac6617bced623e61005af70cc90c17", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9430e248-f7f5-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684686964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686964, "uuid": "436eef07-c3e9-4e32-a937-97a3b38b0b39", "comment": "Malware payload", "value": "84b0217be6ebbd6b62fd833922e118fb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686964, "uuid": "e30f7a9c-0b8b-4c5f-a3e3-fab0dc71e93d", "comment": "Malware payload", "value": "6f66d3edf6a98cc9610884e83543548fc1c31809c55c08912a537aeed4b8329f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686964, "uuid": "006e718f-51e3-41e1-89e5-b8b5ea6a2035", "comment": "Malware payload", "value": "a37291b1a701b9a3a981251061fed9e705529cfd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686964, "uuid": "6341219d-31d0-4904-9601-4fca894ca6fa", "comment": "Malware payload", "value": "f5f17a0b3e4fdce394cfc0e9ca507c75bf08754a63357e16f74f3dcd2cb4ec89e26c7893c80f319675ebb0465ea69a83", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684686964, "uuid": "875d187d-56e8-4f1d-9d2d-b6712cc37326", "value": "T111933A0799A59F77C0C7EAB919EB59300326A9520B2F1F5961386BF4438F9CC740FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684686964, "uuid": "dbfdb840-8940-47af-a60a-d7dbea88c34f", "value": "1536:fI7+hcIM9naHAAGtKhmA+J/FosGvJtKqCRDQtmW49VquLeefkcX:YNIMZoAAG0hS/FoHKqeYm79VquqefkcX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684686964, "uuid": "e71ac468-0b1b-42fb-88cf-bedc69e9c981", "value": 94356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684686964, "uuid": "131d5133-9b8a-40a8-9412-ca6f27d5ed05", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684686964, "uuid": "c450e3d0-5534-4e76-b8cd-e2899bb85e48", "value": "84b0217be6ebbd6b62fd833922e118fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a88af77-f7c6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684666761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666761, "uuid": "619f577e-e272-4064-a3f2-2e731d6caba3", "comment": "Malware payload (RedLineStealer)", "value": "953529d6aa02f6b94100f5380ed02e48", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666761, "uuid": "622155d2-d786-42a5-a527-cd8df48597f6", "comment": "Malware payload (RedLineStealer)", "value": "6f8d078a49e1eb18227922be358b133d72dbe6ef7b9c739bbab9250ed1c951d5", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666761, "uuid": "1a198a6d-bc8e-467a-bec4-461cffdd4d5f", "comment": "Malware payload (RedLineStealer)", "value": "4e1ec413f0272d8ae11854eac5d6e710b6abc1ec", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666761, "uuid": "9c7e644d-41d2-468c-aeff-6121489439a8", "comment": "Malware payload (RedLineStealer)", "value": "a5ec1a1f010a34fcaca418ec0c008633b3a3ebcd396ce7460e1c2ddceb5a37da3287258ee1c65421897947fe711c7181", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666761, "uuid": "4d9ab46c-2abf-45de-bf6c-1015d53095e5", "value": "T10125231632D980B2FD3627B55CF303531E3AFCA24DB08A6B621469EB5D726905B32773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666761, "uuid": "2076b656-b95e-4ca3-a621-3bc84999d7d9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666761, "uuid": "9d65bccc-db21-43e9-8750-fc6e413b7116", "value": "24576:2yygAwwuMMpTWurzq6LHKXgvubFAySKqCM6i:FbA/uAqzq6uJAySf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684666761, "uuid": "ecbd896a-762d-4e8f-8976-e8d817f9a49e", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684666761, "uuid": "c399029d-208a-49dd-a8cc-d11dc55169d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666761, "uuid": "00d2b2f2-e552-4c83-bca3-4fadcb5a0691", "value": "plugin255.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3930a2e4-f7c6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684666625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666625, "uuid": "1b8be798-b546-4d85-942c-b475f98983ff", "comment": "Malware payload (Amadey)", "value": "f1fbb770b2ae8839e56d2924cb37ccce", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666625, "uuid": "e898e0ad-43dc-4589-adb7-42a25fb84fad", "comment": "Malware payload (Amadey)", "value": "6fdcc2eb31ea29a9ca7ef63f2b8223e5a220bf252b069c19258db0c55ca5fa66", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666625, "uuid": "84c7dd8b-20fa-474c-b0d5-eccb263701e1", "comment": "Malware payload (Amadey)", "value": "95d17c34fa2d030c600c06144493a2967535d177", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666625, "uuid": "2f8a1d7a-bbc3-4914-885b-6985aead6317", "comment": "Malware payload (Amadey)", "value": "9ff4761bdbf0fbcd85261fde5ee865838192cec0a12ab86da91f0033dbbdbe04b33699d3efb03472bbc4c9dde79be72a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666625, "uuid": "89102b48-08b3-49cd-bd18-d6f7098afa75", "value": "T1FE252302BBD84866DC71277498FB57830F35BDA18D74A72B3344A95B8D33644F8B2B26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666625, "uuid": "70ea0b0f-ebfa-42c3-ab30-9951bde53c7c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666625, "uuid": "526cb1f6-dc09-4689-a99a-afb240a70843", "value": "24576:XykCcLNcy/uOwvQq2vUWalHQMBlKQDkWr0g:iroNcy/uhvQqTvlKrW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684666625, "uuid": "356f6b90-74b8-48da-9976-8bb092603476", "value": 1054208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684666625, "uuid": "2f81ba47-863d-48af-b95e-1a65d419dde1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666625, "uuid": "51d71236-7285-49b2-9620-73ca2bb315e0", "value": "launcher231.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b233f269-f7c7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684667257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667257, "uuid": "40c6ff50-cb07-41fe-b9b6-8a900fb4ae6e", "comment": "Malware payload (RedLineStealer)", "value": "914b4f4628308db41190cdd48421fc56", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667257, "uuid": "bfbec92a-e96c-4c26-b559-af3bf327f4a0", "comment": "Malware payload (RedLineStealer)", "value": "6ff1ab3091fb41d7aef0851dccc3f328af6d729036b5c3d48dc64caf61685b42", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667257, "uuid": "1b417f74-9b33-49fc-becb-ea6b85d21c16", "comment": "Malware payload (RedLineStealer)", "value": "1b019140079da44db3635a9ed9eab38154209644", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667257, "uuid": "135854b7-5938-4779-a5e3-b4b23e271e7c", "comment": "Malware payload (RedLineStealer)", "value": "7b0e454e0a908546d7e22a4f743bee665ef76c82a66404807cf1bf1a13da886d49fa6a43a1ec7d36c506ba73befe2fa4", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667257, "uuid": "3dfb0982-41ed-4cd7-acaf-5e9c8ca52ca9", "value": "T14C252316BAC85122EC762B719CFA13971A35FCA05838872F234BE55B0DB36D0A5B4737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667257, "uuid": "81dc8ace-286d-43a6-b2aa-89bc18e63f38", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667257, "uuid": "ff8c6057-e334-46e6-99aa-b6d2a96eba29", "value": "24576:6yIN7uhdD6FJu+RYkxqeT/BnL1yHbMPaa94a7mB74Ay8K:BIchdGFJXRYkxqeTdp4MPaaaa7074Ay", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667257, "uuid": "dd176354-d26a-4dd8-baf3-ef68566d9131", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667257, "uuid": "da0586e4-8bdc-4b3c-83ba-b7dd07c10ccf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667257, "uuid": "d8f03105-415d-4ed7-836d-f83a6f0da42a", "value": "achievements636.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de669827-f7c8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1684667761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667761, "uuid": "a916d04c-da58-4175-8800-9218b1e5bc4b", "comment": "Malware payload (Stop)", "value": "b8825c2eb849b6656991b0b86785c139", "object_relation": "md5", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667761, "uuid": "ea5b6a17-5b24-496a-970e-0c20a778ee22", "comment": "Malware payload (Stop)", "value": "70365b7e7cb7451145d67b2b96721ac09ae6794d592b5a9d1dec808d322b53b5", "object_relation": "sha256", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667761, "uuid": "f94c4ef4-ea99-41ae-becd-682f55d98a95", "comment": "Malware payload (Stop)", "value": "8c4f20c0a0798b4006ddf187917576e456a6144b", "object_relation": "sha1", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667761, "uuid": "c9491825-3d1c-4efd-ae39-98749b581a85", "comment": "Malware payload (Stop)", "value": "a9ceceff6450509d06313e5303ac49336b9fe53a72889b894ec392e29d0e67a3019e5e48af57a4442cc418feb59ac273", "object_relation": "sha3-384", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667761, "uuid": "91eca662-de6d-40ce-8479-b65d295916cd", "value": "T18C05E00392D1BD63E7154B728E2EC2E86A5DFD618F093BD722146E1B09711E2D97E332", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667761, "uuid": "b6367b11-644e-4aa8-b81b-ab7ee452c650", "value": "a5b920833de11e763698004374a64e2f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667761, "uuid": "169e8350-454e-42d8-a476-9dfc8fdcfa65", "value": "12288:b64ORyLPQCUXOuzQDvjKtC9VdyfqsvFOKskZlYFMTI2gnaE5GPwQks9lBDu4:GlyLPFUXOuzQXG4EfqsFOvkDlULxQpD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667761, "uuid": "c594d15e-66fd-447f-99e9-e41affc5991c", "value": 843264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667761, "uuid": "2d6aabd6-9a0c-4672-8a43-eee31130e3b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667761, "uuid": "299eecc6-ad03-4971-b426-7475e6f1d361", "value": "UI602.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f8da09a-f7ff-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684691117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684691117, "uuid": "f01086d0-9e23-4d94-b696-df843137178e", "comment": "Malware payload (RedLineStealer)", "value": "a76e4b7f73c60226473ce18e48f02a49", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684691117, "uuid": "9fb3de5b-7d9c-462a-94b1-fc99f3ea6778", "comment": "Malware payload (RedLineStealer)", "value": "707523e12c7b453d64a202d6f68da809c4527c469a1a94fd07490a523f2d732f", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684691117, "uuid": "f978373c-072e-4a33-af65-0a0ea22648c6", "comment": "Malware payload (RedLineStealer)", "value": "c3d4eeb9fc1a4fbad8630b4d1feff51a09972c2b", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684691117, "uuid": "cce9b2db-1022-453d-894d-cfd45a8cf75b", "comment": "Malware payload (RedLineStealer)", "value": "4e050daf4f7d395653007e7923ef06ec5f4fe426f1c7ef9869e4da7b9c7203ab6b0d85a772a465ff1b27a41db5e0b7f1", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684691117, "uuid": "9296b314-f07d-46f0-bb4e-98c89e0739f5", "value": "T1652523537FE94033E8B517729CF605931A32BD7198B4D27A3B46DE520E71A88A832377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684691117, "uuid": "627ea212-5202-4a23-a709-f8fa4971b863", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684691117, "uuid": "eff9156d-28da-4709-b0d6-4b2a81bb9b7d", "value": "24576:eyOZuQV9BTAdQqdBBsP8cy8osvZAKSs2yVAP:tAfV99sQqdBc8c3oIeDe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684691117, "uuid": "4a74ebf8-5313-400e-9e60-ed6199b341f1", "value": 1046016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684691117, "uuid": "f57fc7ea-5fc5-4317-9c48-6de9832e9f25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684691117, "uuid": "b5b17463-272f-4f71-8b61-9d4683075f5e", "value": "2332324127.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7074101d-f7e5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684680032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680032, "uuid": "1dc84a7e-c14d-4cc8-a604-6947c1dc6c05", "comment": "Malware payload (RedLineStealer)", "value": "046ba4397eb39ea53d180010f730674e", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680032, "uuid": "9609b071-dce4-4875-87a0-7d5453adbef1", "comment": "Malware payload (RedLineStealer)", "value": "708d3a51da4974d0588595bcc4fbba1286b581a8951d877994822b607f45e25e", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680032, "uuid": "3467146c-5da9-4713-8b3e-c2d9dcbe1dfc", "comment": "Malware payload (RedLineStealer)", "value": "864af04b4cb921146ad7e58429deb1c43d8bc53a", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680032, "uuid": "696765ac-1654-4bdb-bc77-05f008dc7ef0", "comment": "Malware payload (RedLineStealer)", "value": "1fdb1fdbc834f7cc199bb0ac69603ae0a6536db9e75fab5d4120e2057dcd855e6c3db8581c329476fc5e4f386fee0ceb", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680032, "uuid": "4ef4a6da-5b7c-471a-8fe1-8685d76a16a1", "value": "T1D1252306B7DC8073F8BA87B004F617870E367C5259B89A6B375BAC190CB25E5A47173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680032, "uuid": "e99bbe1c-914d-4283-a210-96cbb613a89c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680032, "uuid": "96adcbf9-6170-4943-bf2d-a34da726df82", "value": "24576:ryfOH62TIq71TYV20Lo580EFUNh1yw42id+ipPUH9s1dw:eAhp1KLo5JcUpBicipPq9s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680032, "uuid": "66a17241-09b0-4a4c-b60c-4a0232646a94", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680032, "uuid": "d213d6bc-840b-4380-adb0-13340918739a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680032, "uuid": "04344053-a3b0-43ec-b939-5fdd842a08dc", "value": "downloader848.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db5cabf1-f7ec-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684683218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683218, "uuid": "fa03025e-42e1-4203-b56a-aaac9d4b826d", "comment": "Malware payload", "value": "26fb0dde752d4d84fd38ac41bab24388", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683218, "uuid": "9b243233-6ef9-49d1-8b3b-1b89a6c1e504", "comment": "Malware payload", "value": "70b47bc464ecb9dc9e668022781a7e5e8cbafb51a164e4f7a928fed1f10aab4d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683218, "uuid": "91df024f-e1d2-4809-b4d7-ad916c181dd4", "comment": "Malware payload", "value": "baf66573bace7e95b3e47fcd5fa4a28caef4ac7f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683218, "uuid": "87838059-6e18-4853-be48-dc33d81c422d", "comment": "Malware payload", "value": "1b15335f9409ebc219ba4b3da528549469fee7f681eba610ceda62276cb38d7f3842b55a2ee045fbc7f1d322f95d8074", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684683218, "uuid": "3dfd60d4-6e41-43d3-9d5b-94913a87ec9c", "value": "T1B4E3D313A5155E4AFC582DB9DC3B62F8BF98D9A703A765809D0BF37D0531C242C8EB89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684683218, "uuid": "df65402e-83cd-4d74-8953-2749bda51cde", "value": "1536:fz7Y7m2q0m5ifioWQrqr1QQRxYJkVCkId8XXDMVeRXMWDHNZA+K6hs5DoajS04:fzC9brQRx7IYkenA+JyDgB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684683218, "uuid": "8d1199c0-1924-448a-b8ac-c3801b48ebe4", "value": 148576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684683218, "uuid": "27a35d8c-6b9b-426e-a317-ba09c9a2fad9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684683218, "uuid": "7c619a32-9091-4cc6-b4de-29a9f0ccb4d6", "value": "26fb0dde752d4d84fd38ac41bab24388", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75080a42-f7d0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684671020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671020, "uuid": "590b638a-c35b-43db-8eee-884c730dc50f", "comment": "Malware payload (Amadey)", "value": "bfae81604837499942b317f9be7fa393", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671020, "uuid": "23f94431-17db-449a-84d3-97044bbe218f", "comment": "Malware payload (Amadey)", "value": "70bfffedfdf884fb9c4d887b748d5eed2b646ec994050a88280762f57d6aad26", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671020, "uuid": "83873e1d-5a75-4167-b9f8-2c74ae13adce", "comment": "Malware payload (Amadey)", "value": "d314a3a57e1a50337f31439c4b831b624f5dded2", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671020, "uuid": "e0b715db-f168-44f2-a0a8-553b3c13ed9d", "comment": "Malware payload (Amadey)", "value": "b68aedbf26978def244f6f87fe1c777c357f8076fd1ea5f58922c5b061a4e90759e07a52ec54e89845c355afd373679b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671020, "uuid": "b0453a23-c007-49b7-9eb4-5d99cec7882f", "value": "T15A252313B9E1C07BECB62BB058F207931E36BC508E74976B635569AE1C735806532B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671020, "uuid": "d668e97b-94f5-40a9-b485-124b2cefb439", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671020, "uuid": "0a3bd9af-08de-426a-8106-dd33181a9a4d", "value": "24576:uyDEtBvkE38lqiRSVkC7eq74zRUAPodzWpR1L8Vrm9u:9DEtBvka8lqUEkCaOzWn1L8VrK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684671020, "uuid": "46d76586-8016-4df6-8f28-a94999432d5a", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684671020, "uuid": "d0c85f2a-4e42-433d-a6b5-18929634c753", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671020, "uuid": "ccc6ef06-17f7-4f9e-a20a-c649336e4422", "value": "audio412.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45cda41e-f7b2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684658056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658056, "uuid": "4c79c093-e877-443e-9e79-68572c47709c", "comment": "Malware payload (Amadey)", "value": "062ece7595a84c3d9082d88592d39702", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658056, "uuid": "72f40220-4301-4d37-a55f-327f23d8bd5c", "comment": "Malware payload (Amadey)", "value": "7116b4c829c334541d03b07bf373b5f957548dfce1e8346e214c1cc613b23f5a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658056, "uuid": "e00dcf9d-8ec2-46ed-b2ae-55d9cdb1c741", "comment": "Malware payload (Amadey)", "value": "d23aa6eba7b85daa54e7cfe803dee5cebe70a4ae", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658056, "uuid": "1937ffdf-9d99-4151-a11e-5157fba94854", "comment": "Malware payload (Amadey)", "value": "dbe668dce16e6821bca5081fddfeae9420a86fa6bd2906cc0717c2332a9cb7baf4e05d6bf336639f8ec4f40843bd8771", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658056, "uuid": "74634544-cc7a-41ad-8656-eece3275aafa", "value": "T1C1252347FAE5D572C4B5273068FB02931B3AB9E14D34C29A3B42D99B4CB38D4583572B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658056, "uuid": "df95acfb-a791-48d7-8fe3-190b3349c4f1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658056, "uuid": "efe25712-c2f9-4545-b138-a99de2540612", "value": "24576:ZydPbomFr/6Jjwteu1+OnXNvAsTJk0RZlx6:M1om4u19ndjTJk0vT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684658056, "uuid": "e799ba79-d6a3-4215-92b8-48dc89913d35", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684658056, "uuid": "dbf7bd06-50a1-458a-9f03-2172bccf9b61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658056, "uuid": "799d66b9-4542-4b7a-a211-a71aab9d5670", "value": "readme.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cdb1f95-f7f5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684686925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686925, "uuid": "a6b9df5d-0425-44ea-a092-c650f7180c3c", "comment": "Malware payload (Mirai)", "value": "82b52b0edd432ea42bbe38bc7e843768", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686925, "uuid": "5b728bce-f563-48a4-acf4-43ecff92f308", "comment": "Malware payload (Mirai)", "value": "717a42b74cf740ee65d38d541d00526da922efb7a6323943b2c88755e6ab4931", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686925, "uuid": "4139376d-127f-4edf-8343-18c2d4d63dad", "comment": "Malware payload (Mirai)", "value": "1824c23f480765dd58a488c6ffda223ca0a6b622", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686925, "uuid": "430bb407-37f8-479d-9e00-4a354e236593", "comment": "Malware payload (Mirai)", "value": "556900a9de51f79cc18e9be39674f3b4c1c14d80abb6da5947fd6fc76ee22c325b5f7543540412d357c31d0f56b7c06a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684686925, "uuid": "021926eb-cd2b-44e4-b12f-cb5b4b83bebf", "value": "T1D0F2F851B8814A27C6E413BAB2AE5A8D377073ECD2CFB617D8615B20BB8151F0D63F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684686925, "uuid": "68c62cfe-c99b-4b01-92c8-8e73b342b3ac", "value": "768:zVWEn+5bAYG5zMHFSoSUdtrbfOlw7ph9yS0HJjOO4o+dwx:zVKbTG5zIPSUzPn5sgOHx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684686925, "uuid": "70bf3ee1-4e9b-4a16-baa5-67407a9078dc", "value": 35116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684686925, "uuid": "44c4b68e-666c-446a-b684-4feea0f03fb5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684686925, "uuid": "cf1e07ee-1764-44f1-9dde-161c37573ec5", "value": "82b52b0edd432ea42bbe38bc7e843768", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1709d7e-f7ed-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684683577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683577, "uuid": "46167626-d99c-41e5-9457-509df8e098c0", "comment": "Malware payload (Mirai)", "value": "b08e57f9449e500dc30eacc4aa9a1f9f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683577, "uuid": "bd711d49-5bf7-418d-b5c3-2539cd82a7c6", "comment": "Malware payload (Mirai)", "value": "71c1a2f555be7315f857516f69be754332533d530e253264fde646e7ecf16000", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683577, "uuid": "1c04fbe8-68e9-4ac3-8a27-dc16f12d4609", "comment": "Malware payload (Mirai)", "value": "9c680761db56cc71868448b54ac9383c55d7a8e6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683577, "uuid": "6edf3e90-25db-4c58-a4c4-15457319075d", "comment": "Malware payload (Mirai)", "value": "def82a23ac59f729275e45a8ca68ce24e593cf692f8f4ec4dcf240aa5239aa1eaa39015a853aaac17c82ae6441c83b58", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684683577, "uuid": "63de7688-1e70-45e0-9b98-0b01f1bdcbf2", "value": "T12D633A21BA761E2BC4C1947621F74B25B2F143DA26ECCA0A3DB10D9EFF719846543AF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684683577, "uuid": "98731d34-6f39-4fdd-9808-1dc38c546ec8", "value": "1536:lGRaTYmol/hGIAs4PNvAyQ8Gm75123tStGl:lya7hJJGmVDsl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684683577, "uuid": "2fa324aa-4963-4f64-b231-4b1c035ee02c", "value": 67320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684683577, "uuid": "afdeb553-76dc-45c9-be8b-9d511c5d46be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684683577, "uuid": "6c2299f4-c921-43ce-bd6d-76a5131f6466", "value": "b08e57f9449e500dc30eacc4aa9a1f9f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8d01f0f-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684680690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680690, "uuid": "293ed155-5c1a-41aa-beff-d6ccb623d14b", "comment": "Malware payload (Amadey)", "value": "32aed0d7761325bed37b69c81709849f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680690, "uuid": "dfa5f38a-a76f-42fe-8f6a-fff729e0fe0d", "comment": "Malware payload (Amadey)", "value": "71e83511988d90c16eaa3420ce9cde6f25bfba30a6916431e5f5ce8130d703a4", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680690, "uuid": "0d5fa43a-36dc-4418-8018-ceaa60949a85", "comment": "Malware payload (Amadey)", "value": "f354213fcac84e85bd639df73a8ad66c73f5fc11", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680690, "uuid": "ac3f9caa-b624-40f1-923e-f9a9dd51f6e3", "comment": "Malware payload (Amadey)", "value": "5fdaf2d75a5349fbb16aeda8ecb5b738c2443b3f50a419422284e95f293b124aa9f2ba6cd48e484b207a642b23c0d3f2", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680690, "uuid": "2de0542d-b389-4fdf-9193-fb59501eaea8", "value": "T1E5252395FBE44472EDF213B568FB02A30935FC906E68876B275169560DB23C1A4B233F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680690, "uuid": "97a28f6d-9770-47ad-930f-363e9656e8a7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680690, "uuid": "3eb8c9ad-4d29-42dc-b3b3-fde714e9dc24", "value": "24576:ay8fb4ynG2IH3MRZi1L3hx+LP0cdTy8Ptmh+DLTH4:hSI8RZe3v+QcdTyNh4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680690, "uuid": "ebd92df1-6510-4f2c-b08b-5e53e6f4645f", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680690, "uuid": "82343c4a-44e9-4d6e-a95a-d63fad63bf1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680690, "uuid": "d1ca4c26-8638-4184-bc93-392f47c96da9", "value": "utility863.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2be3f0be-f7c6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684666603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666603, "uuid": "66a524e0-245f-429b-baf9-9e1b608e9cb4", "comment": "Malware payload (RedLineStealer)", "value": "1f3c0f82056a0c54752fa877426b2711", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666603, "uuid": "08be456a-5ed3-45ac-b625-2e9809c6fa76", "comment": "Malware payload (RedLineStealer)", "value": "72063979b694ff4d2f3f157475371a8d8fa8b81824a30460a19d9329c95f07d4", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666603, "uuid": "36e1dc02-5761-4143-ab25-e79b4fc88a3c", "comment": "Malware payload (RedLineStealer)", "value": "6fa46ce09a549e0cbbdec0c4f21f187e37bc82a5", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666603, "uuid": "3a8e8df2-c349-47b6-b892-acc750668904", "comment": "Malware payload (RedLineStealer)", "value": "7f64c56aae9876821e2457b74411aba6ee0215c5b6c8a37bf5614439c213a7450580f1ffc312e8a96f04a61caa58e796", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666603, "uuid": "84ef1684-a371-42fa-b3f0-958aa5ff0257", "value": "T1A2252312BBDC4573E8B43B7099F302C71E34BDA1897C816B2684689E1D72D90B63677B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666603, "uuid": "604cc796-bb48-4776-8d03-6d83ea026ee1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666603, "uuid": "f6cb5b36-cd8b-495c-a393-5d0abf31f151", "value": "24576:+yMM9UT0VFK2h5Kq4BoQEYocQ8yOzlcWj3PBThJvMAHBj:NMM9JVg2HKqsESlp3pThtjH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684666603, "uuid": "a5a79bd2-72da-4733-9c9b-4ae11a0f001c", "value": 1054208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684666603, "uuid": "2940843c-d18d-41f2-af7e-2ad952de4bf6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666603, "uuid": "5a885262-fd8c-4589-8781-9af2c1fd7d73", "value": "handler912.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43ffdcf5-f7b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684658483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658483, "uuid": "1c3cf970-a9db-443a-81eb-ccb7f92d40a8", "comment": "Malware payload (RedLineStealer)", "value": "7c57738426dc10099e3f8929422477f1", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658483, "uuid": "876e6fd1-0aef-4d13-8fae-3b0e8749c2fa", "comment": "Malware payload (RedLineStealer)", "value": "724b375724fc43b6d4ccbd73d12306a30aba705bf78a219fcd2f773b58d45fef", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658483, "uuid": "bdbf994f-1376-4c75-ab15-3999b62c75f1", "comment": "Malware payload (RedLineStealer)", "value": "73263cba3eb466871cd44d4a70231b0c4bd4a371", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658483, "uuid": "675f7459-eb10-41cf-a53e-439b79c0a662", "comment": "Malware payload (RedLineStealer)", "value": "a975682e4c4b9a414f2d4d77663259f7eaceba7a06196cab4f7a8256dece130e4f78af2ad127d641a94fc9be920c5aca", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658483, "uuid": "a1192c25-88d0-4754-95ce-bad8de7faa06", "value": "T1DD252352B9DE9077CD755B706CF203970B33BCB29CA887462359684A0EB1AD5E93133B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658483, "uuid": "6d0620ff-561b-4cf3-85cf-b6e0144397a8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658483, "uuid": "3c2d7761-1f3d-4b12-afd7-77c51b9d4a9b", "value": "24576:fycjyYrSIjMG+WLxENNsPOdS6kA7Et32:qcjyYo80N9S6KB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684658483, "uuid": "87b07993-149a-4133-a835-3193424790c6", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684658483, "uuid": "bc35eb5d-d4d6-4f38-82cb-6d6a1a707729", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658483, "uuid": "c40e5ce3-fd3f-494b-8cfb-cfbaf3ff6f7c", "value": "resolver237.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7a70e4b-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684680661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680661, "uuid": "1fe9e47b-2a85-4e4a-82fb-434a31b20d60", "comment": "Malware payload (RedLineStealer)", "value": "0b1eb8cb28989cc00526ddac742cab9a", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680661, "uuid": "e0b9e6f9-d000-424e-b0f4-9a97ae51e476", "comment": "Malware payload (RedLineStealer)", "value": "729d0c5a1e2f691a24bd766d93c968c903735263ffda035cac387569a13d9d4e", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680661, "uuid": "6b79d7fb-3129-41a5-9695-a7047a6fa33b", "comment": "Malware payload (RedLineStealer)", "value": "9233cf626a32c69ea551ff5d4d857d1b29162658", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680661, "uuid": "d245c287-3e98-4746-9b64-af043c6636f7", "comment": "Malware payload (RedLineStealer)", "value": "b4d9dade023fef8ff00ef0d3639c3345863ab72e2266c3d332a9dac1832c96ebd15369856b571053922df6f7153b11d9", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680661, "uuid": "49518593-a3b3-499a-8ec0-0281aa0ac9cf", "value": "T1B0252303BBD980B1D832677158F646C71F33BDB0857553AA6725AD260CB3B84E831BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680661, "uuid": "15b54232-d2d8-4771-b3fb-caf133478b7b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680661, "uuid": "efd82519-fef6-4611-9062-2cfe8922afae", "value": "24576:cya4NaHtZWqMzyg11XOIzy3pPZDzLwPMQx4wfk:LRaHtZWqMNPrzyTLWR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680661, "uuid": "e2113319-9a48-45a5-a96f-60bafc5632e3", "value": 1045504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680661, "uuid": "abd52d34-a341-4ae6-9a52-b9b94b20446b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680661, "uuid": "05f5bec6-5b8a-4c39-b58d-623b77eb216c", "value": "saves386.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa5a91c6-f808-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684695296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695296, "uuid": "6a7596f8-d0a2-4854-b6b8-92daf419dbfd", "comment": "Malware payload (RedLineStealer)", "value": "db4cd49f2fd3ad7e1d3d72c0032bc181", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695296, "uuid": "49fc1568-b190-415f-9bed-56173f5847dd", "comment": "Malware payload (RedLineStealer)", "value": "72f81473e8cdc83b575d7344d1a075c2324eacc8c0eb4be2208e92e2e580564a", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695296, "uuid": "ea28cfd6-aa1a-45f2-bdf4-680f8fb7f031", "comment": "Malware payload (RedLineStealer)", "value": "0039cfe4789208761421e72caf8b53ffda48955c", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695296, "uuid": "74157aac-fe87-4278-bf45-38e8518f949d", "comment": "Malware payload (RedLineStealer)", "value": "2d52ca2970cb0e18064837b256e74ef39440bf401f0b792121997308bb12f43807c256f0f18c46022693d43e8fd54802", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695296, "uuid": "5d11ad61-f795-4714-b5f7-7b1adcade2e6", "value": "T1FFE3D528279F8934D6BB493D6CB19CC076BCEC52A542D70A4ECDF1593A73B80DB116B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695296, "uuid": "ffa26c34-2ac2-4998-826a-fba6f87ddb0d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695296, "uuid": "c0604187-ebea-4294-8d56-e1b004ec773b", "value": "3072:PV+m5chQmRSZQ1avem1eJwfUuMyNiOhjZR8e8hX:PjENURTIOhj7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684695296, "uuid": "bc213be6-ca58-4d41-ae60-b6e004ad2571", "value": 148653, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684695296, "uuid": "875eefc3-fd68-49b5-88de-0d54fa4c3e7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695296, "uuid": "4b8a245f-0b66-4af3-aa73-19bc5cf0e4f7", "value": "file253.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77075ba3-f7c8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1684667588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667588, "uuid": "497d4fca-c463-45eb-978c-d9c99b470347", "comment": "Malware payload (Stop)", "value": "8969998b8c0bf8a6355ffbe6824cb4c0", "object_relation": "md5", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667588, "uuid": "0d86cbda-a6d2-4f96-a8f0-ebedebfa5f60", "comment": "Malware payload (Stop)", "value": "72fe96710a11c58cffc2a88f057a13d2651bd96397bc86a0f4cd85fcfd274535", "object_relation": "sha256", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667588, "uuid": "35fe8c21-b838-4e10-a50f-15c49b94d70b", "comment": "Malware payload (Stop)", "value": "fda2685cb7de570479d47770ec4b9db2bea9c2e5", "object_relation": "sha1", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667588, "uuid": "8a380230-32a5-49fd-82aa-f5125322fc5b", "comment": "Malware payload (Stop)", "value": "9aa84fc375a31aee496db87b9ec8e5c99382c62f38586c683622de8786ae539954c9e4aab23cf17f3e69d62ace47b014", "object_relation": "sha3-384", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667588, "uuid": "3be03b54-f110-4c41-aff4-2a87b24d3889", "value": "T16805F12275E5E871E55A4671CD2EC1F8266FF8F1BF086BC722456F1B19302E2DA7A301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667588, "uuid": "783e89f6-0498-4714-885e-e88ca20eacb9", "value": "bb27c4958c76443fcfe46f9765d838a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667588, "uuid": "8ca01ce7-4e2a-45e4-b970-9a6af53d8cd9", "value": "12288:D5G1tb3W+SlVlNrYS/qHk3/cYAAJ11nDfj9V/GjU7daa9Owd/eNd8AIfYBHuABm:D52bslNTfPdAK11Dbh5a1wJed7m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667588, "uuid": "b711c5d9-b1d8-4440-80b8-b4e3752e74fb", "value": 805888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667588, "uuid": "c91b4697-da31-4519-8dbf-40d5c1564292", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667588, "uuid": "e5e0c2f9-be76-4e4d-b0b4-9960d0560caa", "value": "cumloader392.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02f689ce-f7e9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1684681566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684681566, "uuid": "47df530c-fb06-4426-8393-27a50e748479", "comment": "Malware payload (Gafgyt)", "value": "c8c92fd7e56d5cea1fc2922a67977b9f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684681566, "uuid": "ecfffc94-fd7e-44f9-8831-922926895916", "comment": "Malware payload (Gafgyt)", "value": "7311111bc744b185239be8f0ec37b566709dda7260a96a8f506b225ed0c4bdd8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684681566, "uuid": "173e0295-09cd-42b8-9f4d-86d837367358", "comment": "Malware payload (Gafgyt)", "value": "dc21b87131c75223d894927cf7545b594e7935a1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684681566, "uuid": "b28e58a7-3081-4f9a-89e4-b6c0f959cb47", "comment": "Malware payload (Gafgyt)", "value": "2ac6c3e7f6d36cf2eb1ba3b6b49a904798fccdde541c069b547b32ead87f6fe7c1e2faa8467644fad6a04d7263ff28b1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684681566, "uuid": "35bdb21e-91bb-4e79-bb8f-f0d2f4fb98ed", "value": "T1C1A32903DA60847EC48B93761BDFC6225623F8B90731621B63C4BEA92F169D9DE5D343", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684681566, "uuid": "38b72b46-1792-43a4-8ad4-74581ad1fe3a", "value": "1536:Q9fT9WiC3txvWtfEo5vXJM9wypej++3hLEgL7nLGPTms5TDUMHYr/:Q9jC9wtsOnuejjhLEgL7smITDfHYr/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684681566, "uuid": "0e738835-eff6-4930-aaf1-b0d32968dbb7", "value": 101269, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684681566, "uuid": "24740e45-7bd9-4f4a-a430-a74a4f15b091", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684681566, "uuid": "0e3a8211-81c7-4ee6-ac22-4ac198cb1a37", "value": "rebirth.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0423b9ae-f7d1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684671260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671260, "uuid": "e778747b-7f34-4eb8-92ad-11cb2dc248b6", "comment": "Malware payload (Amadey)", "value": "aec16a2c7b72b40722a607340396143d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671260, "uuid": "115f9d7d-bd17-4c78-a298-36d9f6c7d9d1", "comment": "Malware payload (Amadey)", "value": "731dec45709ebb65148c552c4982abf480b1eefe7eeae5ec1ab8bfc4f800fc7d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671260, "uuid": "8a3239da-ee50-402f-81d2-840cea339efd", "comment": "Malware payload (Amadey)", "value": "f0e75dc31925bbf5b33183e9780a02ebc369aa44", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671260, "uuid": "52fb2e83-24e0-40f6-baa3-08fb5e894ada", "comment": "Malware payload (Amadey)", "value": "72346c70556b7f86fa0212ce47c3b9280acf0ad3c88580795807eac92a263cfe1da52bc68b92ed9dde25e8fc62fc80ab", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671260, "uuid": "5a54d72d-f3c5-4f90-8542-9832f4056df4", "value": "T15C252216F7F98837D9F853B418FA05830B367CA6A52093E7B6C558550DB12D8E83273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671260, "uuid": "d3eba157-88de-4515-b91c-490797ff370e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671260, "uuid": "c3267dd5-a036-4fd0-99f4-571e3610f72c", "value": "12288:vMrHy90W6SHIARMB4olRLF6jpzJNOnYyeQzZLuevLUjhlch+xI7I2UUzDETjU1fb:UyXHIAC7XLFwAYyTtyhInPEnU1fPz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684671260, "uuid": "2797f9fa-409b-45ce-b8be-ad745342a173", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684671260, "uuid": "29a62fa8-cd47-4f2d-8bd2-e07988c5ad53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671260, "uuid": "17f9c882-6a2d-4dbd-82fa-77c1be3f96e8", "value": "server535.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad2ea491-f7d0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684671114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671114, "uuid": "08b967dd-aeeb-4297-bfbd-dd909b472710", "comment": "Malware payload (RedLineStealer)", "value": "e01c4c5372e5e92042716065cbacb7e1", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671114, "uuid": "227cbfb0-de0b-4ba8-affa-08a689ba0719", "comment": "Malware payload (RedLineStealer)", "value": "73da01638e79f775da3e0767d53716b0712cf85788daaf0c483ae3ac086e0a17", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671114, "uuid": "b172c019-021a-46b7-bbc2-ab394fe9bb86", "comment": "Malware payload (RedLineStealer)", "value": "2602eb314d7d053b6d5fbc454b9b49790f923e70", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671114, "uuid": "9eaebb6c-fdd9-4f7b-8ab4-34bbc6aa8eaa", "comment": "Malware payload (RedLineStealer)", "value": "ff9ffeeda22cc6299d09d3811fa37a63a0dd87f5d7c7069d23c2ddba885347ed3eebc1bd706aec8de9d26da816ea1117", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671114, "uuid": "8a157e6e-19cd-4a28-94a5-16a562caebfb", "value": "T187252206A6D6A036ECF5273599F646832722FCF16EB093172B07A9054D736A0E833777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671114, "uuid": "bed19264-024e-4973-a2ff-8733a775e1be", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671114, "uuid": "aee5fbf4-7236-46e0-a0f1-aa314fd628fc", "value": "24576:EyBeTG2Bq3LSsffl1AkPDDhmu4YlHxUTQ2F3:TolBq3Xfl94u19xUTQ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684671114, "uuid": "cd2445ba-e034-48df-97c8-b686a28e7aad", "value": 1056256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684671114, "uuid": "959f6cb0-34e3-4966-ac99-e510ee92a8b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671114, "uuid": "68fcc248-a254-4078-8a6b-869f501afe2e", "value": "renderer686.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7dc751b-f808-11ed-b3cf-42010a9c0076", "comment": "Malware payload (NanoCore)", "timestamp": 1684695211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695211, "uuid": "ba195ba5-ab52-402a-81ac-37a0a4b405d7", "comment": "Malware payload (NanoCore)", "value": "fc1b4e9eea73a359e3781aa15c013ebe", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695211, "uuid": "10a3fc90-0a44-484a-a075-16b80f971a71", "comment": "Malware payload (NanoCore)", "value": "75256a5cd60ef3bceb277cca6964b51f236d23f966846b5e748446c042d4890d", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695211, "uuid": "fce23dd8-6609-40c6-8b3c-73d746652961", "comment": "Malware payload (NanoCore)", "value": "be3c6336d1a9a90f92298403a4a5fa093a8cf5f5", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695211, "uuid": "0da765a1-718c-4320-94ba-50cba9337d5c", "comment": "Malware payload (NanoCore)", "value": "abedc90760f1e295276569f1881d7fc24ef2ec5569a9f67c181b885168df40d9f5b79765348ffbf2bf6f089ecd4585a0", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695211, "uuid": "b91db3e0-0e53-415f-b7bb-8e1988b2d284", "value": "T1D8F4230723BC877580B21AFAF3EFEC6F63CD45F25BA4966225F1C1329544A6A42F2458", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695211, "uuid": "9e8d12a8-eb24-4da0-bf13-2296e3a1b5bc", "value": "24576:dJWKCS1BleQvVA7xhH0eD4IFK8U4fzMxdB:fWKCakaVA7xhHD4GNTfI/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684695211, "uuid": "7a5070ad-a7f0-4d5d-a7e6-0d02200e2133", "value": 794797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684695211, "uuid": "62c29fef-f3cd-4112-905c-327bb058b870", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695211, "uuid": "57fc8d26-c3e7-4270-9a07-18b2fecc41f2", "value": "26324523.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d451051-f7b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684658391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658391, "uuid": "8dc13ca2-b202-4b35-b0e9-0f8a22dcc8e1", "comment": "Malware payload (RedLineStealer)", "value": "979d2a7b0726a6657304760c44100293", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658391, "uuid": "c5276b6b-94ab-4e0b-8400-a9dbceae0c9c", "comment": "Malware payload (RedLineStealer)", "value": "754af8a9f2959376db6bb2e8221f87459816c36068afd693b48cde23a19ac671", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658391, "uuid": "f7d702a2-27f0-4b59-83ff-ebd7f0e11f36", "comment": "Malware payload (RedLineStealer)", "value": "519ecf1feba3be8cc0279d8294c665f17978adda", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658391, "uuid": "815267d3-7ff2-4e92-be8a-9f1bcd9f87bc", "comment": "Malware payload (RedLineStealer)", "value": "4427d4d9b6ec1f35f5a5c58af66ada5b38d348dc93d3ffef04ae14f713dd678b1957cc6b1b0637623596fc46de60e845", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658391, "uuid": "da8e80a5-a5ee-48f6-99e7-7f5550bb52b4", "value": "T154252307ABD89432FCA433746CFA0AE70B26BDA14E78576B3245691F1C726C48932777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658391, "uuid": "5e339952-14d2-46c9-bb00-89f8cca56417", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658391, "uuid": "982724e8-bd4a-4cf1-99c8-33da5ec6be0f", "value": "24576:fyZTNqJYZ0ZtU4qFIg02m5CN5j/vmDHEkYfTdPnNoBt:qpNqJYe/U4qFIgPljyk7P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684658391, "uuid": "785aae7d-15d6-49f3-95f0-b620553805f3", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684658391, "uuid": "4f90f215-0495-4134-814e-2c9978ae81f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658391, "uuid": "5e4be756-f1a2-4db1-a306-317d078236d7", "value": "423383.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "023dc652-f809-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684695309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695309, "uuid": "973e686e-f661-4a5f-b178-7d1090ffd3b6", "comment": "Malware payload", "value": "0c9f94c77f120055db6618f4a3551caa", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695309, "uuid": "a1d64789-b91d-4c69-8458-df29b42b946e", "comment": "Malware payload", "value": "75c7abc83f3adab2e30211b83aec3a6759a5a1bc0b2f002cb3bd8c3d3e54633a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695309, "uuid": "48e7f9a6-18a3-43c8-8d17-6f5e4c599558", "comment": "Malware payload", "value": "cd918aed1149d217ef592348581049bfa5b4eb5e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695309, "uuid": "1cee4f51-9a62-4567-b0c8-001895604ac3", "comment": "Malware payload", "value": "b8ff3db15c1d8dff12005f274c3a7e488195b0d3a4266d5f614e15983e76d1ae5412855e38278989fa9a547f18f327b3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695309, "uuid": "b43f5647-0e6d-4817-86fe-e767787b5835", "value": "T1E5061242F7D714F2EA82193D50EAAB3B8E357F150735D9C3D384351268F16E2AE352A8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695309, "uuid": "7d16cc17-82b3-4040-adaf-89b9940d8904", "value": "ad9d11227a86b863e31ddf6019cc7ab5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695309, "uuid": "7e30fda7-3192-485c-87b1-47a8a27650de", "value": "98304:eT/HVQDwKKmpidDduWKuV8OI1StFJn4R1E9:K1QDrpidT8OI6FJnK1G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684695309, "uuid": "aee168c8-e728-4e53-a6e3-770ebf948b08", "value": 3885320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684695309, "uuid": "dcd65c37-1017-47b8-a239-1db1b4169406", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695309, "uuid": "26c7a750-6256-4fa0-a132-a191e693f135", "value": "installer838.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32c36730-f7c6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684666614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666614, "uuid": "b25e9fa6-b16a-4a1e-bcfe-282a12870617", "comment": "Malware payload (RedLineStealer)", "value": "ef2cda845800fe8f24ead02283ee4bf6", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666614, "uuid": "15c69870-a218-44bd-bbe6-aa59140ca209", "comment": "Malware payload (RedLineStealer)", "value": "7605217b56a48fb7493e5325f84b1a390b3c134dbd64a1bfa6757863c98433ee", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666614, "uuid": "6e4e1f76-3193-4564-8a97-c2878d30cde3", "comment": "Malware payload (RedLineStealer)", "value": "1588d8e0e4a960db5149afdf171abe4152733e5d", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666614, "uuid": "4c22f6a6-e345-4bb6-99cb-bba2605eed4a", "comment": "Malware payload (RedLineStealer)", "value": "5ab3bffb170aa5e8d04935ea9f3f41ea8195098323616911f994ca9d1d80f8360969438b7641a84047ac1a5d1adb6f69", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666614, "uuid": "4eb24792-4f3d-4093-9069-d829a2783be2", "value": "T116252316FBD88072D8711B70C8F313971B357D62ABA4C29B2749A87B1872AD19E31377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666614, "uuid": "9c1bad4b-fbaf-4adb-bbbd-0b1b3a0337bb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666614, "uuid": "d910b41e-a4fe-43f1-b961-84fb2e795fa0", "value": "24576:UySTFlBclHCgQqqZYwySyOnc0lQRgIimzp/BGa:jSxnUHCgQqZwKL5Zimz9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684666614, "uuid": "00bff318-2b28-4b91-be33-7b73ccfea2c4", "value": 1046528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684666614, "uuid": "5b55c767-8b22-426a-9d07-2fb8091a12bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666614, "uuid": "7839c2ee-8229-4a3a-8d8b-995e1b81b162", "value": "installer475.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2f61ba4-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684680654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680654, "uuid": "9db57cb8-cdf3-4c44-8c72-5655d2be32c1", "comment": "Malware payload (RedLineStealer)", "value": "810c04b11ad73081dfdcc3036b375968", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680654, "uuid": "21263b4e-e984-46ba-baaf-7455cbc5cea5", "comment": "Malware payload (RedLineStealer)", "value": "765ff41b0ec6558f8b15f66be9ca18ac18ed1f97ebb233f205b9a0571deab88b", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680654, "uuid": "8dcdad25-8ddc-475f-8444-17aca99f939c", "comment": "Malware payload (RedLineStealer)", "value": "36392ee0e806f5e9d80cbfeaa80c3cbc469ebea7", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680654, "uuid": "ed611d45-0beb-4dd2-974c-28893608c8e6", "comment": "Malware payload (RedLineStealer)", "value": "073a86a855d6fa9d999632f300b5bc360a1f481d51fef1534ac640b5a2b35e9de0d2fa533d9adb9f08b729fa30f34dba", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680654, "uuid": "0285f5dd-e06d-4997-99d2-7918ec3ffe2d", "value": "T16B25232367E86036DCBD2B3019F207A30B3ABC95EDBDC3165780A4AA5D735D0A971753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680654, "uuid": "69ddda03-98c3-47f7-9d55-42a8f3c2a5a5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680654, "uuid": "031a702d-ed18-41fb-84f2-9ef21f72eeac", "value": "24576:UyUdL8r7Tk/qbq26yNiF0Sdei/SV/7yGFtRu++ofeLWF16Vg/C:jUdO7zq22WSde4pqjTeLWFYVg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680654, "uuid": "d7066cb6-c583-41de-a51d-959f195c8be1", "value": 1046016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680654, "uuid": "cd1c5dde-be23-4642-952b-b5a6f53766b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680654, "uuid": "e5012343-258a-47bb-999b-c5ef7da850c3", "value": "report849.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c3f4779-f7b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684658443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658443, "uuid": "baaa4d51-b592-49ba-adb7-8848e10ba86c", "comment": "Malware payload (Amadey)", "value": "06318fc844c1a651c676936d83a63493", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658443, "uuid": "38189a04-bc83-4719-976c-5bb60421beed", "comment": "Malware payload (Amadey)", "value": "7669eecbacfb3cc798bfa332eba83df9e82cc44d2f283207cdab333b732933af", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658443, "uuid": "059d89c8-5a13-4285-b69b-956a096f3549", "comment": "Malware payload (Amadey)", "value": "d9b6e2623f3ab4f63e00601df58b826f490eafce", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658443, "uuid": "3783c5a0-f980-424a-bb53-f01356bef859", "comment": "Malware payload (Amadey)", "value": "1ebf9627b267a975b92ccf3c70bf5c459ac870718e9fd230b74cd14c9063c98c5b09b578b33a1b4c6d9d3804e73b7dd0", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658443, "uuid": "c00cbf4b-f72d-4779-a672-14ccdeb99beb", "value": "T18125235292E49032D5F623719CFA53830B3ABC6294358A7F2B89AD0F89327D4757077B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658443, "uuid": "ce8a9029-1968-4073-bfe2-83e903e8614f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658443, "uuid": "28556964-f05f-4ab9-a7f1-7feda845eaac", "value": "24576:Ny4PdtC1I5OOwbx5E84bpzjFIRlm1ry9nbobyW46BOLTM:oMKcOOU5E5pcnEt46BOLT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684658443, "uuid": "9c864e0f-bac6-4f0b-9718-75798cf1f1a7", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684658443, "uuid": "f1417d4a-8fe1-4bba-b530-dd044769b96d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658443, "uuid": "8198ebc7-6d4f-4ec7-89d0-e30a769fe3db", "value": "gateway164.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2af4aea5-f809-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684695377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695377, "uuid": "a0e77909-c091-49d0-af59-b29fe50eb745", "comment": "Malware payload (RedLineStealer)", "value": "eba6e7502e4bbdfc0cda4dd21f83f158", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695377, "uuid": "a04ed1d1-2bfe-416d-9917-d5a8dcb9f255", "comment": "Malware payload (RedLineStealer)", "value": "76a28795e161ff4c572a0bfdfa7b9f4ce9977f0a486dea8ce21d32ce66f3349d", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695377, "uuid": "0edbc43a-4668-4d3c-9d62-8f1f2d4a52be", "comment": "Malware payload (RedLineStealer)", "value": "7ada74f7f5fb624593f218d6d00502592060e0a9", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695377, "uuid": "fc14540a-ea11-47e4-815e-e38928d20ecd", "comment": "Malware payload (RedLineStealer)", "value": "b4e51efe8129f3b65fbf4f90842b99700425ea7679e734ec6c41a377a0bcde1fc31eb69a648e6c6c10f482834d42ea64", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695377, "uuid": "e333ed47-48b4-4850-b1ef-66c40805a0df", "value": "T1C4252313B2E4A5A3E9A217351CF503830F367CB25C7887BF274AA99B0D7158158727BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695377, "uuid": "bf9eef9c-4676-4b0c-93ca-241917ea63d0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695377, "uuid": "4d551a4c-cd73-4c91-9857-d148c2a46392", "value": "24576:dyeauyVFI9ib/YqZSutDWnRMyqPfFY3/cW0YlpbG:4nFfcqbDWnO1aL0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684695377, "uuid": "81f62a9a-9aeb-4ec9-b61c-6ca8f7fbc063", "value": 1056256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684695377, "uuid": "78c41d8c-83c1-4b24-b207-9a9f2780b49b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695377, "uuid": "d92834dd-b398-49d5-8b34-50f005b4a39a", "value": "writer730.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77c7ab30-f7d0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684671025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671025, "uuid": "afe4f8d9-4310-4b71-b1d3-b1c440014808", "comment": "Malware payload (RedLineStealer)", "value": "d0018036f2a6f1eddcf30c078643cc1c", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671025, "uuid": "11ad9a36-8bca-4ce4-a2f9-074aaee94ce4", "comment": "Malware payload (RedLineStealer)", "value": "7700560e42ea6e74dcf7628d4592ffda2a9fe9f474840ca8a42c4a9fd6386cc0", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671025, "uuid": "c743e348-ba32-41ba-a293-f051a15836d4", "comment": "Malware payload (RedLineStealer)", "value": "f2653c3257d135e3a50643da7c0231493583be6a", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671025, "uuid": "53c23f4c-4220-4e27-a235-ee439c53e852", "comment": "Malware payload (RedLineStealer)", "value": "1c49792094232e84c80b20b9d5f0db56af9d30b8106968d8460015796901ab3b91521d374fb96a3c5eb5380fcdd17cb5", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671025, "uuid": "a3375eb6-e651-4365-af0b-ac4cd882d34b", "value": "T1B2E3D624279F8A30D6BB497D6CB19DC076BCEC126952D74A4ECCF0593A73B80DB126B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671025, "uuid": "ca991eb5-629b-4c2f-b30e-29a2b1cbb1ef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671025, "uuid": "8ecfa899-df70-41de-9c54-1057c8d46ecb", "value": "3072:YV+m5crQmRSR38AQtQJ8uptt0phbZV8e8h1:YjCZE+phbf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684671025, "uuid": "048441b3-f43c-47c4-b0a9-37f3af37672a", "value": 148564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684671025, "uuid": "2ac7dd41-82d9-47be-9345-d82e71c28801", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671025, "uuid": "fc02769e-e794-4e08-aefb-1cffb3ce6d75", "value": "compress442.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42299aab-f7b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684658479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658479, "uuid": "d77a2e82-d817-4831-a598-8ab129ad526d", "comment": "Malware payload (Amadey)", "value": "64527a7c97601181864df8e060f05a50", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658479, "uuid": "64354ef4-464a-4711-b46c-bde94dacc55c", "comment": "Malware payload (Amadey)", "value": "77c8b264d0f8a29582cfbf4c24ff7ea462ef3bee98d33320592eb620b02655b8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658479, "uuid": "49e020b4-4cf3-4ec9-991c-02614862c464", "comment": "Malware payload (Amadey)", "value": "70567b03cf252a6396cf853ff03c5dad6aec7741", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658479, "uuid": "08ba58c7-0657-475c-9e71-d4c6e7a6bab7", "comment": "Malware payload (Amadey)", "value": "d6b2f37123104358832cfb2d5e93e533d5832876fa5d97403fdf142432bc8d2752dc6d56d13b016bff02796c0e4c23c9", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658479, "uuid": "4d905acf-d7a2-4f93-857e-ace545007699", "value": "T155252313A3C9C036C8B51BB44CFB03430B37BD695979D32A26D5A85E0EB2AD49574B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658479, "uuid": "3a53d83a-71ec-447f-91c7-c87c6ee1878c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658479, "uuid": "19dd44a2-060d-467e-b8bb-69e40a8d0115", "value": "24576:Oy+eaKtaOyqMbOmIBT6Q/vfmd49h2gcHTSvyaD:d+eaKtDyq6PIkuvua9hfcHTSqa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684658479, "uuid": "2b2f5ce5-e644-4b45-800f-604687052c0f", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684658479, "uuid": "0ea69fed-a25f-4560-8708-c34ae9223010", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658479, "uuid": "b6c7f1bf-84f2-4a04-9272-2e620d4de8dd", "value": "report168.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bea0ba02-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684680593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680593, "uuid": "62a026e7-cb8c-4925-aac5-ad184a054eeb", "comment": "Malware payload (Amadey)", "value": "a15543d879186ca7382348e2d2ac84fe", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680593, "uuid": "bb1d7393-47f5-47a3-bb9b-6e8cb2fbb072", "comment": "Malware payload (Amadey)", "value": "77d37a55f7e24e3d237471c4a5a2dcf3cef1fdd055bebf6a3fbfd848c3b0d87d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680593, "uuid": "b356adf5-2250-4c3b-a99e-df3299911188", "comment": "Malware payload (Amadey)", "value": "20af3159681294e7e04ab8b988be3192eb7f8d26", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680593, "uuid": "dfdee8e2-ff5d-41bf-aaee-e0f41cdca708", "comment": "Malware payload (Amadey)", "value": "94feef8e0c67ab62f3b0517e4b8ef985e793fe3f8990a6a3c126a6bdaeeb6f485ec119869f6e0c7e6a152617d03287bf", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680593, "uuid": "26ece028-8e8d-4db5-aea5-2b695d023e26", "value": "T10E252317E2DC9833C4B92B70A9F507830A37BDB45D78826723905A8E5C72191B6F673B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680593, "uuid": "8034039c-ec7d-43cc-906b-c116fe7a04cc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680593, "uuid": "bcfd38cc-1790-4a92-a515-b2b0e09a8d68", "value": "24576:DyTHIzCCLqsrM1Fp91xt6P3QlwOfSiUUgJO3:WyLqX91e4lDau", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680593, "uuid": "f4496577-87ae-415e-a6b9-39f2e8a26627", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680593, "uuid": "5e15497f-a22a-49d5-b577-ee24a9ca4ba4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680593, "uuid": "ffc5ce7a-2441-4d84-a2ad-d9b6de991b4d", "value": "interface954.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8c8951f-f7c8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1684667778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667778, "uuid": "84fc4872-a521-4dab-aa8d-70d3c221ac10", "comment": "Malware payload (Stop)", "value": "3fe8d70e6afc2e75bdaf6b0a59a738bb", "object_relation": "md5", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667778, "uuid": "7cce1428-6c0d-47a7-b533-91667a8efb0a", "comment": "Malware payload (Stop)", "value": "7800794cd25aaf48943d931935a9cd98980a645881fd557a24f0444ffbbdc2e1", "object_relation": "sha256", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667778, "uuid": "93026d44-6231-403e-85c5-5668424b1f33", "comment": "Malware payload (Stop)", "value": "c3d202e5b592d09799ca1df3209a40bfdb77bee6", "object_relation": "sha1", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667778, "uuid": "30fb4865-ce63-4d89-8781-6943d8fe01be", "comment": "Malware payload (Stop)", "value": "91f8283cd3eea07c0d318dc86d9b6819f1aeb063b5f3482ecc2dd807765987e1498b238fe3f4f1490a8e50f4798181fe", "object_relation": "sha3-384", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667778, "uuid": "687bfef6-00f4-41f0-9be5-9057b51146f6", "value": "T1E405E0039291BF62E9154F759E1DD2E8A6EEF9508F49ABDB72146E2F04B02B2C573301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667778, "uuid": "b6c5ea19-fc64-4808-9b0b-5063eba39971", "value": "c3945e210b1009128598ead2a7524d0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667778, "uuid": "1367c671-1710-4a31-8f40-c5a811aa72d5", "value": "12288:S8A7zS/xGU1gG7HCkpIwS95TUO2XzUjD4LIsxWps7hAlLCu24AXUF:SjS/xGUhikpIws5gO2Xz6DTs8iqCu6U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667778, "uuid": "a76fb324-b177-454f-a2aa-fc0fe1e4c445", "value": 842240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667778, "uuid": "3178adba-4f4f-4df6-bdbe-ddcd6524efa1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667778, "uuid": "db35511c-593f-4e7d-9428-3fbb87d69e1f", "value": "debugger549.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efc32d5f-f81a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (DarkTortilla)", "timestamp": 1684703009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684703009, "uuid": "c7abffdf-0ea0-480d-a41e-05e6e0d801d9", "comment": "Malware payload (DarkTortilla)", "value": "3b1c1c708596ec7fe563b06c0eb68245", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684703009, "uuid": "d085e0d5-1634-49ed-926c-b06fb0832411", "comment": "Malware payload (DarkTortilla)", "value": "780142cd361d17b3ac569eb6a281938c7eb67d30a26e8cccbeebf06c9c5e9a7b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684703009, "uuid": "f9ce2b9e-a44d-402f-92d5-ae6fe7ce888b", "comment": "Malware payload (DarkTortilla)", "value": "6d8c27ad87a7c335155a7366416b92801135df8a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684703009, "uuid": "cc42d3c5-ee48-4202-a5ae-eb2c062f7ac5", "comment": "Malware payload (DarkTortilla)", "value": "d7a4fce5e67dee1eb42a45f8a32d3aa8b3f55ea1d5b5e379a705bf6bfe7159297bde88798a03371c02382b04d5835b5e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684703009, "uuid": "3d476da0-d4c6-4a36-85b1-d8958b440374", "value": "T16EA48D65C960E160FFB9D0F7C82E5F8235680D5902FF33268957FF7271B21A4A69BA10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684703009, "uuid": "869b60c4-350d-4660-8b48-0da2e1074f8e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684703009, "uuid": "b953dc0e-18f0-4564-baaf-ce370bc693c5", "value": "12288:DHSCOOG8eRibYEA+4pO4VBSt3I92EulzQ/lZ3i04JiZKxNDoNbyTivcjgCRv+:2CXYEopBLD+/o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684703009, "uuid": "090114ce-042c-455a-899c-b3c526da1352", "value": 479744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684703009, "uuid": "e44397fb-775f-4b05-8f97-b5d8f6a2c6fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684703009, "uuid": "7e5d6f54-58d4-4608-9164-a65bdc4d3e33", "value": "3b1c1c708596ec7fe563b06c0eb68245", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf9b48d5-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684680594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680594, "uuid": "263aa4bd-a4af-4365-ad7e-ce4835600cda", "comment": "Malware payload (Amadey)", "value": "399ec9d91a0dadc9ac20b2d40a310dfd", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680594, "uuid": "d7b4824b-71b1-427c-8a68-41abdf67ac36", "comment": "Malware payload (Amadey)", "value": "782dbf2a368e19b463a4e57e7a97c42f92f682a01ce4279e3343d233d296f3bc", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680594, "uuid": "1e25c726-31dc-452f-81af-0d67d59f32ac", "comment": "Malware payload (Amadey)", "value": "dbbae6f2978982bbb0cc7227d229f4ab5ea0aca0", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680594, "uuid": "4cfd3e9a-9bbe-4794-8695-1b4b7c59d7c0", "comment": "Malware payload (Amadey)", "value": "d6431296537c3997d738f93eefc23761a427dacd4ad81aa2a06b24ea3aad890fdbe3f5b06b85b50b363f378df04394d9", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680594, "uuid": "464b83c8-0c17-4c8f-884f-6d122e42c106", "value": "T1D9252307BAEDD533E972273054F60583093A7DE0DA30A32A1349AD9F59733D4DAB13A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680594, "uuid": "7d713224-aebf-491b-8bbb-4dd8c51ef218", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680594, "uuid": "f7e802a4-d647-4889-978a-463d39d8c1a4", "value": "24576:hy8Bfc1NWAGeqWpIyP1AXafmRzsMoTcU+:UdLqvyd1fp5Tc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680594, "uuid": "b506c8dc-5e56-4512-8d4b-b95af5759ed4", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680594, "uuid": "b13342eb-9f4c-46ee-bafd-7f4f974fe15d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680594, "uuid": "62c9ac89-1527-4f9c-b483-3299ab640726", "value": "invonce587.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6f30d57-f7a8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684653924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684653924, "uuid": "2e2d24f6-9268-4e93-b90e-af8df0a30893", "comment": "Malware payload (RedLineStealer)", "value": "2a0edb9db5c778a5b6af5cc5ea9b1dde", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684653924, "uuid": "6967eb15-5b59-43c9-b8bb-a6e3b2aa5869", "comment": "Malware payload (RedLineStealer)", "value": "784fc1fbbcff2cafcd507ef7daa959fea0a7521a72c6ea42010e40e3cb337839", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684653924, "uuid": "b4104eeb-01da-477b-b665-99c0e9553d8f", "comment": "Malware payload (RedLineStealer)", "value": "ab13be730d7248387258f8a7a36b15a778085843", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684653924, "uuid": "6a131fce-c207-4dc5-bf55-8dc98d8a07a3", "comment": "Malware payload (RedLineStealer)", "value": "b19735b79d0ff80a31e1fed2c5a044dcf68db40c999c24d9d54d91c0ec92feba0ae952210941af8256a3516e31152d12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684653924, "uuid": "7ee46e8d-0bb1-4e29-85b7-5590fe4edc30", "value": "T15425231A6AEA0833FCF627741CF7128307377E95AD384273168299291C72691F57277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684653924, "uuid": "13feef18-1ada-4a03-9595-2333debf64f9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684653924, "uuid": "39c6fd43-ec81-4c49-a45b-433fd8d1555b", "value": "24576:DymAu+DASEFi+L4vGuDfOvEL6qF6r8Tyw96+YJ8:WmYASEDL4vGTE56IT+n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684653924, "uuid": "9b88c992-a3b6-44de-bf49-ac301b9a1676", "value": 1056256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684653924, "uuid": "f713d1af-3aea-4014-86d3-3a067cf7f99c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684653924, "uuid": "983a05b5-49f8-43c0-9656-c1650fe79be8", "value": "2a0edb9db5c778a5b6af5cc5ea9b1dde.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c33c1cd9-f808-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684695203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695203, "uuid": "e2999998-d6be-4a42-9fe5-81ea0272beaf", "comment": "Malware payload (RedLineStealer)", "value": "bb8e864f08597af2720b0fdd9f78b4ce", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695203, "uuid": "ebd3c9d8-7aae-4442-821a-2c56dd426458", "comment": "Malware payload (RedLineStealer)", "value": "7858f3b387fba2121cdc2e3762037a93ec3f2b961c872fb32de7a41188262e08", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695203, "uuid": "53ac2fc5-8b42-4f26-a3f6-819f9ca0c049", "comment": "Malware payload (RedLineStealer)", "value": "c7102bb1dad7da43043e9f35e4640820166fa80e", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695203, "uuid": "9ee6f99c-a44a-42e1-b90a-0168645d5c9d", "comment": "Malware payload (RedLineStealer)", "value": "0a3cb6347770d1f69ee1a37b2b9579d5d189c459a47fba3e9d3bea817d8dc2eeedaf31a501663c2faf14166eca51f901", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695203, "uuid": "3e8103e9-99ee-45ec-96b1-c89ac2d3755f", "value": "T1EC252313B9DC4077E8B12B746CF213D30F257CA18539925B7AA5AD6F0E7278061B2727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695203, "uuid": "7215d820-1ccb-40cd-bf0b-e661d77293b2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695203, "uuid": "5e88f982-0fcf-43b4-ae8f-0a38ae0f7b36", "value": "24576:TyJUb6H1JvdIqUS+0YGpgvviVMtSm3232PWSJz6gxirRME:myb6H1zIqnPhg3YcT3hx6ayM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684695203, "uuid": "66551e94-6bba-4c66-a6a3-b89d5fcf21b0", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684695203, "uuid": "c09e76d8-b3b1-49b4-9468-b001e1f7a00a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695203, "uuid": "5d8d1347-6202-45ab-b2d7-fe789ee9d263", "value": "245245254261.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3232bda-f7c7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684667259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667259, "uuid": "971de041-c3c3-4336-b4bf-60a45423e04a", "comment": "Malware payload (RedLineStealer)", "value": "0c7738e4a28ae3d656c25780c4b6d8ff", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667259, "uuid": "ff3d1cc3-62a1-467e-87e8-543bc0b5dd7e", "comment": "Malware payload (RedLineStealer)", "value": "788e4fed642bb08a538b5df492040b3e972d6e1615c05a1de516ccfb800fa6a7", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667259, "uuid": "0999847a-5a11-4686-b31e-4e1a841cffb0", "comment": "Malware payload (RedLineStealer)", "value": "de4a959bedf37a4a5fe7b8cf3fc7f215faae1cfd", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667259, "uuid": "659912bf-1fbd-4ecc-bb8e-a39d0c5ad165", "comment": "Malware payload (RedLineStealer)", "value": "1942f09a53225e50d9f9460495a995fa192e535bcbca84598dd5673653c26983b25c2ae390960cda0ecf610b4e3a2229", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667259, "uuid": "2b27f4f5-2777-4c31-a6b2-2449f09c5e67", "value": "T1F1252319B7E88033E474173068F617571B74BCE24D38879A32A9595A1E726C0F9337EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667259, "uuid": "9394dc6e-c363-4e8e-98a2-5abcc95c6acd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667259, "uuid": "671f979f-2290-4e9d-a7bc-abbb56427a3e", "value": "24576:ByqYc7UJSQ61TCfnh/cn8a46wCdtLYzjQZRCncf4xQj1:0qYywRh0nbndVYnORR4xQj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667259, "uuid": "6c3fec62-9924-491e-bb73-4ae25e71fabb", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667259, "uuid": "6b4df21d-372f-4d71-81af-65ae50274fb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667259, "uuid": "aac1a186-8fcb-48a7-ba3c-dc59bbabf28a", "value": "agent576.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c16216c-f7c7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684667220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667220, "uuid": "543628af-55f6-421b-86eb-3451f658e4a4", "comment": "Malware payload (Amadey)", "value": "2578f9ef7ac10ccb21b2a7ac5977ff3f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667220, "uuid": "2ef8d6d2-9a48-4e8f-a355-5c861a3cd3bf", "comment": "Malware payload (Amadey)", "value": "78a655494180e1703baa8235b7ab98decbdcac332b06f5cc4bac7323e1d2f48d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667220, "uuid": "ca694b74-4021-4a8f-bd58-2ffc6f825365", "comment": "Malware payload (Amadey)", "value": "d6ce241ee76f3fd6fc257dc54461ada13fb1f0da", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667220, "uuid": "4556dcfa-0d8b-42ea-9108-57337808a94b", "comment": "Malware payload (Amadey)", "value": "1f5f27c15f222d4c3700a7d48d89f054bf6ed02d6abca5d17533b0577ce6b2a76c534966aa7631b6c71ab1cc8305bf6b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667220, "uuid": "f8a000cc-a015-4a2a-b6cd-991f872ef53b", "value": "T1D62523639BCA40B2DDF1377059FA06C73636BDB01A74432B3346284D29725C9EA7176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667220, "uuid": "d1913200-dc0c-46a3-935b-07f5fb8650b5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667220, "uuid": "695b14a1-0518-4bc6-b8dd-123359925d04", "value": "24576:Ey+nIK6VwappZAZqA2qi6R/OtMJmU0miwJNrhTIkJUetaK:TvKYppUqA2qzRoKiwJZhTIkOet", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667220, "uuid": "867e47d5-9b4d-4dad-af0a-a8c2f8c32598", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667220, "uuid": "88a8ba72-2608-4846-875e-e54097081993", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667220, "uuid": "2024db77-3dbc-4de3-91e6-1b8dd82afb62", "value": "35677443.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff926d95-f808-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684695304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695304, "uuid": "2e5454c6-6de9-4581-bb69-bc0ecce8158b", "comment": "Malware payload (RedLineStealer)", "value": "ea9db4dacdec70faf935cd4f998918ca", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695304, "uuid": "7f337dd9-9484-45a3-be53-1a1e4bed2abe", "comment": "Malware payload (RedLineStealer)", "value": "791860bfd8fddd4ed4da1bd269cba09a2f19688bcd1b5e2412034634224be60c", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695304, "uuid": "8d50a749-966a-4989-b11c-81dc39f4dc33", "comment": "Malware payload (RedLineStealer)", "value": "428db18c0e1e211c212b3466f290082669f0f2f7", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695304, "uuid": "8ba2dd4d-b8fa-4da7-b422-98bd270d7df2", "comment": "Malware payload (RedLineStealer)", "value": "f86ce78ef15141150f25653e431d2160334162cdaf253c667b1be2981fd2ef1043ce35ef66eee49b82f2e49d5fb32e24", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695304, "uuid": "4fb698f0-d5b7-4322-a0af-346813258869", "value": "T1CE252303EBEC8172D9B62B70B8F602871A22BC919D7183277B9E5D5A1D71BD05933326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695304, "uuid": "35c94565-1770-42bb-a38e-ee5454cf9a77", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695304, "uuid": "2d2ea0bb-2cd4-495a-b474-afc35e132306", "value": "12288:7Mrzy90BAcYOtgdxX6etNwRqB9A6rFDeaBJ6HG6PdAG0aSxsm+RjZd5wNoj4wyHN:oyaGt/NIqPFsPdAGKsf76Noj4wyt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684695304, "uuid": "ca520e4a-d5a5-43cf-874b-65be54d11f6e", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684695304, "uuid": "0ba48655-6d12-455b-8f1d-5ce1b3c64450", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695304, "uuid": "ca212132-3f8f-404a-9c87-73176eae38cc", "value": "gateway961.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e46732a3-f808-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684695259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695259, "uuid": "aa57edab-985e-46fd-a587-41e46a84b818", "comment": "Malware payload (AgentTesla)", "value": "2fa11651bb778b5cef8da0e58d135f76", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695259, "uuid": "f1f9a02b-c6a1-471b-89d5-5ba0b7efcbea", "comment": "Malware payload (AgentTesla)", "value": "793fa84f515abf39c7c2b4cac06e6b09b2f3a70403eccc4ddc8035d6ce72a4b9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695259, "uuid": "2fc41892-3834-4c68-9d9d-7130bcd0eee6", "comment": "Malware payload (AgentTesla)", "value": "9aa4e666b060136d48422649ff78eb5ee6ec9c45", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695259, "uuid": "381c457c-2aa6-4221-95fd-0facb343d93f", "comment": "Malware payload (AgentTesla)", "value": "999a5d07efa0185c4c4f8bd9e52cfbc395279e20a317ed308328b9d27db331e4475264a9331a2eebfa54ac2828958b2c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695259, "uuid": "60d26a22-1c19-41a4-8937-4cb708815db7", "value": "T16544228B819B0148EED181E1934C7E7C9D5434DBCF018BA3764965A7AB731F28D8FA2D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695259, "uuid": "f384a925-5b81-4476-b7ab-f061e3bfab86", "value": "6144:upzgOqMCUvbsQvpMymkq7XmHlPfSjWlz/RbwE0h1ECZ:sgNMzfOymzmHZailRn4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684695259, "uuid": "735cdcc2-7cd0-419b-9fb7-6f6f29b7fbf0", "value": 260732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684695259, "uuid": "c5b72fe3-cbc0-4246-942f-f6286ca1f094", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695259, "uuid": "99826ef8-00a7-4db2-8a92-261370ecce11", "value": "Unlock311.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e67f85c-f79b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684648326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684648326, "uuid": "8673529a-60b3-415f-b534-37b15ea32581", "comment": "Malware payload (RedLineStealer)", "value": "396bc5561591f6be2f8962c138afef43", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684648326, "uuid": "a2e2356d-8543-45c6-bd58-ecabc4181580", "comment": "Malware payload (RedLineStealer)", "value": "794cc354a71c5992f8b303a76a4378630d320d3711ada97664ab97b99e3604e1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684648326, "uuid": "b3b4c8fd-0c03-4c10-b874-a452033abb16", "comment": "Malware payload (RedLineStealer)", "value": "eacb411b9723f2bf808b9e58daf8caf8e033ae4d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684648326, "uuid": "a5292f3a-3ee9-4e8c-8ade-2254ad46a754", "comment": "Malware payload (RedLineStealer)", "value": "d6ba57fbdeaf232ecf2e7855cf6d8f043537ad3127509b6c1b640541ff44071377ae628edaf86d279cfed6775a040294", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684648326, "uuid": "82b0a2b8-a64c-4405-acfd-69d5e175003b", "value": "T15F84B022B2E1E871E9654671CD2AC2B8652EB861BF1917CF33593F3F19311E2CA36741", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684648326, "uuid": "1a63ac2e-3447-4ade-a801-165c38c80a0f", "value": "bb27c4958c76443fcfe46f9765d838a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684648326, "uuid": "0ad5b9d6-2c6f-40ee-a5e9-c4b245d0d04a", "value": "6144:S7Hx1Kp8Ph1G962WHz00rmGGkS8QLwt+Pse84TK:WQ8Hs69HOGGl8B+PD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684648326, "uuid": "fcf26ecc-e779-42d2-9526-74af926e308f", "value": 374784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684648326, "uuid": "bf9b369d-3b71-443c-9309-ad62719f8fae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684648326, "uuid": "b5747426-fded-4b48-9b94-22d86a799e7f", "value": "396bc5561591f6be2f8962c138afef43", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9985cf43-f7c7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684667216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667216, "uuid": "78067444-ee4e-4ee6-9b6b-726dca95d35d", "comment": "Malware payload (RedLineStealer)", "value": "5512afff06a48297ee8e846a0256657c", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667216, "uuid": "4b1e6087-4172-4e77-bc87-3ce2da57b90d", "comment": "Malware payload (RedLineStealer)", "value": "795933c806e265190cea9ac38c003806bb0ccdb4ce2c6cf3b3a365db9bb9bef8", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667216, "uuid": "65171a04-a0d7-4dbc-aa58-b3dbb0b0d58d", "comment": "Malware payload (RedLineStealer)", "value": "62164acd3872e22e17c251e5bb9b7ef90106213e", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667216, "uuid": "43cbddb8-d45a-4b44-b559-d2444e0c570a", "comment": "Malware payload (RedLineStealer)", "value": "0d4954fda5109b8493ad88547d7d2259a5722b4613c11092f731b73d5d83ba4345a53a99593af365fe0908e9ef01a92c", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667216, "uuid": "866c20b2-466f-4a09-b7fe-15a71ac3470a", "value": "T1EC2523026BDD9432ED7907F064F705A71738BC938EBA932F778A184B4D32A84A571736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667216, "uuid": "c119c571-4a81-4e30-91cd-c4434029e71e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667216, "uuid": "52fe8f94-02d9-43ad-8f62-de7429dd15b7", "value": "24576:0yAC5itSZgUbqH6RTbM0WRX95viIyF+SfVT7xGb:DutKgUbqa2r5odXxG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667216, "uuid": "5e79e906-5a25-4995-84ec-3b0bec4f5b9b", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667216, "uuid": "8311d8d7-ddb4-4f3e-b465-09ddb5dcea45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667216, "uuid": "8dc5b848-50ff-4b12-a844-a18f7c246184", "value": "353512434.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e290c52-f7b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684658446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658446, "uuid": "98ea6bf2-836b-4436-87bd-64180e0ebe44", "comment": "Malware payload (RedLineStealer)", "value": "5a3cb2afa61457ecf2ea4948782b0d1c", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658446, "uuid": "56ba486c-3e7f-4e75-b229-670ef7001c43", "comment": "Malware payload (RedLineStealer)", "value": "7a1676b75b976e21bee7aa6e90cee10fd1437c3b897ea31df00da2cf8bd5c63f", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658446, "uuid": "7aa492a4-4db9-4e3f-aa5f-59df80460ae7", "comment": "Malware payload (RedLineStealer)", "value": "edbd25ba980257100f42eaf93544911d36400689", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658446, "uuid": "a48fac0b-3086-4eff-9a8b-39719e08fb9a", "comment": "Malware payload (RedLineStealer)", "value": "c9ffa3d19b3a92ed5a8f1d140b0f81ba8a64c40ec5c4bbee79b23f6edf8e358689d62754bae98ef3161de3b8df95cae9", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658446, "uuid": "1505a08a-223a-4803-8838-7ad849bcac6a", "value": "T170252310A7DB55A3E9B22BB074FA02834A397CE19D69923BA305F41E0D72345F0767E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658446, "uuid": "8ba3998e-b61a-4d59-b694-0c6df19b6e3e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658446, "uuid": "1bfee65a-32d7-42ad-8b19-0d2de05ae4c2", "value": "24576:qy50CjhRdEDsphWAlT4hkqV4g9lKe89wgkH:xSCrdESlkhVVdbKeak", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684658446, "uuid": "a180ae03-b295-4f76-9a5d-02de20bd7070", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684658446, "uuid": "8c0c5cb0-f5be-4c4f-bf50-4a7784a17725", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658446, "uuid": "fcc37fbb-19d5-44ea-b4ac-40efff7b6927", "value": "helper572.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3e81534-f7c7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684667368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667368, "uuid": "86c3c121-29a3-4ff9-a60e-ec55a2a1931c", "comment": "Malware payload (Amadey)", "value": "3d9a02c7e1dbbb44d7babac2a78c1bfc", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667368, "uuid": "4b0322f4-de15-430c-a48c-617189200d44", "comment": "Malware payload (Amadey)", "value": "7a7317ab0885f0968ece04a53b18df32bb292a70a163574af21470273c0136ec", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667368, "uuid": "ffe9bc70-0d8f-4223-935c-9b84c5e2aa93", "comment": "Malware payload (Amadey)", "value": "552e18918fc3a3694d75e4401fe0b05f4714b5e4", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667368, "uuid": "2fe9fe3f-58b3-4468-a418-d69258522033", "comment": "Malware payload (Amadey)", "value": "eb55e061dc4d0d4ac813db267330badccff43d6816ce822aad2a0e23976c2ac2051546f8ee66308071f68fdbe184d644", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667368, "uuid": "8df8151d-3c42-455c-8911-7512049d3254", "value": "T120252342A6E844B3E4B56B7058F743831B3AFDF04D39438F3A99A80A9CB15D4D971B1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667368, "uuid": "b6614bc7-6331-44ec-9f46-39492f7e8a97", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667368, "uuid": "6159cafe-249d-432c-bc03-9b56e1bf1b7c", "value": "24576:dyRJmAHBTjoTX3brvFvbNEO+ZjSV5Fumk4NVoIgoa01nmEBjbac0/:4RJLHVYNJEJZe3umkQVo/pja70", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667368, "uuid": "966649ae-033e-42e0-ae6d-0926a1729cd6", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667368, "uuid": "710b9574-a300-4e51-a3a0-2f6eaf4c5d82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667368, "uuid": "5f66db2b-71c4-462c-8285-55c92affad9e", "value": "patcher434.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6ebd6de-f7b9-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684661360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684661360, "uuid": "2b57c322-5cfb-4b52-ad32-559fdd0a4ed9", "comment": "Malware payload", "value": "180c8d6096cc9f6457dd5c4b3863d7f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684661360, "uuid": "ed7707cc-a5db-4129-bcb8-a2b054a025a5", "comment": "Malware payload", "value": "7b1c50294a076221786aeaaa76237a02a25d61302c6fb797a203b01fcec973a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684661360, "uuid": "6f517128-d30d-40a0-bf0a-f924b8363ba8", "comment": "Malware payload", "value": "c97a2dc7412b12bef8ef5ecc2795c7b3ce54f4e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684661360, "uuid": "4e3ed371-3a84-45f1-914a-d674a8e4e7c3", "comment": "Malware payload", "value": "a7acbd8da36ad1d4604de2516d586e7caf0cd1509f2b941c55310249f4a53816e448d8d30bf89ee9ecd139b10c55d289", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684661360, "uuid": "07f79e76-d1fc-4d4a-8af4-d29a815fa0db", "value": "T16486392B5196AAA1F4E133334BD5A3C19194A23B3D620CEF8CC4AD1D14E9D73436D6FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684661360, "uuid": "5e825d02-8e57-4b6e-bd12-49b37da2a75d", "value": "c983ca29445c3b0f29b987d079b73fc4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684661360, "uuid": "26ae8133-3384-4381-a8b4-64ad421c2803", "value": "98304:8JbaVIJpUZ/AdzLsj/0ngsUtOuk6Ir2Qs3BSBDShyJiDt9/:82SmMsj8nwEukE5griDtZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684661360, "uuid": "72c7d6c8-85e1-41ea-aece-c856ca2c682e", "value": 8056320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684661360, "uuid": "18c7aa0c-f217-4123-ad5d-0805db4f5d38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684661360, "uuid": "24becf3e-a4de-4246-8bf5-74919059a0b1", "value": "SecuriteInfo.com.Heuristic.HEUR.AGEN.1313961.12879.17745", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a8e1431-f78a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684640857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684640857, "uuid": "50039655-07dc-44fb-8e67-90949a8c4189", "comment": "Malware payload (RedLineStealer)", "value": "86ee20d9e3b204904597a9fe316a9e05", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684640857, "uuid": "b587b8d9-3339-47ab-88f4-0c2165040832", "comment": "Malware payload (RedLineStealer)", "value": "7b5a4cd4ecd43bf1008a2b6e6bea7b56c5d20925c6a0f286a86a80d4f3d00fb6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684640857, "uuid": "280ad8a2-eb76-4e2f-bd91-67a4c184282a", "comment": "Malware payload (RedLineStealer)", "value": "94c2f3da6d3bf4bad440aa96b71efda03db3971b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684640857, "uuid": "e1f4da5d-6451-44d9-a074-72a9ce06c8cd", "comment": "Malware payload (RedLineStealer)", "value": "3e54d4bcb24f471d3dc00b4e9b4ae8a874f933b8de7700329086b9cd5702cfe4146a74abaca77efb84ecd4b8efd9e96f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684640857, "uuid": "f5040117-ea14-45a6-9893-71055a61f146", "value": "T1AF252342D6F65876DCE613F028F602C71A36BCA29A6D835BB709981E0CF39A17176335", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684640857, "uuid": "e2f6b3a5-c95d-4f08-a697-ebe63293a59e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684640857, "uuid": "1a7aee94-cb8e-4c45-93f9-c0073663dc70", "value": "24576:MyqOfWrehbSolhAeEonnuHKgn+wdMbzTdzmMzxw0U:7VfWrUp4onu86MfTLxd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684640857, "uuid": "bec3f753-6ecd-4207-974c-8d1541f17a45", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684640857, "uuid": "36488c66-0607-48f7-9049-2a2a31ee36d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684640857, "uuid": "669ab3c5-246c-487e-befe-0b348b78d67b", "value": "86ee20d9e3b204904597a9fe316a9e05", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2830b41b-f7b2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684658006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658006, "uuid": "03428d41-e56c-4d7d-94b6-5b48adcd31cc", "comment": "Malware payload (RedLineStealer)", "value": "da944e6329845fad3aed39f25aad13bf", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658006, "uuid": "a8e6b32a-50b8-4ea1-b475-97a41e96051b", "comment": "Malware payload (RedLineStealer)", "value": "7bba3f9a2793b45763375d65a096b8026f6469fba0b5f4233c1a1767000017b0", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658006, "uuid": "a0a44162-5c85-462b-bf53-9403bf0f0ec9", "comment": "Malware payload (RedLineStealer)", "value": "dafdc69f9ea91ebdf516615f51494334cdb25fec", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658006, "uuid": "622df934-f64f-42d9-b897-355d30da0f3a", "comment": "Malware payload (RedLineStealer)", "value": "1f43004af9456083d66ff981b0dae2b1b7e44e49ce076fecf5dc23f19fc3a4ee5b2b730d5026049333a5723608d3419e", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658006, "uuid": "169d787b-88cf-4264-b723-2fe81ce8fe98", "value": "T168252302A2DD54B3E9B71B70A4F12AA72B357CB05E78472F37999E9A0DB32416070337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658006, "uuid": "332d4a27-871c-46e9-9a66-49551dc152dc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658006, "uuid": "b15e84ed-7614-42c5-bf50-941461f9e842", "value": "24576:3y2el+TtrB/omAb9c4aI/Cq7PC7/thgr14tyj4DvRfMpw:C2A+9yfc4aIacYgqss7RfQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684658006, "uuid": "88d00c44-ba9d-4362-949f-58e9d59a887e", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684658006, "uuid": "a8f2f3d6-3f05-4688-bc2d-8bdb8df8828c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658006, "uuid": "3cb7bc68-c5b5-423d-949b-e45edc2429a5", "value": "parser.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01abe3ce-f7d1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684671256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671256, "uuid": "4df891ef-c8c2-4690-b1e1-a4dfe96657a8", "comment": "Malware payload (RedLineStealer)", "value": "0e719d6ff783672cc3d9fbd9ec888c44", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671256, "uuid": "57066ffc-311b-485b-b613-9fe8ea4883fa", "comment": "Malware payload (RedLineStealer)", "value": "7c08a11ee160fc068af13f66b47be0fa867c90d58a15dc08f4dabbdb248a8c72", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671256, "uuid": "19915df9-b496-4834-b433-f46ffafbf541", "comment": "Malware payload (RedLineStealer)", "value": "ccb0e12d04923d898b7f5615c77d1322482fa01b", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671256, "uuid": "cc1b967c-bca2-4aba-9475-5f9f4890bf46", "comment": "Malware payload (RedLineStealer)", "value": "54459ac51f204fd67157dadc11c2e1732fee1b9619968a03d6cbeb0f17a368655ee60f2b6828a23759d294dd4b26285c", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671256, "uuid": "46758950-e2ef-4723-99f7-6a835d6b83de", "value": "T11B252313D6D94036D9261BB095FB13C72E75BCF25A70039B3BC15A6D09B26C4E2363AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671256, "uuid": "234c0fc7-afb1-47a3-ac02-0e50ac69fa1c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671256, "uuid": "e9b7614a-bf04-4d25-8a42-f2ec41b39d2b", "value": "24576:vy+DtRtdrMr0Bkn0wINSZSGHWzhA74gDfJmPVzJq:6+JxCRnMNS/Wzh+Jmd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684671256, "uuid": "8653af06-1195-4bbb-a6e7-83b5a6c6352c", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684671256, "uuid": "ca0bd1cb-0f5c-4a4a-85d6-f62573fc5aa3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671256, "uuid": "ec940d77-c326-4a97-957c-ed8fff873f2c", "value": "resolver282.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90dc573b-f7fb-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684689535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684689535, "uuid": "e6fba6ae-7040-45c2-9fff-0e39aa9ee61c", "comment": "Malware payload", "value": "a927f40de7ad3718b8ad2d4a0cda7ccc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684689535, "uuid": "6acac0a9-dcb5-438d-b1ed-58ee75bd442a", "comment": "Malware payload", "value": "7c698e4aa4593ac4e70e0c0029f11b40d9a8019ba6f4f481702781e9ba1f0674", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684689535, "uuid": "43707681-f4a7-4651-b689-a8c384260dd0", "comment": "Malware payload", "value": "38f0b842b10cea410e45e3219d65814247eb181e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684689535, "uuid": "ef7bbeee-157c-4612-bf8f-7d33c467b4bc", "comment": "Malware payload", "value": "db4d5ce9cfe10b0adedfb16eb7b17e0a00d5c376fd9175c820f242cc8ed917df4a0b3485a4274794c383cbb8c3edfa48", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684689535, "uuid": "b28d4ec8-0ff8-49a1-922d-faa2a23c5eab", "value": "T171435BC0AA92F8F2E812147C207BA7765A73F4366535FEDAD3985923AC11701E61B39C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684689535, "uuid": "0adbbedf-b909-4479-a12e-3c1d04a236fd", "value": "1536:kk9iSffV+ZjHjQ8ZUBfNXCWi0L796K+x2nhxGpc0SX:5wSffV+ZfQwcfNfi0QK+QnzUcl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684689535, "uuid": "b196226c-1e21-4785-b287-0fa1d54cefd6", "value": 58928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684689535, "uuid": "7ea7913b-5571-4496-9d89-f0942f35748f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684689535, "uuid": "f6c0893f-e789-423d-b33a-ecf1c3afa7f5", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fda05b3-f807-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684694500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694500, "uuid": "e201716a-0678-4c4c-997a-d1eff1bb596a", "comment": "Malware payload", "value": "e4d6154ff77891d9ed364767b70cb07b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694500, "uuid": "fdebe96e-0f23-4e46-b1b6-93d714ee8d52", "comment": "Malware payload", "value": "7c750fd0171835613e9af6ec6622f6cb27a20da65b8e5f36a05ac65dd740eaf5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694500, "uuid": "6f8082d4-1ff0-41dd-8427-860779f98517", "comment": "Malware payload", "value": "b52a13ca8ce04e88b8299fa0574540f3c0d94632", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694500, "uuid": "417eeb10-1e92-446a-b7ef-190d51b0323a", "comment": "Malware payload", "value": "dc317c4315080820a0256ef22dbcacb417127dc16d3a6d443ec4b0879d8957214a9bc77e677fcd44f00a02c093ac0fc7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694500, "uuid": "d001bc7c-23c1-4a08-967e-755581e96a7e", "value": "T1B0337C77E82B5E28C09986B0B4748EB56F63A1C093475FBA24B6C7749083D8DF505BF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694500, "uuid": "e264c449-70f3-4fa8-9af9-9dd9f0ceac17", "value": "1536:6jJqTPr31PjQHKd+qOCU70nyeC/BV2JbBX:6jgTj31PjQqdtPUuyeUV8VX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684694500, "uuid": "913d42cd-737d-496c-b917-3de814f1e12e", "value": 54472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684694500, "uuid": "de8afdb7-eef8-419d-8952-9928b7463eca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694500, "uuid": "0aed9199-e5fb-4fba-91b7-5f888d1b3593", "value": "e4d6154ff77891d9ed364767b70cb07b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0438e999-f7c6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684666536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666536, "uuid": "7ffda467-19a7-4bd6-94c1-ee534744a2fe", "comment": "Malware payload (Amadey)", "value": "da599fb9ce0e9a6909cfde1f1da81d16", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666536, "uuid": "ea32ff3e-f9de-42f7-bda2-c700ee762cb9", "comment": "Malware payload (Amadey)", "value": "7cc06a8b59760708079dc621b6a5c8dd674e01539d5e1dfd371405aed562d444", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666536, "uuid": "8c0d2b90-fa78-470a-bae3-e5e8c677b7a2", "comment": "Malware payload (Amadey)", "value": "bacc900e065a46a739f2461efdef38e28bff07fb", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666536, "uuid": "5ddc0952-fcde-4df9-83d0-99e2f9aff8ed", "comment": "Malware payload (Amadey)", "value": "24abd021a883585a4d9018094b50ce63ddb91bbb09a6d7fff32848f739c07f5014ea429f86327acdb83bbaf63f9ff46b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666536, "uuid": "22d6da46-f7e0-42a4-8a17-faa39f6049f5", "value": "T1EF252302B7EE84A6E5B81BB459FA07C30F357D619D38635B2B88E81F0C70A91957136F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666536, "uuid": "dbd30235-a620-4668-8b68-8ea1533cf0a2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666536, "uuid": "eef30094-ed09-45f4-899a-93c4d6ba661b", "value": "24576:ZymUT07oCUxuNgvBBJZKgyGmQd25tAPXAUUR9E9Ta6akJ9T:My7o/vnigyHQdwt8ukTax", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684666536, "uuid": "eb7e4c9e-fff2-48d3-af90-7a40e02a738f", "value": 1056768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684666536, "uuid": "cb6a5af8-49e2-43ba-b2a5-e45077e0f8d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666536, "uuid": "17a2a320-a8ce-4e5e-9356-9248775c7f00", "value": "editor912.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "656dbdf7-f7a9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684654244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684654244, "uuid": "e5be906f-3b86-4d23-91a2-d2f09a604bb4", "comment": "Malware payload (Amadey)", "value": "cefdd38e3778f7603c667d36ede8f909", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684654244, "uuid": "3e48c74e-dca9-484d-ae65-935dc3ad51dc", "comment": "Malware payload (Amadey)", "value": "7ce671025a7350a73c075ee8db73de5b9dbcd04f9b5fe988a33f2fc41ec63839", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684654244, "uuid": "03962568-c61b-4793-9435-1f0f0c038247", "comment": "Malware payload (Amadey)", "value": "dd1ca876102592a4d562440b335e8e050f531392", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684654244, "uuid": "30ab7f3d-6a6a-47a8-8982-1544a7cc804b", "comment": "Malware payload (Amadey)", "value": "d4be6a8cc7916e0d71aff15c0604a539b48707e698c88cdf14805cfd3d60b5bb00a680c241b529140efe3c368d18791e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684654244, "uuid": "33f4e861-516b-43f7-969e-3846f72c17c6", "value": "T113252303AAEC05A6FD3123B059F642930B35BDE28D75923677A178192D339C8763B367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684654244, "uuid": "a7bcf027-1561-41d9-b5a0-c2f24d268cf1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684654244, "uuid": "68bd53bc-1677-473a-8fa9-5b09a085ebfc", "value": "24576:SyeSJaD6DkqladTqSOBb+mahMVaOuReo/7eynECk/:5ewaDckqlSTqSOB+mHaxzrD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684654244, "uuid": "5c4829e6-d9b5-4fef-8644-d7d8e81f2935", "value": 1046016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684654244, "uuid": "1327c44f-0b67-4023-ad02-78523c90274f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684654244, "uuid": "a8fe282b-6480-43ed-a435-197196d2a5a0", "value": "cefdd38e3778f7603c667d36ede8f909.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc5a85b3-f808-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684695219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695219, "uuid": "3bc8c357-faf7-4008-8c48-156528bd4423", "comment": "Malware payload", "value": "9df97891924dece9a947aa10a4c4faac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695219, "uuid": "017ce60b-464d-4aa8-96c5-7a1372bedc22", "comment": "Malware payload", "value": "7cf0a676d5e52fbac56fcfb84b624a2a2d550ac317ee8b2c5f3fbe76eb40211f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695219, "uuid": "cd4956ce-2e1c-4a79-a237-89c4b1d4ff1a", "comment": "Malware payload", "value": "59e2a0d74afa3f1506ff695186c7919bdfb35bfc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695219, "uuid": "90c84468-6de9-4d37-8168-c7db56075d20", "comment": "Malware payload", "value": "447bc295499390e376b5d6b9945964b8f82e89596d58989822cd27d1be826ab55233ac4ae043e5086646577bd3df9b6c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695219, "uuid": "378cdb39-1f03-42d4-bb92-b80e5f9ee0f9", "value": "T10663F956F8819B22D5C1127AFE1E514E332317BCE3DEB2125E246B30778756B0E3B949", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695219, "uuid": "49ea85e0-9276-4fe5-a548-a9e10f7995c5", "value": "1536:EJn+wtDUPQnKmAIEztB0a7+RKhIRiCPKxAMu7D15iYW:ODjyztB0a74PKxAMuX1c1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684695219, "uuid": "32eca051-3d8e-4fda-b1b4-badd3443f844", "value": 70804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684695219, "uuid": "961f099d-2a68-4d9f-be64-c3095615db6e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695219, "uuid": "fa68fa99-df17-4ea7-8800-b349f638b867", "value": "9df97891924dece9a947aa10a4c4faac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbea0812-f7c8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1684667811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667811, "uuid": "577843ac-164f-4e99-b53e-900cd560e39b", "comment": "Malware payload (Stop)", "value": "e65780b1185a83adc7e60b7992a2225c", "object_relation": "md5", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667811, "uuid": "213579aa-19b2-4fdb-ac3c-bd19f38a3b78", "comment": "Malware payload (Stop)", "value": "7d0485e8348a7c45a4124bb3c458f304eb0a573f0adc7b507286348138ae02fc", "object_relation": "sha256", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667811, "uuid": "e5f5973d-483f-4318-a310-cf174e97b6eb", "comment": "Malware payload (Stop)", "value": "b16f06dc572176f07e2db83dc3fb37dc6446ee33", "object_relation": "sha1", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667811, "uuid": "4c8d01db-e7b9-4bb5-9a35-bb14a6c9d018", "comment": "Malware payload (Stop)", "value": "c43289ec9dcc8fcea29b9fc340602000f356e86ec170715ef8b59b3f154062379795bd5226f648c7d125ff00418cd152", "object_relation": "sha3-384", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667811, "uuid": "443aaf9e-8c1a-4a1d-a5b6-f56bf2a8fde1", "value": "T1DE05E003A291ADA2F9514A3E8E2EE5FC765EF8514F0D3BD762546F2B24701B3C5B2342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667811, "uuid": "d36495ea-e712-4273-9f07-8964afca9d9a", "value": "f682da34b918ddb61703d12aa2522a66", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667811, "uuid": "aed3b699-7e39-41d9-b601-5e522ed819af", "value": "12288:fYBRnFFRwGT4IHQSVco2pfklukv8cAmuRUURUJ3Nrg5CnM1Ulh2Bcjc:uJ6VIHxSxs9v9A56wULc5uducj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667811, "uuid": "8cb61ae8-14be-4d41-90f4-11d24127f076", "value": 841728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667811, "uuid": "1b6eb42d-707c-42b2-af53-cc9e07733e05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667811, "uuid": "e7cb1e88-236c-4f16-8cf4-44a51e17b64c", "value": "parser638.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bba72185-f7c4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684665985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684665985, "uuid": "5f1d5f7d-b958-43be-a9a9-0e61fcf3b3b3", "comment": "Malware payload (Mirai)", "value": "92331c9c3063fd5d39f56dc4043c8803", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684665985, "uuid": "e94faffa-3029-4eb7-8763-1e7b147a0a73", "comment": "Malware payload (Mirai)", "value": "7d0ef6196dac3971897aa262d3f0b6325a0c9341866718a3dce8952b82195d1a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684665985, "uuid": "ed0d75f1-1bd9-4200-913a-633733887539", "comment": "Malware payload (Mirai)", "value": "ac358315434b210c31a36a2b91070f0c3eb326ba", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684665985, "uuid": "c616ecb1-3d02-433b-9152-4103cb16ce89", "comment": "Malware payload (Mirai)", "value": "d05dcb56fd300873569a40e2aa91db4e696303830bee3adc62b675a25eb1c2b9a2fe72a3ce214943271d2e64eadc67a1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684665985, "uuid": "009277b1-ad0b-4f6c-87c4-c80207e7289b", "value": "T15763F682BC80E616C7C01677FA6F509E331567D9E1EA32429D251FA07A8FC1B0D6B786", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684665985, "uuid": "4e410265-65fa-4c7b-8ce0-527ddc38e571", "value": "1536:xBnoU1QAu0Ud66g27Ilx0lB8t46uxtajJzox:xBoU1QO0384BxtIJ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684665985, "uuid": "4eb940ff-fa96-4298-bb0b-f77791ce573d", "value": 70652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684665985, "uuid": "a318fb76-2487-48fc-8257-8cc42d98044d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684665985, "uuid": "9e2d5bde-b52e-4f42-8cc2-6b4ca9676625", "value": "92331c9c3063fd5d39f56dc4043c8803", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a36077a3-f7c6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684666803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666803, "uuid": "f7447644-2ba7-4af2-8f8c-1896de730262", "comment": "Malware payload (RedLineStealer)", "value": "3ff2bdf197ca53bfbcdd05443f85bb74", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666803, "uuid": "2c01b571-50a1-4b62-90bf-605106eb83c0", "comment": "Malware payload (RedLineStealer)", "value": "7dcb86a162ea278fa7cfee4f134dd26993b9bcee3b11de979756e7191c5be2a0", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666803, "uuid": "b1b3a434-e0c7-407a-a1f0-6863237c44f9", "comment": "Malware payload (RedLineStealer)", "value": "b8a2b5fcc107f48228f9c9d6d16200658769b7f9", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666803, "uuid": "f1d7e4be-a67e-41e8-9b9d-1a4f50d387e7", "comment": "Malware payload (RedLineStealer)", "value": "ffe15a8df9158370db752c06696f98d75db2a3422508b57b3ee84873b855b2e0b1d7a6aaea14ad63719d5a8490074921", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666803, "uuid": "3f5872c3-05ac-4a30-90f6-da851a86bfe7", "value": "T1F325231BB6DDA827D4F217B14DFB02830B363CD5AAB5875E21C0B6560D725A0F83276B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666803, "uuid": "2ce74a53-5e8f-4d87-b1e4-562f2bc788a0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666803, "uuid": "aaca4412-d36e-4f93-833f-10986e63fece", "value": "24576:7y0YeM1Ea/bzd6mzpbIt4AVM79dQuoq+Paykm:u3j13wQOtj2jbf+Syk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684666803, "uuid": "742beee6-28f5-4ecf-abad-091f569d0138", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684666803, "uuid": "f1aa98d4-26d1-4ef8-adf5-a455793aea7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666803, "uuid": "05bddc79-9ad0-4b3d-8f9a-585d028f6626", "value": "report329.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70a0272a-f7f4-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684686475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686475, "uuid": "7bd55459-916d-4b2a-bbc7-c99876862e85", "comment": "Malware payload", "value": "57f08f8cf23062430facd2a59cccd041", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686475, "uuid": "63effed2-0655-473e-804a-2cbdbf49f856", "comment": "Malware payload", "value": "7dd1365747629e0d0f2262281ab9bf278850807559478e5017629d9b725308a2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686475, "uuid": "0b1e4010-9cc5-4add-9c90-0a794ea02e1e", "comment": "Malware payload", "value": "6d6baf32f65312e51645b90e967ac334adbda2ea", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686475, "uuid": "235cbe5d-f5c2-4d55-ba10-a1a18554220b", "comment": "Malware payload", "value": "0ad4325fd73a3fe1fced73e98f86720a76b643b5a37c40d6d083796dd9583ad568559fef27ca35df0d114ba14ae2651a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684686475, "uuid": "481c2d38-9eb6-4794-b4c3-315a8f77dbc6", "value": "T119532C9AF801CD7DF45BD77B4457090AB630B7D142821F3623ABBAA7BC721991D23E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684686475, "uuid": "456c9082-6b58-47a1-a45a-37548faa5154", "value": "1536:ZtAdHd/h6cvEfWeUeS88MmhzZkAEkobd1Xj0hKxaoiGYBm:ZtAd9/hFv6WVexoTEnbzkJGYBm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684686475, "uuid": "ed2ae087-762d-41e0-a453-a8f37081082a", "value": 62352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684686475, "uuid": "a7d327ef-30ac-4f65-8001-310480f1d4c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684686475, "uuid": "c845d1c7-c28d-4411-a943-9ff83f993f02", "value": "57f08f8cf23062430facd2a59cccd041", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "870f2020-f7c8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1684667614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667614, "uuid": "89371194-b9a9-4ef8-96bf-1678148de9d4", "comment": "Malware payload (Stop)", "value": "2ded6051719709ea7972e7f345f124a7", "object_relation": "md5", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667614, "uuid": "265d57ab-8529-411a-a24b-051e475bcd5b", "comment": "Malware payload (Stop)", "value": "7ded057e9fafed966c7f33ebe0e99a2e59bd39449252f6f98e5ede1ea4f1b0ff", "object_relation": "sha256", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667614, "uuid": "622d081a-c146-421e-aa61-04b17b05a9da", "comment": "Malware payload (Stop)", "value": "9f6a979104ddbafe27a3e7c9da506967c1ce00ae", "object_relation": "sha1", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667614, "uuid": "5cbfd810-f916-45ff-bac9-16de3f66fd13", "comment": "Malware payload (Stop)", "value": "e1238782b9d6ba9444eaade9a497e01a99698d49085543a7cf00958e39be29837936a0eccca56ad4908644b8b6a23d8d", "object_relation": "sha3-384", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667614, "uuid": "44709839-6eb8-43f8-8cc8-e1d9d65cff3d", "value": "T1A4050222A6C4B871E5258675CD29C2F8352FF861BF196BC723583F7B19301E2DA7A341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667614, "uuid": "cc860e1f-c85b-4a71-99d3-b060144d2a2e", "value": "bb27c4958c76443fcfe46f9765d838a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667614, "uuid": "99633666-1522-4a38-9bb3-bcf4668c5cee", "value": "24576:kfc+erXmkBvzIa6pJJTJ/clZOJMZWjuHRCUH:kf9rkBn6xV/c2JMZXxC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667614, "uuid": "46eb54ca-1ac7-435e-af1d-fb7e19d81a59", "value": 806400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667614, "uuid": "2986f2ae-4451-48a8-ab0e-65bc84c26c62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667614, "uuid": "a7d75bfb-0652-4eaa-8dc3-99608cfa8150", "value": "handler249.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "770c9aa5-f7e5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684680043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680043, "uuid": "7f5083fe-1846-42b1-844c-0ed8b2072d4f", "comment": "Malware payload (RedLineStealer)", "value": "629b132a399e80f55ec150da08d32b74", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680043, "uuid": "bc4d2120-9ada-4721-9078-66f1b831793f", "comment": "Malware payload (RedLineStealer)", "value": "7ed25343cfef3a48f84727af0c4529518f83d101513d72da4b663cbd8de977b8", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680043, "uuid": "19a269c0-b739-4824-817e-abd4ab924da7", "comment": "Malware payload (RedLineStealer)", "value": "9728a97790ca8c12a17b6e58c891f7bca0ddbd9e", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680043, "uuid": "63df2a69-3dbd-43a2-9ca3-23a762838cf4", "comment": "Malware payload (RedLineStealer)", "value": "8681c66cb28bf637ae8b34741487137e7047c91e34f8bd8b60e489146de72b163f8763f564b2cca100ab2ceb00a28758", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680043, "uuid": "1f5a9b53-cc3f-488a-825c-4e00507020ff", "value": "T1EE252307B6D98077CC7673B818F60183173ABDA00A38875723D8295B8DB3AD5AA71777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680043, "uuid": "cc0efefc-1f5f-459c-9113-fc559e3a1df1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680043, "uuid": "aff38cc5-35c2-4f04-9ffe-d16806a08bf3", "value": "24576:cyIHWLmiMKqwGjMGuZe6ejZ5Mh4AVrnvetqNlPNOzEhnGyE:LlmPKq7jMG6ejbgrnvIwOz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680043, "uuid": "cad19c05-f677-4592-a5d6-91c3bda2824c", "value": 1054208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680043, "uuid": "ed96bf10-c7c0-4c7f-927c-c2d11d120e7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680043, "uuid": "146aac6b-0e1d-4b22-830e-a8bf4ff90cfe", "value": "editor200.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0caa604-f7c8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1684667792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667792, "uuid": "462bfde2-8daf-49e3-a4e0-4d67afd93143", "comment": "Malware payload (Stop)", "value": "bda73088c1234fb7d8efb9be553b1895", "object_relation": "md5", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667792, "uuid": "06c7a40d-7636-49c6-9e1f-ae4d34509f2e", "comment": "Malware payload (Stop)", "value": "7eefc0d7e66d4b96163e215c40b65c480b8f992241afdab7f70a9be6c84c3068", "object_relation": "sha256", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667792, "uuid": "bbcfde7e-77b9-4675-aba8-fa34d109e20e", "comment": "Malware payload (Stop)", "value": "33a8aa9f53008deddf308733085173595ebbba4e", "object_relation": "sha1", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667792, "uuid": "72387f05-f6ad-45da-a26d-24c2c965556e", "comment": "Malware payload (Stop)", "value": "b71f558037f479d52a19a61357617fef75349de235052bbcd302646574d73ba1fa12ca5c9d9173e1dba3fe9fa9d1a76a", "object_relation": "sha3-384", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667792, "uuid": "156b33ff-2c82-4aae-b1bb-619177c273ea", "value": "T1C105E143A2A3BC6AE9254A729E3EC6F8361DF5504F192BDB22146F3B14721F2D5B7301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667792, "uuid": "3a885d12-dc96-428b-8dcc-d630340992f8", "value": "885df6b18e739ee3563619e20c0ba91a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667792, "uuid": "762f61c2-123c-46e6-8364-5372b742fd59", "value": "24576:8riSZi1RtMLQtIxOOW08GRMbsAOcrdU8c:890/MEtIvW0LRlce", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667792, "uuid": "9459fb99-7ec4-4c8f-81bd-f38e82599187", "value": 845824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667792, "uuid": "ad9a3493-387e-44c3-a52f-bbe77ab0a2a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667792, "uuid": "939ddd88-b37c-4c7a-bf96-12dc0d7f55e6", "value": "game725.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fda817e3-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684680698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680698, "uuid": "bed61cc3-77c8-4ea3-9f16-51fd094aa31a", "comment": "Malware payload (Amadey)", "value": "da8a8e6b23f2bcecb30f16c58928beb5", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680698, "uuid": "872d8e13-18b7-4224-a3a8-014ec1018389", "comment": "Malware payload (Amadey)", "value": "7f229b1233b01d70eb1b8e1be33bc555c8fb8daec1d284f4e4f7a46e7894aa01", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680698, "uuid": "8434c448-cfc2-4595-903e-ce94bc2b24ae", "comment": "Malware payload (Amadey)", "value": "823912cf0f35645b0171564ff50d562b1ea0642e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680698, "uuid": "029a2ae1-15bb-4249-9699-23aacda0b457", "comment": "Malware payload (Amadey)", "value": "c2c7c91cd17ccb9f85b5f9d67302b71da9b4a0b3b954a6bab64031ea72370a5f20952734aa6b434e33bdc97734f8ed8f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680698, "uuid": "ad2c6633-df42-4850-9126-5140f28127c6", "value": "T14D252202E9DD8171DDF1577018F607870A7BFEB15A38871B2742B91A4CB3684E972B3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680698, "uuid": "382e342b-312f-4120-8359-350f1314855d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680698, "uuid": "cf437463-5995-4288-a60d-f65b5de19652", "value": "24576:gyFT7GFVxobJ3qqFDHI1ZPchtrOfQY6ojG:ntGNobJ3q8DHY+DrOfJj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680698, "uuid": "f98ad72d-c9d2-4d71-8474-fe940b9afce0", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680698, "uuid": "e2efa6f6-79fb-4ea3-b842-865cb73bfc07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680698, "uuid": "a255a89c-d976-4517-95a7-344ffaa84b10", "value": "writer149.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de2eef10-f7d0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684671197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671197, "uuid": "bccd58da-41ae-44e6-967d-f501db53ccb5", "comment": "Malware payload (RedLineStealer)", "value": "7c725353362277e6c7895951d9f87719", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671197, "uuid": "2774d6d1-7dc6-4ffa-9a47-21299ecd8938", "comment": "Malware payload (RedLineStealer)", "value": "7f289d8a4652c574af35fba15295ffad1c37878d389ba0be4fce6a06411b7bac", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671197, "uuid": "047c1104-02f9-4b3c-95b5-91b25647044d", "comment": "Malware payload (RedLineStealer)", "value": "cec9bb7d0f33c33605a564fa4b38fc9b983650c2", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671197, "uuid": "9d92f17f-6495-4a67-873c-d2bc2ddca99b", "comment": "Malware payload (RedLineStealer)", "value": "12a56507939e6e4b7e48934f53b4b670c900b5ab8ad98df21e4c30645afe00e7c8865d0ba9f09195339f36a4a73cf959", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671197, "uuid": "bf01e5eb-cb9a-482b-8ece-7391b326b26b", "value": "T13F252363BAD88473EC72273095F903D30B37BEE159318AA3234B6D5A19723D495347AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671197, "uuid": "cda5c8f3-33db-46d8-91fc-abcac97a77cb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671197, "uuid": "727d3907-5499-40fb-9152-46f712b8af73", "value": "24576:hy5q75/gfWjqHKxla8DSMeTB4YgS0qNkI5:UI+Ojq+U8DNeTyYj0qNk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684671197, "uuid": "df75be3a-ef7f-4808-a9a9-3229dd5dd5c7", "value": 1056256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684671197, "uuid": "451fb065-0ef0-4bbf-9520-62755dcabc6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671197, "uuid": "c0da97d4-0a72-49cf-bf06-28c6673a3984", "value": "2454273.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64a97644-f7f4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684686455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686455, "uuid": "aba23bf5-167e-4ecd-a22e-efbe54fd0f8a", "comment": "Malware payload (Mirai)", "value": "d9e03bb263536ac3f9319d2638992e34", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686455, "uuid": "8cf37223-ea36-433d-b5ea-48d9ee963214", "comment": "Malware payload (Mirai)", "value": "7f97590ed2480367068fa2326fac5adc75966544b0de4133ff5b77038484a486", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686455, "uuid": "edd173b8-211e-4237-9690-b230b350efd6", "comment": "Malware payload (Mirai)", "value": "a0845417ebaf513421bfcd56e8a323327d970e6a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686455, "uuid": "ddca6c0d-74b5-4d83-803b-94034927b061", "comment": "Malware payload (Mirai)", "value": "881a37b76311dac8c73d8ca1d7a15f4bf58ced324b2e084508ffa987476789bd42f7ad29d7cfde10a01fc35336668bc5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684686455, "uuid": "e563d1de-3348-4f19-b660-31dad157a688", "value": "T1AAF2F851B8814A27C6E023BAB6AE5A8D377073ECD2CFB617D8615B20B78151F0D63F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684686455, "uuid": "079a3ef8-c467-4963-9bef-5e5b4a37d584", "value": "768:zdWm4W5bQYG5zMHNSoSU1tTbHOdw7xh9aa0P5TOO4o+Vwx:zd/bjG5zAPSUL3HR8oOPx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684686455, "uuid": "0924542d-4bbf-4c1c-8b7a-60dfc4da3111", "value": 35124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684686455, "uuid": "e7bf118d-3305-491f-b201-0dd0ec44bd29", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684686455, "uuid": "b165ded4-2c02-4438-a84f-1ea34c4439e9", "value": "d9e03bb263536ac3f9319d2638992e34", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee2dca60-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684680672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680672, "uuid": "694ecb08-8eab-4505-909c-3bc9dda24014", "comment": "Malware payload (RedLineStealer)", "value": "88c56d08ccb50c8e7dcac4ac241aa31d", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680672, "uuid": "646e5315-7ec1-4ed5-9e09-6afb5bd3cbdd", "comment": "Malware payload (RedLineStealer)", "value": "7fa136f8ef8025f9ac93c35737987b7b092e016221a3e0eda188fa0201cea9f0", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680672, "uuid": "1b7565d8-0fb6-478d-ad0f-61e1640ac354", "comment": "Malware payload (RedLineStealer)", "value": "b7f81b36b62c6ecd50ac71e7adf8a3e56ebb754a", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680672, "uuid": "1f226faf-8866-4925-a152-c8a0720ff4ca", "comment": "Malware payload (RedLineStealer)", "value": "0babb978432d85de3371d46542a54d9e97f92d1f597b41694621d7d99fa5176f8e681266036f89628f84c855e62f2447", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680672, "uuid": "85daaec3-3f00-40c7-877f-7d3d73f8845c", "value": "T11F252352B7D84072DC32673058F7175B1A327C99AE38A32F33956D8A09F2294B1737A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680672, "uuid": "d569fe00-d928-4fbd-bd72-39a0ce480c8b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680672, "uuid": "cb2916bd-9e27-4880-a793-d4fc368a4853", "value": "24576:xye+wy7eg68jHtpAm9zEv3/tL7C1xTI7uZ/3evU4lI:keZy7e+NpnBMtL+TISh3evU4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680672, "uuid": "6548b7e5-eb17-46ec-83b8-9680237658da", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680672, "uuid": "d06e8cad-ec40-40ef-b252-d9aa367f6616", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680672, "uuid": "9141de61-ed74-4c17-a73e-489117b01398", "value": "start787.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a738a8ef-f807-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684694727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694727, "uuid": "d7a442d3-7fac-4827-b677-79215118b603", "comment": "Malware payload", "value": "e334697099df84b01b336d6d5de9e1a4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694727, "uuid": "948b780f-3ef8-41e4-91c8-2b5d106960fd", "comment": "Malware payload", "value": "7fb3a6209fb77b7d56595929c842e9822642931289bea05b4107e9ad0cae40ad", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694727, "uuid": "76ec8665-f1a6-42ce-acc6-5e3e3eaffbd5", "comment": "Malware payload", "value": "707b151ea68a80353c8805b21e0da10d58bd3611", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694727, "uuid": "4181e2d5-57b4-43d7-946a-c684c72fd0da", "comment": "Malware payload", "value": "739dc8cc98b43973982b51d88aa46f39db4412290f5860591eb3bbc6cbc2840466dbe26cdeb330a5521b710b04bbd032", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694727, "uuid": "cc323736-21e2-4786-bea3-fc469363f54a", "value": "T1D3252353FAEE8473E834433150F603831B35FD6498B9939A379AEA3A08A1640E57177F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694727, "uuid": "a7591cb2-715e-439b-9344-3e7f5ca6a51f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694727, "uuid": "e3ac21ba-f3ab-48bb-b28d-4ffb5036ba90", "value": "24576:PyIcAXPf56nV8qSl6MVb6vSZCVDB1MWL5ejRlhS8X:aGX562q5KMVvejRlhP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684694727, "uuid": "5fc883a7-6795-48ea-8530-5bc821ffb6d9", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684694727, "uuid": "1a2c1cd0-b830-42df-8158-70af20a82520", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694727, "uuid": "65dadadf-a31a-406e-bb2f-dfd727c8b69f", "value": "999642.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "972ca68e-f7b1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684657763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684657763, "uuid": "f5976a61-9337-4f97-9761-4987a0982967", "comment": "Malware payload (Amadey)", "value": "4902b0faa69aa3c847c886d202b4f14e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684657763, "uuid": "9a26cc3c-ef9d-4ac5-a630-0a2246b901c9", "comment": "Malware payload (Amadey)", "value": "7fe7f26bd7bf0c81495941020852c66477de3bdea3d1a0f867c71c90b1fe411d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684657763, "uuid": "b733488b-e6d8-4496-a5f5-950be193dc13", "comment": "Malware payload (Amadey)", "value": "6e782284e2f96e1151b838c1316802edcfeeee46", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684657763, "uuid": "4255e20a-95cf-4607-8bdb-257143692b68", "comment": "Malware payload (Amadey)", "value": "c4cb98aba03a86e015a9c4677e78d3c5bb3973c20a9697f91bcf76643e1cd9a3cf5922bf71c73fe28883a22e18031034", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684657763, "uuid": "f87a774a-bf82-4f06-81c3-f8a3840f0792", "value": "T11125235255EA5572FC7A2B70A4F65AD70B39FC610C79A77F3302B82E0C7298198317A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684657763, "uuid": "c0d6d4a6-d687-4f21-839b-ac2aff4fe000", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684657763, "uuid": "c1f9d38f-9163-4c8f-8dc3-95f589617697", "value": "24576:vyoSW33s7/qJW7QP8jKw2SB7wtGji2Gcpb6thln8g8SfDsm:6oq7/q1P8B2SO/lGbglngSfY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684657763, "uuid": "e9d605c2-5b38-4b88-8f4c-0ea263491b17", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684657763, "uuid": "0fa5c3fc-f4f6-4169-b191-a84924343852", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684657763, "uuid": "b75d8db9-7edd-478c-98f6-e39d014ec682", "value": "4743.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "213e1c6d-f774-11ed-b3cf-42010a9c0076", "comment": "Malware payload (LummaStealer)", "timestamp": 1684631366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684631366, "uuid": "2707dfc7-9703-427b-85cf-0feb4686c3d2", "comment": "Malware payload (LummaStealer)", "value": "bdbc48b665a422c5845109cc594536a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684631366, "uuid": "1905fafc-6db1-4627-8127-436cefe90b78", "comment": "Malware payload (LummaStealer)", "value": "8059343dd1bd2043009e81a54115ea921ebe7467c35ac05c43e6acd013eec085", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684631366, "uuid": "6a3ba949-d204-43ef-9517-fdad5b537058", "comment": "Malware payload (LummaStealer)", "value": "a3e7b4c35d31f0479af9be082b85910cf1e68fa6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684631366, "uuid": "6e56390e-3532-4b46-949c-f520ec0b29c9", "comment": "Malware payload (LummaStealer)", "value": "3fb66b2d0945117f28b1f105197cfce5a99bde3293d71a9e73664fa26e64a9d1c5052ce98555246c3042551034f9c310", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684631366, "uuid": "63e1dbb8-d916-4b76-a3cd-5767d50a63a9", "value": "T10CB512017F105692F9DE1B7684DF0A2DC3D49C7612F2E727EE6C31694E46A07F80A9E8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684631366, "uuid": "923e8cb9-6c98-427e-b656-5738f2e0d751", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684631366, "uuid": "57ca5a45-13e9-4b78-899b-770717eda422", "value": "49152:d53xYNqUy45WgWBJNf8UVYfVRgQyPbuQ7ROwYkP8iEhy5PntI/:d1uNjWfTNfNEa5TzRH8kxnt0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684631366, "uuid": "14469525-2b4b-4875-9c24-47ab11610435", "value": 2415328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684631366, "uuid": "108b258c-4de1-47bb-b22c-6132ca9152bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684631366, "uuid": "06cf9fe5-673a-4d4b-b5f1-4544a27c2d87", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb8d0e5d-f7c7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684667380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667380, "uuid": "803dbfab-b00b-4d17-a940-4a73077fa10b", "comment": "Malware payload (RedLineStealer)", "value": "f9b8c2ccd91ed1de22ff2ecbbc83f4d5", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667380, "uuid": "d5822124-e9c6-468e-9030-be6e66473438", "comment": "Malware payload (RedLineStealer)", "value": "81223cb2bc8a17ca20bcee105152103a21e9bc74e30d28c5a932c2125eca29b6", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667380, "uuid": "68db2045-172a-4cf1-adc4-2a25b7b45cb7", "comment": "Malware payload (RedLineStealer)", "value": "06a7f044e3e8ede4c4e30d11bff5fe227558d4cb", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667380, "uuid": "f22714ae-6728-447d-bdc3-ba54a2698d97", "comment": "Malware payload (RedLineStealer)", "value": "bb7c4c91406bc93229e337197a3fdd2a7737ca270b68adb39835533f4640cee1ef040df0ed3b647663377046f885642e", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667380, "uuid": "3d01a011-1bd4-4a12-a537-264dc71927b2", "value": "T109252313A7D4C176D5B99BB4A9F201832B32FCA0AD2C8B653312AA5E5D72CC17931737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667380, "uuid": "95efbdd1-d766-468e-8697-17d60ab3020e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667380, "uuid": "8b94e974-929f-4235-9cd1-2ce159e3af4b", "value": "24576:hySjrLsMz4aqwo4MtzzPnYpOtz+DkHeQVWyYm/Ww9aj:UArh0aqN6OcXQkye1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667380, "uuid": "7117fb7e-1dea-4175-a4f6-d8269c2d638d", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667380, "uuid": "bbb493e1-0d64-4191-8cf5-3afdb4dcb506", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667380, "uuid": "d9535741-7726-4f5c-81fe-51b7a935eb49", "value": "plugin983.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11a245ff-f809-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684695335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695335, "uuid": "34779107-343c-415c-94d3-edd1c70d9df7", "comment": "Malware payload (RedLineStealer)", "value": "0e0c5fc78377ce026b4b90aaf53a6cac", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695335, "uuid": "1ca47dc0-0db9-4783-a75c-48ba1e7b8709", "comment": "Malware payload (RedLineStealer)", "value": "812780035df9e2d2163b80ebb1de76f68641f26c8f6ca3b0231d94c7e9168861", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695335, "uuid": "eb8dd813-991c-42e4-8615-ab7767e24701", "comment": "Malware payload (RedLineStealer)", "value": "ea4693b9dbc450a51a8cfbcd38c6e04717e28291", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695335, "uuid": "cdba609c-d45f-441e-ae01-f2e25870e256", "comment": "Malware payload (RedLineStealer)", "value": "aca9a3c655c549114312119a18517f8b49ff19ab03d727ef7af8eacd514463fe95b7c095f410bf80373af7fad5144468", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695335, "uuid": "bf0c351a-bd32-4704-b46b-f143914eccf0", "value": "T1BF252327AEE44432CCB52B701DF207B32A35BDA16D38832B77416A1A1D736D89D36727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695335, "uuid": "1536a8b8-602b-46a8-9f33-533d8aef6468", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695335, "uuid": "e7189616-471d-413b-8aed-dff23672ef2d", "value": "24576:yyelXK5Jf+nT3boqwrXL4ux5c1eaX6+k7eUkobe9b:ZeNK7GT8qob4gc19k6U+9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684695335, "uuid": "eff13e03-8e79-48fe-ad51-ec1c0fc7aa04", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684695335, "uuid": "6cb6f10b-150e-40b0-a2d5-00d1ae7c29d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695335, "uuid": "d23cd94a-58a0-44cb-9c49-7b5cac64c70f", "value": "payment545.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a3b3013-f7b2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684657983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684657983, "uuid": "adb38be8-5f07-4825-8e32-a4fee55e7b5d", "comment": "Malware payload (RedLineStealer)", "value": "9035d57d3439d8ac714da3073c090d4a", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684657983, "uuid": "b84f3db9-5577-44aa-93b8-278a140cccfa", "comment": "Malware payload (RedLineStealer)", "value": "8171293900029ceb2f6d0524630fd1ba93b50f8712ac1ade7e63c9598420422d", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684657983, "uuid": "29af4314-8cb5-4045-80d6-ae9eef330f60", "comment": "Malware payload (RedLineStealer)", "value": "f7e83a5636d2b6de1ec49fba290d16a7f75968cf", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684657983, "uuid": "d3c8c9cb-2df1-4534-af4b-8f58533637da", "comment": "Malware payload (RedLineStealer)", "value": "b484e063c963ca07bfe3493b48bc3d31d7a429f49e22a6b6e4bd24e60a88a3d320fa163ddc14892bc4cec55445b1ec8d", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684657983, "uuid": "7d335e10-4989-4148-a223-7d28805ac034", "value": "T11C252303AEE95037DAB4677591F203E72F34BD904D38A7BA27497E840CB22D49972367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684657983, "uuid": "845dbd2d-5541-4ac9-83f1-29c4e60a36a7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684657983, "uuid": "bee82d05-4470-42d1-8cf0-8a3dc82b3e4e", "value": "12288:7Mrvy90CMl9BPKhjnJJAD52GQ4BRqa/DthkDPsKa/75GPE0dYIhY3dBl1aWnM:QyXgBQbc5/bqCkDYdGPPY3Pl1auM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684657983, "uuid": "1d9aacf9-fccb-45bf-bf5c-452b95e4cea2", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684657983, "uuid": "3e2b86c3-17ea-48a7-9c20-6469735b3297", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684657983, "uuid": "2e4f5472-485e-4b5b-a967-7d456b68cca2", "value": "networking.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcac9d49-f7d0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684671248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671248, "uuid": "8b56e94b-e3bc-494e-8bc1-76e76616eca4", "comment": "Malware payload (RedLineStealer)", "value": "a5edc6d818daa022c671d025652f0f70", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671248, "uuid": "675ba6ee-9827-49fe-a3e0-7f0d2fe2808b", "comment": "Malware payload (RedLineStealer)", "value": "81a0641542c56bc4611d8ab7b5a939bd151a780d99eecb7836d9a94e0d2142a3", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671248, "uuid": "a495167b-e78c-4239-92cf-a4386b972cbb", "comment": "Malware payload (RedLineStealer)", "value": "6bd984040615539077a38a0b7b9bf2d2ad1e16e7", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671248, "uuid": "cd191158-cbee-48a6-bad7-8f358dbbf4e7", "comment": "Malware payload (RedLineStealer)", "value": "311eba139df0b23a3970652c387776cc825c92141118781c69ab2d24bc0640bb30155715bed059d4eb6a5b0b7869d959", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671248, "uuid": "5ee6e752-805a-40b6-8113-9fc0f0f870ea", "value": "T1DC252342ABC51971ECB1277060FA12C30A36BDA0DD38C22A3B55EE9E5C735D4687277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671248, "uuid": "63cc3ab1-4ff6-46ab-851b-9181884753e9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671248, "uuid": "fea8d61c-9fa1-49a4-94b4-449c4ee9a670", "value": "24576:Rymk332gRpUovlfvqG/x29i7+Q4XNUZe/fgmmLshzdHdodVV3a:E1GgPUo9fvqG/IQ4XNUZ2wQ3dAV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684671248, "uuid": "d2ce1713-fc5b-41fb-8bc5-08432dc65bd9", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684671248, "uuid": "17ceb878-7d3e-47aa-b0ec-575da8944a23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671248, "uuid": "6f5a9659-3f63-4a8b-aaec-4079e8632a0d", "value": "physics334.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a803a14-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684680478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680478, "uuid": "4984cde2-b990-4afa-a628-2e3a7521d92c", "comment": "Malware payload (RedLineStealer)", "value": "bd4268b46870b06dd1056b19ab128991", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680478, "uuid": "3ef4d479-4cf8-496b-8eb1-8bb54d59a4cf", "comment": "Malware payload (RedLineStealer)", "value": "81b1388e588c5f5b95eca062859651cba52230f2a18a1c2062e8ececf6572893", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680478, "uuid": "309eee35-3dfe-445f-a0f0-11cf98e15c34", "comment": "Malware payload (RedLineStealer)", "value": "0f4de9bc7a411edb0b43aca0707a1492e4ab5aa1", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680478, "uuid": "884a21c2-495f-4940-b436-b63eb5db4932", "comment": "Malware payload (RedLineStealer)", "value": "e5d62ac335256e72fedf90c3f43a4d687f3f7e48a3f78212b1eec86b0a8e320b076b4395cd316ac3c618b0ab299db6bf", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680478, "uuid": "877d4b13-55cf-4fbd-8e18-e32f7b1a5d70", "value": "T15E252302F7E84253EEF11774C8F90A8313317EE0D668E2A23645EA165C73AD1D9B572B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680478, "uuid": "07447c36-18b1-444d-b5c3-ac98a21c428c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680478, "uuid": "2daeff55-0e4a-4c88-92d2-b8fa105544ca", "value": "24576:XyzNs44CthvVKqiY1nZsbJW0AIHapkxSPUu9C3Sc0H4ayvumS0TCh:izNLh9KqiYLsbJlAIVru2za8umSmC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680478, "uuid": "ac82184e-fb5b-4a8d-a890-aa712f4f20df", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680478, "uuid": "64109375-36b5-459d-85f1-893ae7798d16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680478, "uuid": "6abd3950-855d-44a5-83cc-74e2ec4a8d29", "value": "99242557.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9aca12e9-f776-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684632429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684632429, "uuid": "90559b1d-6d37-4602-be57-c5657a3912c3", "comment": "Malware payload", "value": "9495252841fae875d3e0690e8fa77574", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684632429, "uuid": "1c53b50e-992f-49db-b5a2-31dc12fcf2a7", "comment": "Malware payload", "value": "8207d8c2ba77c53cfb7035c0d3a85b196af5255788bc1d0fc08beb7312f3cff7", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684632429, "uuid": "1f5c5191-2455-4225-9406-b7898d9a3282", "comment": "Malware payload", "value": "8178021cdcaed0cb0abfe2da915e455150b0e2a1", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684632429, "uuid": "a02311e0-a8c4-4a82-91d0-6a2ff119d9a5", "comment": "Malware payload", "value": "5bfc3d7f3cf2452b8efe601cf71b9b77d5e28708ccc432c91bc8885aebee0a79258f9ed42be74365a89eee7292a5ce9a", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684632429, "uuid": "91eec55a-cd15-4532-aa5d-1ee5ae5231c4", "value": "T170865B2BA596A6A2E0D123334BD9A3C19194E23B3F600CEF4CD4AC1A596DD73536C7F4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684632429, "uuid": "49645c27-fa1d-44ad-8894-45dcb8b769eb", "value": "c983ca29445c3b0f29b987d079b73fc4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684632429, "uuid": "dd58535a-60d7-4853-9377-e05c174a0892", "value": "98304:JcaAM0Tk0lvyOR4NW38tqyrwoxqP3OcPGyDcUJIPl1dh4V:JbwkxG4WcwHmSGUHIPvdY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684632429, "uuid": "32ea06ad-57c7-4d78-ab03-4a5aa6b68019", "value": 8036352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684632429, "uuid": "00dd4989-c54e-4d5d-baba-e994486db9ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684632429, "uuid": "8728bfbe-4041-4403-9ff2-4f23ec76cc09", "value": "9495252841fae875d3e0690e8fa77574", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8948d37-f808-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684695266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695266, "uuid": "c9488728-505f-4c37-9ae5-b662350b6ba4", "comment": "Malware payload (RedLineStealer)", "value": "143740c156b657b1d2e87955931c81da", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695266, "uuid": "507881ab-0fa9-42c2-b953-1b12d8351d2b", "comment": "Malware payload (RedLineStealer)", "value": "824bb1be7ad9884c7f25f981ce353b8db6824993581319b532a98244547a393f", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695266, "uuid": "4e0d8245-7649-4b1e-b8cf-bc6cfa4fb4de", "comment": "Malware payload (RedLineStealer)", "value": "a259e1a47c71f41f5001668c842c0e8b00e36838", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695266, "uuid": "411d0825-8807-4d93-8bf5-ce4c223cb190", "comment": "Malware payload (RedLineStealer)", "value": "4cc0c5ab9fe666542983064af0c4b56bc4e64b09185dd1f9806151353e99e132795db31957d7422548adeffd9cfee141", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695266, "uuid": "dc6041b8-ee8d-4887-bdbd-a77e288429bb", "value": "T10BE3D624279F8930D6BB4E3D6CB19CC076BCEC12A542D74A4ECCF5593A73B809B116B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695266, "uuid": "106bcada-1c4e-4eca-b3dd-e83eb7d46968", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695266, "uuid": "5b43063a-595a-49dd-a884-094fc1fa8b1f", "value": "3072:2V+m5cNQmRSxWWAcP+DDXedh7Z58e8hk:2jwCUudh7z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684695266, "uuid": "a8beb017-b47f-4fc1-a8d3-f0119c80a463", "value": 148818, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684695266, "uuid": "9ee9d1aa-14b7-4953-a8fb-d3c769f7d0a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695266, "uuid": "b99fd3a4-f565-4341-b2ac-62088ee9a6fd", "value": "audio412.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c10d05eb-f778-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684633352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684633352, "uuid": "43428211-c016-424f-b7fc-e15b3763910c", "comment": "Malware payload (RedLineStealer)", "value": "34c735aac13c12757a8e954f87f6852c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684633352, "uuid": "91fd7b24-8899-4261-846e-c2333f1d884d", "comment": "Malware payload (RedLineStealer)", "value": "82b28da9dd8874b827052827a6a1214ec59689001373a71c9f7dfb8b3f56c3df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684633352, "uuid": "dae616a6-be39-4c61-a09e-2e6ab6eeb398", "comment": "Malware payload (RedLineStealer)", "value": "5d0c1b22263578abf5a9cf9f2b8327dd91dc3935", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684633352, "uuid": "909b6837-8b09-44bc-b2d1-42606a4c6479", "comment": "Malware payload (RedLineStealer)", "value": "e914d348307c01c205340230b26e8b37c97d81904fe121916c11a7f2f8d0468eb409d388080181c9a36760d32a10940b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684633352, "uuid": "dd7a2e68-9b9e-495d-9362-8dfb85e2ce33", "value": "T152648D23115C543AF427F532DCE28B72D27C7AB7134FA6E76384311A4B1A1E66AB910E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684633352, "uuid": "4eaa98e8-af7b-4d37-99f1-68efa3d933c2", "value": "aa13816afc0cf283e1c2ef6f42b98abe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684633352, "uuid": "3836cf72-b515-4882-81eb-8a1758cc7757", "value": "6144:ZPKnmlp1JPMWi7Q0VMxWwkTUI1LfXk0mTv:ZjlpHMWKQ0VgWwkTFXkd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684633352, "uuid": "03730262-e79f-426b-93e7-2b732e79e2b1", "value": 326424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684633352, "uuid": "c233920c-cd00-4176-b03d-b240c05db3f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684633352, "uuid": "640dafb9-7abf-447a-b17c-5607c5824346", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0a0cab8-f808-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684695199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695199, "uuid": "42903e13-db38-4922-b818-2d4afbd69cfd", "comment": "Malware payload (Amadey)", "value": "fee8dda92140ae14ad16abf57c0b36b6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695199, "uuid": "ceb67e5b-b498-4b2a-878a-28fa63dfdd7f", "comment": "Malware payload (Amadey)", "value": "83066dd9923343dfbce3af14e45c5918f9f569b4ba9e821c6e93ef50c39dbd5f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695199, "uuid": "c74ba741-1b36-4041-9f3d-278a01bfba59", "comment": "Malware payload (Amadey)", "value": "85c18958da3c0ee90b0dff5d0124fb3abe9dc719", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695199, "uuid": "755c8e7c-e3eb-4d19-bf60-86e7eb074df3", "comment": "Malware payload (Amadey)", "value": "becc33ded0f3157a9e67cccbb19c1f2e27e5a47d20bf91e13a69a69e2c842c86a6250fbbce599edf32ad7ee5565f1fab", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695199, "uuid": "7d970587-a6b3-4843-a4ef-040cfb28aa10", "value": "T124252353BBE48072E9A35B3458F686CB0737BDB199B8535F3641A97A4873E40AD30723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695199, "uuid": "9300a174-a537-4fe6-a3a2-7a4925780c36", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695199, "uuid": "00c5d4ef-e4b4-4c0e-8403-b7bd03390d4c", "value": "24576:NyTNDKPWIrNZHHDoqZz3NnB35YxkCzV9Qgr2gKFBo+L6I:oTNudHHDoqZpR5MNeVY+L6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684695199, "uuid": "6938e931-6abe-4e38-a9ad-b068d00c2e45", "value": 1046528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684695199, "uuid": "17560313-5762-4bf9-8305-7c87f06479c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695199, "uuid": "6974b8a7-87cf-45fa-b345-9441a31da808", "value": "234433512461.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecb767d5-f7d0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684671221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671221, "uuid": "e7998a14-8719-471e-8527-fb8646221dc9", "comment": "Malware payload (RedLineStealer)", "value": "0338d4fdf9ff4ca03f06e0d72e638713", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671221, "uuid": "1dc36852-ef49-4f81-ada9-b8d9d5ccb2d5", "comment": "Malware payload (RedLineStealer)", "value": "83124c348c7cf6c812dfdba408729b06e42e08707a2635ea8df23aff6c1dc13c", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671221, "uuid": "81ce3b3a-bff7-4fa3-b68c-ee2102e30d02", "comment": "Malware payload (RedLineStealer)", "value": "9299605067988c65c8a1a8d20457f4de2715a022", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671221, "uuid": "3478f2f1-4ebb-42c6-864a-93718ad58def", "comment": "Malware payload (RedLineStealer)", "value": "146fb75bdac7fcf1c7fd57565ec5a6d1211814b2b118ab400de9b7f7c50acdb122867bb3fbc3b698d276f62ba81c2ea1", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671221, "uuid": "dbdeb14b-ab82-413d-ac64-100cdb8470cc", "value": "T1842522539AEC4933D8767F3118F153935B32BCE1D934D36B239598866DB268068333BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671221, "uuid": "356c3652-c440-46a1-8be2-a8e320d88708", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671221, "uuid": "80c342e6-69b8-4e6f-87f4-613ed74a1991", "value": "24576:ry4+XXL03zSjnAqgSczVK0UUtKDaxUDXpXaoMzm:e4+XyzeAqgbVK0UUoDa2D3Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684671221, "uuid": "f35e1599-5535-49b9-b319-ec27863f51ef", "value": 1046016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684671221, "uuid": "3e5e094b-7eb5-45ad-b231-8f9890c202bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671221, "uuid": "aa3391ba-aeda-4c40-a647-b2d79f20b7d0", "value": "bils306.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58a22574-f823-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684706621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684706621, "uuid": "0bf53037-b5d1-4172-9f74-07540bcbbd87", "comment": "Malware payload", "value": "2428076df073251e59bcfd3ba2ca7641", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684706621, "uuid": "e5977874-82ac-4c35-975b-86aeef385b1e", "comment": "Malware payload", "value": "83132fcd8d057516919807e287516d7a17f2d86d1b4791172167a3da9d496e44", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684706621, "uuid": "c4262139-43c4-4a28-be48-761c2971ec64", "comment": "Malware payload", "value": "23c200bae6a471ef8edb2b7af31b34617aad3ba9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684706621, "uuid": "2f94e1af-76b3-41bc-ac7e-357b1141e512", "comment": "Malware payload", "value": "a38712c10b5d25ad7ce1fa4a5725ab1a8ded514658624bfd061f972c37f1e317f7f5971812284be635f462fecf9667c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684706621, "uuid": "79f4ca37-a28b-4a59-b1e2-1ff8c114a63e", "value": "T181849E13A2D1BC62E7264A719E2EC6FC761EF8548F193BDB2A445A6B04701F6C633F41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684706621, "uuid": "85f85a01-a1f0-4412-bc98-b848b41feda7", "value": "f4492804ef800c5af0eb5787c534d586", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684706621, "uuid": "a701c0c9-9193-44d9-bd5d-716e1fa9508b", "value": "6144:TZLmKUn5ZjyzVt6qjvccctCamECriTgqzYqcNVTw9vrXWPY:IKUn5ZjyR9IccM9iTMVUjXWA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684706621, "uuid": "2c106196-57d5-4eb6-97fe-84a9e755abef", "value": 399872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684706621, "uuid": "420d4c42-d7bc-41e9-867c-3944e4e4a227", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684706621, "uuid": "29e0a32e-4779-4d3a-bd72-3fa6eda0492c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ededb787-f7a7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684653614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684653614, "uuid": "3a170188-e6d5-4d90-9e58-4cd44462fc59", "comment": "Malware payload (RedLineStealer)", "value": "50b1bcc8fb175a0903f3bc37c82345ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684653614, "uuid": "975378a7-b81e-43cf-af25-6cd08d68ef96", "comment": "Malware payload (RedLineStealer)", "value": "83343e308a48221f0e9b14ac70cff935f73677224535dd5487c99e8faebbbd5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684653614, "uuid": "efe471f5-8aa6-4a23-8e3a-6fd8d15ed578", "comment": "Malware payload (RedLineStealer)", "value": "0e1e42e5120f98ec4b26425ff02bec7182749b39", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684653614, "uuid": "5ef591b4-1675-4e3b-b01e-bc245ce94f25", "comment": "Malware payload (RedLineStealer)", "value": "18e3a85c3139fcf64b71f8a0129fe08bee2c540b24b9c78b46f3e88254925fc28d796de91bb361e50673500f15031955", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684653614, "uuid": "ee919ad4-5784-47c4-9780-b08e8fb5394d", "value": "T1D3252362E6D4A073C8F42BB005F306830739BCE25AB4976B3796986B4C735D5ADB1327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684653614, "uuid": "245a323a-bacd-4fb7-9802-56a687c32fd3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684653614, "uuid": "f0f8a08f-d0cc-410a-ac88-1bebc0b86428", "value": "24576:oy49rmNitjnRHy6nq9K2VLMvoBGvYAG1wvw8U69MBF8:v49m0RRHy6nq9vYvoBRdwuBF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684653614, "uuid": "ea2cfdf5-f8b1-4fec-8ca2-75aa19c311be", "value": 1046016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684653614, "uuid": "16290484-3e50-40ef-a872-47fd16b82dd1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684653614, "uuid": "895d9784-b486-4efb-91ff-0ae4ef4452d8", "value": "50b1bcc8fb175a0903f3bc37c82345ab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2789983e-f809-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684695372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695372, "uuid": "e79bfff1-6591-4b9f-a99b-7dc528b247f6", "comment": "Malware payload (Amadey)", "value": "6aa96ad92e741e7856e64e0121761ba1", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695372, "uuid": "6831315f-4f30-4ee4-8c15-30c358762174", "comment": "Malware payload (Amadey)", "value": "835f81c9efc7e71b0de1a64ad9c5349c63a3f2698643161c4b01b0a0b887358d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695372, "uuid": "1ecd0232-15d6-4df8-a5c3-6fc5788440a4", "comment": "Malware payload (Amadey)", "value": "68673aff12db44085327ed3025ba33b224f40118", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695372, "uuid": "dcff880b-9d2f-4e1a-bad6-309abd6357a2", "comment": "Malware payload (Amadey)", "value": "ce79d3a33de9faf12a0768678716a30d2d6443ac46760bf7d92e947bab486170430cc9c016bee91b470267d854583f6b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695372, "uuid": "76ca1d27-96ab-4bdb-a0d5-3a5530fa2517", "value": "T131252353F5E88532F9F117B059FB83830B39FD902D38632B21595D9A08B378199B53AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695372, "uuid": "f2ec6522-49aa-48b9-8af4-ea83a67cb28d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695372, "uuid": "f0be8e46-0956-410b-9d9d-964b4e2c290a", "value": "24576:nyXrv25/+q6gBT5eihN9MuI5TfvZVdDH:ybu5/+qJT55gzR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684695372, "uuid": "3deaa0b6-fc6a-402a-a234-f0432c3bb517", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684695372, "uuid": "69fae5a8-e0e4-4201-be6b-08c73370085e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695372, "uuid": "75f5a5b0-2b6c-44ae-9aad-fee20b9afd05", "value": "wallet223.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "040ae729-f809-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684695312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695312, "uuid": "dea397a2-0e35-4024-9d2e-5970c0abc45f", "comment": "Malware payload (RedLineStealer)", "value": "8ee751f1096982c64e21d61366e02578", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695312, "uuid": "7e278d1c-b625-403c-88af-aefe1e57d642", "comment": "Malware payload (RedLineStealer)", "value": "837ad8f994cd084ebf27d6209ae170c3546f3e2ae55d0475724cb358056e5fe5", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695312, "uuid": "688c8267-c2ac-491f-b847-f21d8cd3ea74", "comment": "Malware payload (RedLineStealer)", "value": "d8c8ed34445f5e138560c78b043b5be6a4744a6e", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695312, "uuid": "ac0c7a61-a25e-49d0-9184-e0e6e1cf6ea0", "comment": "Malware payload (RedLineStealer)", "value": "d5b838d392ff406bce69c4dee345b054b8bf0f5eebc29e74273f33b9a9ec26bf934a79807807eef6435ee35ff7e133ec", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695312, "uuid": "704c8a16-d0b4-4b29-810f-321b58ee698f", "value": "T1D72523136EE440B2ED757BB0DCF603E71939BD601D79922FA7416A668D738C0A43236B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695312, "uuid": "fda896b1-4474-4527-bff5-023890d4ef34", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695312, "uuid": "e422faab-2af4-4045-a388-91db5b5393f0", "value": "24576:8yiPQtJXlPVqkyDJcFKkZKR214j7kxAQ/:rAQtJXlPVqkyDJcFFZKR2owx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684695312, "uuid": "d98c938a-38d4-4cd8-899d-c54a430a8d6c", "value": 1056256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684695312, "uuid": "a2c6b152-5f55-4787-a77a-bbe429e87bc4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695312, "uuid": "9eebbbe1-fbc1-4227-8396-c75ec73ee8ec", "value": "launcher262.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3316d79-f7a8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684653918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684653918, "uuid": "3f3ffa1d-cc5f-4c87-a52a-58584711daef", "comment": "Malware payload (Amadey)", "value": "ffe189d23a0319769e551cacf0191bc6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684653918, "uuid": "5382adae-a401-4d39-b645-c93067fcccb6", "comment": "Malware payload (Amadey)", "value": "83f951dd15048eecdf29f3c04af798527d8bd4d1829f5f39564372ae564c8a83", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684653918, "uuid": "7b6d5887-ac89-4d93-a4d4-b1d76f064adb", "comment": "Malware payload (Amadey)", "value": "7d12db840ff6b5bb7583530f8ef71ab49d628525", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684653918, "uuid": "70ad9d1e-5e31-4b64-a923-0c1bd0670cb4", "comment": "Malware payload (Amadey)", "value": "731de978fbd954248c1b19721c01d4c1d1d26c1c47dcabcb2825fb7a51bab984ffb1a0f35ebd8e3448db23654c0a5824", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684653918, "uuid": "e6a2cfde-cb4a-4c1a-bc37-9a54f8b57b23", "value": "T1002523279BC88033E0F427B018F61253163A7D964E719B5B3757888F0EB3594A9793BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684653918, "uuid": "5ed6ed22-b289-451f-b07b-b92ba86a0d70", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684653918, "uuid": "8328c8bf-efdc-4daa-9712-d5ffb3623a91", "value": "24576:UyiOqCdafmxSZfXygLt/urQZp6BafBQNYS941k:jiZCAfbi4t/u7Ba5QNj41", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684653918, "uuid": "8c844b99-4b87-4bec-a65a-2f2b72b269ae", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684653918, "uuid": "3b0aac6f-6f1c-46d6-bc19-3824f3b675ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684653918, "uuid": "c1933359-36a9-4597-9b1b-8ae5f0349694", "value": "ffe189d23a0319769e551cacf0191bc6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2143b030-f7b2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684657995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684657995, "uuid": "0b32ef3d-1e8e-4fa3-9171-f27c676b03b2", "comment": "Malware payload (RedLineStealer)", "value": "4128d438632166877ea924a1733c9d4a", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684657995, "uuid": "0a2fe196-4a12-4ee1-bf39-31631c4420ec", "comment": "Malware payload (RedLineStealer)", "value": "84457f84df961330e39114ef2fb3820e4f4aeb6c9aee076c852159ac1b6560ed", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684657995, "uuid": "879f1a38-3752-40f9-aac7-23477c240e5a", "comment": "Malware payload (RedLineStealer)", "value": "dd0be822caf883a769617c77da1d84290301204a", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684657995, "uuid": "367aa223-0277-4c91-b723-ca49ca040652", "comment": "Malware payload (RedLineStealer)", "value": "cf77154aac8bfd2c50bd8dc6bf769de80a6cf7beee22e67d9f1bdd0d8795d1c591db2e0609244cfd66a9cc06a25d4ccb", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684657995, "uuid": "3586bbe6-50ea-4f82-9398-c9a9110ede1c", "value": "T119252353AAD89832D8355B3CDCF752A31637BCA1D5B8A32B1742A91B4C734106DB273E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684657995, "uuid": "ffa5c293-b753-4486-8ca5-5089303db574", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684657995, "uuid": "3430f9fc-080c-44cf-83b9-b6a79ed17d7d", "value": "24576:8ythY0l11IAfUICAq3iK1X0y/dyspLEeu3osfwqc3t:rM+11LfUvAq3jX0dUEdBfv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684657995, "uuid": "9d4c4874-9927-4b20-951f-e64a5497eef0", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684657995, "uuid": "92ad5fd1-788c-45f0-b36b-81db79b51c16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684657995, "uuid": "7a64b74b-fe3a-4866-81a2-6ebcfa36d998", "value": "notifier.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4051785-f7c5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684666375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666375, "uuid": "892ef5cf-5dfd-429b-b597-331a2677fd7a", "comment": "Malware payload (Mirai)", "value": "df245ff960f37616262d469d539c0c7a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666375, "uuid": "1d1866a2-7d1a-44d2-b624-ea0515fc3ddb", "comment": "Malware payload (Mirai)", "value": "8445cbe6902b2f14acc961a344eb5afe9adab9ca5040bb45dbe4255d27b555ef", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666375, "uuid": "874d6f6c-0496-4f80-bb79-028328626776", "comment": "Malware payload (Mirai)", "value": "ed1c95954be12c16aec2cda561cf92f2d004047b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666375, "uuid": "a3782190-771c-4de3-bf8f-2ef9a1a160d7", "comment": "Malware payload (Mirai)", "value": "448a0967fbadfce09a556a07385cc1eb04d5f1be4bcdb8d87325620b948260fb3f43eb5adfa3d7d9c85d62f666d52e5d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666375, "uuid": "86e4a353-3127-44ab-9cb3-2dd65485c390", "value": "T14D730A86BC409A10C6C50777FE2F218D33075B99F2DE7352CE155BB07B8B91B0E2A65A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666375, "uuid": "a78dbd33-a227-40fa-8d70-cf44d6c960f2", "value": "1536:i6nedybtD+qtZYQZYuKsXHMDpLij8J70qNdxCM9Wz1wIKiZpBNmZL:ydwrtZ9Z0QH6sEYqNPCtpBNmZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684666375, "uuid": "5e0ce43d-4772-477b-8fbb-72d49127d0be", "value": 80528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684666375, "uuid": "fb145f82-5c8e-41b5-bc28-bf8062f488c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666375, "uuid": "4237c04b-62bc-4aaf-8293-fbd1cd5109a6", "value": "df245ff960f37616262d469d539c0c7a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ea918c4-f7ff-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684691142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684691142, "uuid": "1d20e8c2-738a-4582-b03d-11b3b6c0ccb6", "comment": "Malware payload (RedLineStealer)", "value": "058b7d685ed6e64b9fc86b11637b561d", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684691142, "uuid": "53952f0f-4e71-43b6-9d01-52407be9beb7", "comment": "Malware payload (RedLineStealer)", "value": "848b32b0e89aa549d81fe82f6f360ba1eeb65e0ba454c15867e221e699686d3d", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684691142, "uuid": "22463d6b-f519-44dc-a657-046e87cc7791", "comment": "Malware payload (RedLineStealer)", "value": "d582880b3d08e36e9d8ae098ecdae49784028718", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684691142, "uuid": "d6d7458d-f5df-432f-b501-35e0f99b1c1f", "comment": "Malware payload (RedLineStealer)", "value": "9622ea0bd7de86a0912e2874b2388575bd5c1163c68084908e1c0ae3dc692d42b289e6f41c8c31357f5591a7446431ab", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684691142, "uuid": "0e47eeba-3772-4ecb-9383-1fcbeb6df151", "value": "T162252356B6EC4463E8F4037404F6A3831F337C61AA7803667346ADAA0CB3795A97573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684691142, "uuid": "4b867253-efb5-46a0-b533-7ef8e18604c0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684691142, "uuid": "5afff490-07e4-4f9c-a676-fcb2f9036740", "value": "24576:VywDcNOoilU8x3X+JwonrFC5XxqqCAvUa4ok2rLe0i+D5lvfuUZDEURN:wo4O48xnuPrghSAU5MrLqE59fuqD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684691142, "uuid": "b2b99bef-f87b-418f-a7ba-2b8ce46632cc", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684691142, "uuid": "1588592f-df21-4215-88fc-444991d05364", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684691142, "uuid": "45c42747-03c4-4a12-a2d4-5f97edb042d5", "value": "32332613.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25b329e3-f7b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684658432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658432, "uuid": "fe326520-826a-431b-be9d-2fce03d35205", "comment": "Malware payload (RedLineStealer)", "value": "55dcace15a05bcf9493010f3f6a9119c", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658432, "uuid": "235ce19d-55b5-477e-9ee9-88fe21508a2e", "comment": "Malware payload (RedLineStealer)", "value": "84eee08eea754b3c0dc7cc91c8bc81834c9c127cc0bbf57a1f8d665e405bc426", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658432, "uuid": "62d4b58d-24c9-46f9-966e-409c32dd2146", "comment": "Malware payload (RedLineStealer)", "value": "82ad32333fe9c8ec7b21fb5d97c63519c31863fd", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658432, "uuid": "95f0c050-d6cb-4027-a975-f91bed933d46", "comment": "Malware payload (RedLineStealer)", "value": "dc2409d8f1db3cf17caa3b59079a6fc41dcd2d35a64ed1f5a26b8926b704b6e686ea893630f3eb2e8c9d57da1b853fbf", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658432, "uuid": "79ba400b-1b5f-40e1-9cf2-bea6f0177b40", "value": "T128252256ABD840B3ED7267B448FA06D70732BCF189B8925A3B55998E4C33D48693133F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658432, "uuid": "da610ebc-927d-4e39-93a6-e6a370076b7a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658432, "uuid": "e91dff3b-7782-465a-b335-319f71c8058a", "value": "24576:kyndB82e+XL2ZNqMfyRkvkW017rkulnK/mpLvOHYCjC3poQv:zdB9PcqMfyRnj7rJl/YHBQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684658432, "uuid": "4e95517b-3ce4-4049-abe1-f010b5ca793e", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684658432, "uuid": "a78545b7-290b-4b2e-a4b5-31fb1df0219b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658432, "uuid": "418b4ea0-0ae5-4e9c-ae86-2762c34bfecf", "value": "driver164.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbe2767b-f7c8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1684667757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667757, "uuid": "994f8e49-592f-412f-a7a5-be651c76781e", "comment": "Malware payload (Smoke Loader)", "value": "024f063a8272f7d4ca2bb983373c8be6", "object_relation": "md5", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667757, "uuid": "f97b6629-76bb-4396-8a6a-cb6f94b3a40a", "comment": "Malware payload (Smoke Loader)", "value": "8536cafae2d0e674a4576a518f81ccb6a26d1c233f86a0c7e7325d07c691086a", "object_relation": "sha256", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667757, "uuid": "95b0f14e-1c3d-4cc8-a2db-6b406172c7f2", "comment": "Malware payload (Smoke Loader)", "value": "114951c9774f6737dff24d14134bd985681d4a20", "object_relation": "sha1", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667757, "uuid": "5cafe947-102d-4a28-97b2-59c2ec025344", "comment": "Malware payload (Smoke Loader)", "value": "c9562cf377df4affc82ed7f7b568145bd5e232fccaa30e81de51ea9f5848689971c4c281d7acce7aebde1a2a70c94692", "object_relation": "sha3-384", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667757, "uuid": "20750a7d-d5d9-4ebd-809a-5c5c3423a29e", "value": "T193645B9396A3BC69E92646728E3EC2F8761EF5504F0927D722486F3B14711F2D6B7302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667757, "uuid": "f4c7e9d9-9a95-43f0-a265-a877109cb959", "value": "dc368f441a884fce22ecc585e2bd5326", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667757, "uuid": "e3de0bd5-60aa-4313-90d2-8f750c724158", "value": "6144:BOYHa8yBCe1FKlQuVBSXjQljnJJFvTPT:Bja88ZbaxnSXjaX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667757, "uuid": "6d0ac1fc-1c55-4530-8db6-f12b45511af7", "value": 327680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667757, "uuid": "37235526-ba64-4376-8939-2a9b9a7ea507", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667757, "uuid": "05960843-73e1-4101-92e6-d7cb6fdbc0ab", "value": "LightCheats916.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca8b303e-f7ec-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684683190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683190, "uuid": "acf69509-83b4-456f-bc4b-b1cef72868f6", "comment": "Malware payload", "value": "eee053ddc4331aeb9fcb8f0624dd6ac6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683190, "uuid": "2e6303bb-7466-44e3-bd86-caf05721bba0", "comment": "Malware payload", "value": "85b75b40259a7a8dbcd66b2572e1702c252dc3fb6322e46c06927105f053759e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683190, "uuid": "884beaeb-6883-4093-9bbf-a29d7c8768b9", "comment": "Malware payload", "value": "8bf19e866552e8e66f4cac80a7c2d3ebbdfed378", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683190, "uuid": "0f9476f6-96b9-4ee3-9f29-ee4f1f37c8fa", "comment": "Malware payload", "value": "968e22ea67879ee72bb4fb68e07d700cb2932e7fe14d3eabbb67536abca048a9320f2f0143e6ef9f163693b74bbb7b6f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684683190, "uuid": "ac45327f-4d9e-4196-ae1e-38802e9c1c32", "value": "T1D4C32A2327670B23C4E9503441E75337B7B5CB843878934BAAD0AE9C2F1AAD435973E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684683190, "uuid": "5f97f7f0-42c2-421d-adee-7db8e59c6414", "value": "1536:lIR8jc0YyVNM2ZwoL0QImVv6Fuo+uU1tyTQM9KGmuwA/KiyYIW:ZcVyVNXZPVvaFZZX4GmuwACXYIW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684683190, "uuid": "454fac2c-33dc-4739-bfdc-ddecc7192d91", "value": 119963, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684683190, "uuid": "d62d0bd6-4ddd-43d0-8aa2-a7ef0b5ddedf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684683190, "uuid": "06c981d1-c5e7-48bc-acd1-926fc80f5f88", "value": "eee053ddc4331aeb9fcb8f0624dd6ac6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66f9a92b-f7f5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684686888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686888, "uuid": "c43e1004-4646-4a05-afcd-7e4b14c05446", "comment": "Malware payload (Mirai)", "value": "0b2ce589eaeda747d9945323b97efd28", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686888, "uuid": "a80135ab-c6de-4740-8bb1-2399197eeda6", "comment": "Malware payload (Mirai)", "value": "8640b40e60e420b08dfb7a88e80a8bea08bc550cbb694c66e4c923d358d55fc8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686888, "uuid": "ae1433de-cdf1-4395-bd84-a6eab96b1906", "comment": "Malware payload (Mirai)", "value": "ccde389f3171f1b302960d18af58b0bf234256d2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686888, "uuid": "60d2c1a2-3ea1-4ee8-883a-f3a9fa3abe47", "comment": "Malware payload (Mirai)", "value": "da9e817096dc7a2b841333d717550a87fa6a7b447ecc44acc6d8adbcbf10c9e4372c9a2c204639757df944d31acac901", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684686888, "uuid": "aed505aa-7be5-4d5a-aa46-c16ea5a71c77", "value": "T18973E615FB650FF7DCABCD370AA91B0139CC554A22E87B367534D828B65B20B49E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684686888, "uuid": "dbd4c167-d399-4fff-9d1a-5c9d7726211b", "value": "768:YGI8RZU53j6yVRSfaOkfqUrTMNeJgkef6OrD+wdujMlZhChXiL3XKzesAQ2gXwx4:9bUlpS+ra0gkA6wUaZhCaKzbAQMxPg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684686888, "uuid": "2820816b-1ead-4197-a3ec-51d5aa4c9cea", "value": 76416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684686888, "uuid": "e80f0d2c-8af0-4c61-96b3-b73436140891", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684686888, "uuid": "d91bbe64-d7e4-4c41-b2b1-97af8d21f560", "value": "0b2ce589eaeda747d9945323b97efd28", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0333ca45-f7d1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684671259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671259, "uuid": "63aae217-a595-43db-921a-d0e8608a1fc0", "comment": "Malware payload (Amadey)", "value": "9266da7f9f64f6425c8a31ad9c5304aa", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671259, "uuid": "a69c0291-491d-44a9-bf5a-dca251aa5ad6", "comment": "Malware payload (Amadey)", "value": "867d1e4563d71f5a45654a5cdfff18763dcafff65dda4fb2d108f7edc3e5f537", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671259, "uuid": "eb53b0c4-b27e-4d8d-890b-ff62c9e531ce", "comment": "Malware payload (Amadey)", "value": "e88901a2998afd11f1c95447c04fb19f0aa6c3d5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671259, "uuid": "4ae07378-d554-405f-a801-6e5afafe7bac", "comment": "Malware payload (Amadey)", "value": "eb02d6497d789ee1f8105e5c0c9000789c67267db30d360401ac1b33c8664ad3e971d3e4141bb338bf042b8f819a63b7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671259, "uuid": "ec573381-bf5a-4bdd-b7eb-f4112ade9019", "value": "T16F25231372E89137D87557749CF913930F327CA098B8863F6B4A9CA74CB3984967237A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671259, "uuid": "c1e3161f-1cd5-4dba-82a8-bda2460ba33d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671259, "uuid": "48ae19fe-3f04-4c74-9405-e97ad921a8c7", "value": "24576:myKLGNJ5tO1QM0PqUVR6SxnNqLKw8yvIYit32YQB5yTk4M5X0Tz9QL7g:1K8O+1qwVxnoQBtTOIk4M5kTzQ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684671259, "uuid": "c27ae68c-e25e-4391-99d9-a997f708deb1", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684671259, "uuid": "3ea56fda-692b-4575-a7c4-eeb751a278fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671259, "uuid": "664d4131-d1c3-4d11-bf2a-557a5f060751", "value": "saves391.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d5d780f-f770-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684629803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684629803, "uuid": "43e943e1-e5af-4a6b-8148-0b3ec33793c0", "comment": "Malware payload (Amadey)", "value": "6bc3d47d4ed3288a548615ec657041fe", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684629803, "uuid": "fddbb7c2-2157-4537-8550-ea33ce5bd130", "comment": "Malware payload (Amadey)", "value": "868d91b339e92070c1fa3e2c6510e5db940ddf5ff4598fff319c1d9e5f660a84", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684629803, "uuid": "e3bc4b3d-5619-422d-8ad4-42916348bb50", "comment": "Malware payload (Amadey)", "value": "7e33e45e8242800e21a5a12d8cd4e2c869cd0ba6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684629803, "uuid": "0d3a59d2-dea5-434a-8ac3-8bcea788feb8", "comment": "Malware payload (Amadey)", "value": "e8ffc36cd9838b3798402a7d93285f51d7b64fa2cdd2bba3305fdaaf669506346f3d84390c5618d1bbcb0070bd71b953", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684629803, "uuid": "3dea9390-605b-467b-b80e-6004e5a198d9", "value": "T1B02523056BE80177CDB61BB569FB01C3173ABC665C76E12A2B42ADEB0CB31947934327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684629803, "uuid": "00468226-a6f7-4607-bf66-992086c88598", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684629803, "uuid": "8c3e8b48-40a4-4378-aeeb-e2296571268f", "value": "24576:TyfQAhMGlhgT8xiqlqF3xVHAAf8eBWof1KoTUlf:mIahgT8xiqAhVgqZKb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684629803, "uuid": "5f269b1a-9358-4c48-86b2-f08536871e60", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684629803, "uuid": "a12d9180-d17e-41a5-a159-472f24ad3e80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684629803, "uuid": "0a24723f-bd53-4e88-9e70-d20c0eba55f7", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1473bdb-f7ec-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1684683147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683147, "uuid": "66d32697-3ee0-4c71-bca6-475fcc7d3cbf", "comment": "Malware payload (Gafgyt)", "value": "e2e60dadfe944debfa51ea1e708e5f64", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683147, "uuid": "a0a42b0c-686b-4980-9b0a-361eb71523b9", "comment": "Malware payload (Gafgyt)", "value": "871c2491bc978065b4a3c278034f26da69eed43185661661aa2675a65801c9fd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683147, "uuid": "e34bc594-32c5-4bfb-9373-87b634fea20f", "comment": "Malware payload (Gafgyt)", "value": "296dbc0844b6cd8380eee78cb97d13cfc9e71aa6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683147, "uuid": "efdf00d7-1ce4-4772-b58b-09773d349025", "comment": "Malware payload (Gafgyt)", "value": "6d7eb94fff9e10284b2a88dc3e36bd465e7dab380ecec94f75aafc7cdd3564b542c3ad5541feac6c86a495526618c1b7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684683147, "uuid": "7f825282-04b5-4cf6-8fd5-a301ef721756", "value": "T15CB30741D6548627C2D32B7BAB9F438D3336AA54A7E733095528BFF43BC27981E3A111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684683147, "uuid": "346bb048-c04e-4a15-9ca0-9ba4cd830f3f", "value": "3072:HgvUxOcKFN+B9Jy8D3XvpIhfX04CHz9cm7QnKQXaeW:HDEKXy8rvOFX04CZcm7QnKGaeW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684683147, "uuid": "c2efdda2-6044-404d-81cb-cacae72d56df", "value": 111561, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684683147, "uuid": "e6f6d390-5184-475e-980c-57d0936a626b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684683147, "uuid": "19ac5d4f-c15f-4f68-a8ab-89cf7adc232a", "value": "e2e60dadfe944debfa51ea1e708e5f64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb4bd045-f808-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684695270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695270, "uuid": "de55b17d-b039-4a1d-8c11-b30f16b7e475", "comment": "Malware payload (AgentTesla)", "value": "f2fca2a78da63b3b77b0e4af9b395a12", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695270, "uuid": "4b1ad8e9-662d-4b52-9dd6-ec40abb4c56b", "comment": "Malware payload (AgentTesla)", "value": "877fda5f310c7390305f5bd1fa21b2ffdb0d138d2e4581c7ec1017599a9ef068", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695270, "uuid": "07f8c900-6f2c-4b0b-b2aa-599090fa8947", "comment": "Malware payload (AgentTesla)", "value": "4cf442e546efca1f1bfe39b9f9c13636f2aacd3a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695270, "uuid": "dab14281-ed26-4844-af50-ce5d5ea6e564", "comment": "Malware payload (AgentTesla)", "value": "d5645749b30e234c115040c3b8b766235d5ffdfd729103cfeb5f0e37784e60cbfc5fbfa4cf0597a471af14ff98e928a0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695270, "uuid": "cd1871d9-43c9-4128-b096-559231c59eeb", "value": "T142C4233A1F43B52CB6BC3059C3D700396A6AE6C6C91BDD4714DDE0603A14949FF2BD6A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695270, "uuid": "b78d80c2-1095-45c3-be9d-a3e2dcf356b1", "value": "12288:ifqd9TDr32YxAml+ZKlnQJkNx6KmpgrVH03ZNUF7db9Rr:ifqPP32YumwQnQJcxFGgJU3O7rR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684695270, "uuid": "5b42a002-9e99-4b10-b7a2-8db16457aa03", "value": 569093, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684695270, "uuid": "35e4e9c7-8807-491c-ad70-c0b135447416", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695270, "uuid": "d4fe84c0-7ee8-4b40-8168-31cb8085a038", "value": "bitcoin581.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9eee48b-f7c8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1684667780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667780, "uuid": "fddb8800-6ebe-4b22-92ac-e68a64c107ef", "comment": "Malware payload (Stop)", "value": "e944510cc6f000aa4529c7fb09dcb4dc", "object_relation": "md5", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667780, "uuid": "0d198994-cd6a-430a-ab6b-22eeda62694d", "comment": "Malware payload (Stop)", "value": "87b92d37eae4bf035b82a9ce3e25cbc34a1581e9a039344da4707d3c1d3cc251", "object_relation": "sha256", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667780, "uuid": "36b58763-b918-4c50-aef0-475c6c9611cf", "comment": "Malware payload (Stop)", "value": "54601f8c27b6c05dac9d64df5968e4d30c4a7cab", "object_relation": "sha1", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667780, "uuid": "6e3111d9-7e77-4cd8-9f1d-1593d805afb5", "comment": "Malware payload (Stop)", "value": "0ebc2abf9c5c4303cff63b0666485d7d9d3f0544fef3e4816e56a206438cb581b5048f3f158b9a63a48512af79e5d1e0", "object_relation": "sha3-384", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667780, "uuid": "ef529389-151e-449a-8c31-9e6a8aad4652", "value": "T17705E04392D3BC66E9654A725E3EC3F8761EB9504F082BD71244ABBB08711F2D6B7342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667780, "uuid": "dc5e0e77-faf1-4f18-b319-2fc74da29fad", "value": "1f33507fc49ff617ecb248bee3af9a74", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667780, "uuid": "e2d069f0-79c7-45d0-a10f-f5c7d1b7958f", "value": "24576:vmHfqqyh+5kdxcmjC+mFX/QL+ehk5DRo:vmyqyh+5XsC+mFWhSDR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667780, "uuid": "5e5cd386-60b4-4568-8eea-d199b4d74727", "value": 840192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667780, "uuid": "4ba1113e-ba21-4e37-9875-cfffbf26f241", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667780, "uuid": "7af18515-7bd1-41a1-a99b-3796c69f32b6", "value": "downloader519.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2ebe1c7-f807-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684694854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694854, "uuid": "5f9acd2b-0bef-4bae-88c4-f4b0dfc096ee", "comment": "Malware payload (RedLineStealer)", "value": "9059f3c6006ce12fb2245ddb04ff5936", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694854, "uuid": "92472fe6-78f0-43f7-9157-d7c58a782692", "comment": "Malware payload (RedLineStealer)", "value": "87d460a1b04dc248ee1d21937d35e577d43be0c09b0acec507e3580a7f655d93", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694854, "uuid": "565cd201-f593-430f-84c2-3af13f6909e1", "comment": "Malware payload (RedLineStealer)", "value": "71dfc849e5089fc7f3cf7692d2cfb2d64c5bb737", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694854, "uuid": "1f44078e-1898-4399-a21e-156467951c80", "comment": "Malware payload (RedLineStealer)", "value": "b20919b03de779ee235852b66ff38d64931ecef64ad99c9e19ee2e69beb43f05076d7519c9b97ba5e35b4da7214a42b8", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694854, "uuid": "223551e9-5f97-4023-8fdc-44333704bb48", "value": "T1FB25232BEBC84276D972377098FA03D70B32FC625D60832BAB019A5B5D331D15572B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694854, "uuid": "a55eb921-efa8-469d-8d45-1cbb6c881a2a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694854, "uuid": "82e3e842-73df-4c8e-b8e4-f7cbfb09fb08", "value": "24576:vyOWCfc4eMvDRGO7qzY8docCwpN+DzWRRvekJ7Tqtf1YYHk:6fCk4em1Z7qctwpuzy5pTqt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684694854, "uuid": "05c82d7c-629d-4352-a02e-97fc3300b166", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684694854, "uuid": "abcc622e-629f-47a8-9eeb-ee01c1d57ee3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694854, "uuid": "df51321a-75c3-4dce-b3fa-97d6106c8937", "value": "file403.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bff685b-f7b2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684658066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658066, "uuid": "38ec9c24-0780-4df9-ab03-feb38c00ec38", "comment": "Malware payload (Amadey)", "value": "375ffa8fa3e65a31ab46c2a761fcdc93", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658066, "uuid": "48e9cd46-194a-4d3f-b5cb-80e1d92f682c", "comment": "Malware payload (Amadey)", "value": "8825a186b7882eb43ba0b3864c11b02c35aa8c731d8e351228cdea3bdb12e23c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658066, "uuid": "de672afb-bc3e-44f9-bdb6-c5c48cd3c7c8", "comment": "Malware payload (Amadey)", "value": "fa12c2b49ae632a1b14eb60de1ac50337959cd2c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658066, "uuid": "1b775c1d-12eb-449f-925f-6809e9aeddb9", "comment": "Malware payload (Amadey)", "value": "a69eac5826c97066ca0084249e65df2f50bf71e0c981f46c7a74a7df758b8893ddf981a58281d2b02c5c7cdd837ef888", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658066, "uuid": "e8e6f2fe-8995-4f9d-bff1-7b5f9e50fba9", "value": "T1CA2523076BC88072F9B1273068F613C71B36BED5CC79936633969D4E5C762A06835B3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658066, "uuid": "dc313033-5757-4842-bd69-ebb40d928cf4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658066, "uuid": "6dacf057-2555-4014-963f-f7c4e703cb90", "value": "24576:JyIP7oKllFE5jYpFqRaW3wz5rXFrartufhi8I4d3jNvVY6:8IP7LnE5qFqRaWgzxJkhD6jNO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684658066, "uuid": "60498516-663e-4d3d-9d70-e4c225ecf476", "value": 1056256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684658066, "uuid": "df4a8b21-7019-44e7-a5ab-6730c5afcd5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658066, "uuid": "9f96035f-a9e0-432d-a233-624b394cb453", "value": "renderer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "310b62be-f802-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684692381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684692381, "uuid": "422f520a-feaf-4786-94c4-06eadf33dee0", "comment": "Malware payload (Mirai)", "value": "3773a06e7cc8fa924460dbc0e3e51ec9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684692381, "uuid": "51e62d26-222b-4595-978b-91ab5dfaf354", "comment": "Malware payload (Mirai)", "value": "8894ecc2cdb85d2e39080f6e6bb3fd582b94c354c99c59e3b09f6e884df7ce19", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684692381, "uuid": "0df8b2ce-9067-4b6a-a46d-0d350ac0e96f", "comment": "Malware payload (Mirai)", "value": "5f368ed3ab9e99c2b5e8d203990771feaf95b20b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684692381, "uuid": "0d6a35bd-b692-499b-9e7b-b959013dcdf8", "comment": "Malware payload (Mirai)", "value": "0b20c6446ecb23d6ec85330361c76189e7ae6c0251b81de112245fd04163b7ebe3eca29e47aa14aa5e1b2a2b1706b53d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684692381, "uuid": "bfea32c5-03d3-4b46-8ee4-f74dcecb6456", "value": "T16563F956F8819B22C5C2127AFE1E514E331317BCE3DEB2129E246B30778756B0E3B959", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684692381, "uuid": "9906b54c-07c4-4785-9bc9-15eed2302e1d", "value": "1536:kJnvlrB2g4vFm7ELtEraWe+K4I5iCv2xAwK7r15CYB:WrsZLtEraWsv2xAwKP18u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684692381, "uuid": "c38a1931-1456-47c1-a399-a4f538657040", "value": 70804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684692381, "uuid": "d9a6f50f-8e51-4279-ae9d-860bc44a3987", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684692381, "uuid": "bc1125f6-33a7-497b-be41-dff288d0c119", "value": "3773a06e7cc8fa924460dbc0e3e51ec9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0b50744-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684680542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680542, "uuid": "4086773e-6349-41fa-956e-1a03c3f53441", "comment": "Malware payload (Amadey)", "value": "8fd3cfbe126e00609be2fd746ddfd893", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680542, "uuid": "964f58ce-da3e-45a2-b635-88a9141d3b13", "comment": "Malware payload (Amadey)", "value": "88a8ef102a16e4f7a2a0f6a9dd01fbb8d50ac8702435a3ff3c8b281bf64054f9", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680542, "uuid": "f28291cb-8943-4e59-bda6-984f5de78e57", "comment": "Malware payload (Amadey)", "value": "7aca9130a0de10f49221b80a2005581817cbc311", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680542, "uuid": "d31a1bbb-e85b-4f20-9570-2bb32c5fc105", "comment": "Malware payload (Amadey)", "value": "1646975ddda52a5f28189842a2adaf5645eb7b42b2cd95a2d47a90e67b8f97e32f64c838e542ce7625f5e9a90aef4c88", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680542, "uuid": "aa5a3c33-f93f-42f8-a49b-c36000dcc5cb", "value": "T1452523127BDC51A6EEB95B720CF20A930F357C90CD34C13622989AAF5D722A47D3536B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680542, "uuid": "03076fd4-9fbb-48e4-a0bf-73a095ba1407", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680542, "uuid": "290eb25e-c391-49d3-b2ab-7cb97bb1f9d0", "value": "24576:eyAG2jT97l2qFqaiSr1Ju5NFVyUB3isITb:toH9J2qFq0h3+isIT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680542, "uuid": "39d6bbb7-d494-47f2-9b3a-9e60f456dfa9", "value": 1054208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680542, "uuid": "a27b8b28-3974-4954-a332-f561665c7e06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680542, "uuid": "98a8218c-5953-49b2-9634-6eed972d93c5", "value": "controls901.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a1901ad-f7e5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684679914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684679914, "uuid": "8dcd25c7-6f19-414b-b975-9a60f9b0d39b", "comment": "Malware payload (Amadey)", "value": "9c7e667fa9c10a599f135d83b14453c3", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684679914, "uuid": "3c22b7e0-7646-44b0-9fc9-aa9b186fef1c", "comment": "Malware payload (Amadey)", "value": "8911f52ac73ad1aed6da0727743557bfa74df8a0a6016167c86154490464eaa2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684679914, "uuid": "27e85515-c0f3-43e7-9808-3908b3e1593f", "comment": "Malware payload (Amadey)", "value": "0402e4f2a97035747e67e24c99ddcd5cc30b8e97", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684679914, "uuid": "11ab8567-40c0-4d79-85ae-6bcdc008b5a9", "comment": "Malware payload (Amadey)", "value": "bc6df4ab18543c0bd44cea2b489e41127b09c87084372b69ebfabdde27c40aaf157741f0e58533c8eb2b35e44649d781", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684679914, "uuid": "196ef84e-74a4-49e6-b504-c6cad476284b", "value": "T163252313EFD44573E8B833B0A4F211D31B3ABCA4AC7087972785EC990B736A4A971765", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684679914, "uuid": "3cf4c489-7881-44e5-b8f1-e0d1c96134f3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684679914, "uuid": "7add754c-7d77-4616-ae42-b8276fc6e087", "value": "24576:hyiIVFf8Gq8qDGWIInlnlTEest76boaBDVOibwJ7fTe:UiEq8qDGHUHboaRcibwV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684679914, "uuid": "fb339d87-3ce0-4e51-bb40-b3e52cc10d66", "value": 1054208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684679914, "uuid": "b7750f0b-bd27-4ba5-81bb-8214eaef3f30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684679914, "uuid": "575cee31-d404-4ee7-8648-ae2018826623", "value": "21324706.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad30fb9c-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684680563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680563, "uuid": "54a5d829-74f1-45e4-b77b-ad45b4690521", "comment": "Malware payload (RedLineStealer)", "value": "3213546b7334bead27f6361fb70484b3", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680563, "uuid": "b99a3e9c-a3d7-4259-b703-7179997ecfa7", "comment": "Malware payload (RedLineStealer)", "value": "8b3f25b68155b8b1fc71d3a349abfc4b6c54c31eec098c44a39494bc5318f735", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680563, "uuid": "b6a4d552-9862-4b36-a4bf-f25c31e2a4d8", "comment": "Malware payload (RedLineStealer)", "value": "286effee002bca11b103df615f8aeefc90e9bbf3", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680563, "uuid": "ad0282a4-23cb-479c-973c-bed6e50f2fdf", "comment": "Malware payload (RedLineStealer)", "value": "6bebceb9f6fa501dff603596fa030470499ea84fc038df8e232e3f0fd223b3bb6550fc608483988865c5229be73adc1a", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680563, "uuid": "2f5ba264-5621-458a-954f-b72e4bc1bd99", "value": "T12A2523579BFC11A1C8F9273145F646C71E7A7CA2BF64932B2345AD260CB3290A571B33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680563, "uuid": "24a88346-3412-4155-98f1-0d82c09da93b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680563, "uuid": "88ce1ca9-a9f4-4329-8d84-9bf94f70c7f0", "value": "24576:4yhj/22gFdZmceTtZyGmbGeuSVpo5FALUqcq3VtjYess:/Z22grZmcaXyGmbxMjALUqXFtx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680563, "uuid": "9d42fc0b-9ac0-4218-902e-1e357a0e8256", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680563, "uuid": "6d49ee40-fce8-455f-b9d5-8b333b64d379", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680563, "uuid": "f3383cd2-4b3f-4371-bff3-0885b59f44ba", "value": "effects468.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99a09b19-f81c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1684703723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684703723, "uuid": "29757200-35b7-450f-9ff9-a69e5e1b5bed", "comment": "Malware payload (Gh0stRAT)", "value": "98eb4c681fcefe5e1e599f98cd2b394a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684703723, "uuid": "ca9426c3-1812-4043-9122-4a9443693154", "comment": "Malware payload (Gh0stRAT)", "value": "8b4dd2d49bfe4f43deee9489d8ccd1cc4a7e199069c73e2d2e08954f85ac72c4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684703723, "uuid": "35c99998-0ecd-4ff3-8b24-606fa89ec022", "comment": "Malware payload (Gh0stRAT)", "value": "4901fb4a07637bdb2007e573dd87a199a2d6ae7a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684703723, "uuid": "b6487b8e-8e8a-4e89-a222-d3ea4b7c64d6", "comment": "Malware payload (Gh0stRAT)", "value": "f86e8e0f927c0da0ec80f589263123e3c7b838747e8eaed6615bbbc87aeb8caea78bb2e3dc725deca02e215a3a78205f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684703723, "uuid": "41a2bc18-32cb-4fc0-839c-811aecbf04af", "value": "T11AA36D11F58542FDFA69143438EA3F37DA3AA4684A4D4E8B7B1BDE510823585BB3334B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684703723, "uuid": "c26862e9-f4ec-4226-b25d-db6adf266626", "value": "665c82a44827f67961efc7d7d4176319", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684703723, "uuid": "ba4c9dfd-3551-4a12-9c4f-eff841fc659c", "value": "1536:dmMDIt+YLFNAbKUJxjo+IfeCSvQZdYcYuvfvoSCCsZMAHWy:d7uFNAbKUPEZdYfuXvoSpsZMA2y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684703723, "uuid": "832b88bb-0e01-4570-8d97-9c1c3d1766d4", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684703723, "uuid": "4aa062de-3f9c-4af7-b08d-47d8a6e2828f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684703723, "uuid": "cb09e6cd-bce9-4d2d-b11e-24c68478c13e", "value": "8b4dd2d49bfe4f43deee9489d8ccd1cc4a7e199069c73.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c052c5be-f7c7-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684667281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667281, "uuid": "029d3e51-98de-4373-aa83-fc28ccf3d03a", "comment": "Malware payload", "value": "fae853277fd9d233d8ed35e8efbac27b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667281, "uuid": "3f4307f0-b2fa-4401-926a-d5c16c3740d4", "comment": "Malware payload", "value": "8b9c8069d855d524ecfa65c0d814516dba28c5f79d8501f785f392e34ebf6d11", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667281, "uuid": "73779fa4-6820-410f-936a-42bde220406c", "comment": "Malware payload", "value": "ce20e8d6656dfab3870f354b0f75f6670c788ea5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667281, "uuid": "a00ff0ec-77c7-44a2-8963-9e51d962c9ff", "comment": "Malware payload", "value": "71ac55331efe95758732895e68153018691e9f9092fde76ccf2b503c810185370d67680e756e506a7f4acf936e82db17", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667281, "uuid": "993fe5d7-7acf-4011-a952-d450dbca5c3b", "value": "T1EC252343AFDE9461EE723B7464F340831A37FD614A74925B2340BD2A2DB23885972B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667281, "uuid": "2d30fc64-6014-4895-afdf-c56689d9a222", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667281, "uuid": "23c357ba-54cd-47fd-a718-38da94cbe1a2", "value": "24576:WyTaWl+KuqVp8arGIFEuRX8dyaWHrBje+Q:lV49qn8arRX8YrBK+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667281, "uuid": "ce6c07aa-3f84-432c-8d54-97fb46a7d328", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667281, "uuid": "15c9a1c6-5803-474a-bdde-227d9fdd3e52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667281, "uuid": "4ccd08af-c6f2-4c08-a7e1-3f84a6e4691a", "value": "client358.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81666f12-f801-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684692086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684692086, "uuid": "9e52e0f9-3606-4666-998f-a102a0d1e8a0", "comment": "Malware payload (Mirai)", "value": "380dcc93bf30d2be71d75ef3358251b0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684692086, "uuid": "9ceb700a-124e-4e8c-97a9-b0e2c5e74b17", "comment": "Malware payload (Mirai)", "value": "8bac2ce1d1df7d4f30b05c93cc6c75cc42717d224f76768b741a52885e518dc9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684692086, "uuid": "070f7f0c-16c1-4a8b-ab69-633982a4e4b4", "comment": "Malware payload (Mirai)", "value": "a76e17ca833997690afa2e6154bf0caf07527c52", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684692086, "uuid": "05941f07-b52c-428a-93a7-c049abcf3846", "comment": "Malware payload (Mirai)", "value": "a39f10fbc75ffd9b286b2ceed3b8030d0e090d3df33ed8c3655b1ed96b305d7c5eda186482b7d4511e786fcb27c43182", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684692086, "uuid": "3bbaf4d9-7128-497d-abd4-0bef72509adf", "value": "T12E534C02B318094BF9E35EB4393F17D193AEE98122E4B689790FEF459231E325585EDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684692086, "uuid": "87d3b4f5-5c37-4cc0-b82d-e6ad80f9d8d8", "value": "768:zY7ORdRpNIf+y+sUxGaaCuFMEM7L8BY8AePSFszXo9rRT35E044vCIr4kFTet7jR:fZIQxxG3jF1M7IAu0rJWx4CIEmehjqa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684692086, "uuid": "c5427227-00a6-45fc-9a8a-608f0e0d1be6", "value": 64988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684692086, "uuid": "5c19cf51-b75a-44cf-9645-2a0b57cb5c17", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684692086, "uuid": "3b9187ae-c4eb-4eb3-aa78-835b3c6205be", "value": "380dcc93bf30d2be71d75ef3358251b0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c554d611-f7ec-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684683181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683181, "uuid": "dc23d95c-5174-4bee-9368-54214ac5ec20", "comment": "Malware payload (Mirai)", "value": "542385c2064773f75a40c7360ae75d3a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683181, "uuid": "62f201ee-1998-4405-966c-a4bd033832d9", "comment": "Malware payload (Mirai)", "value": "8bbfb1fa4973638924ef433abcb349085afeeef8e833206eab829ad131a67622", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683181, "uuid": "104f8981-db83-4a7e-83ba-e2a9ceb3fb25", "comment": "Malware payload (Mirai)", "value": "9307a76d5ecf702f3384f50773182e11675c0649", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683181, "uuid": "2f0d7fa6-8fea-404c-8be2-bbcf00b43277", "comment": "Malware payload (Mirai)", "value": "2d8a47931beba85325ced54404837eae02773c8c29f5c36542f9c84205b0dee1d7a1280929f065928cd3d8034a065187", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684683181, "uuid": "65750110-ffbe-4dbb-b923-e90db46c52ae", "value": "T180E3B558A8E29E1AC9F31F7AF91F20B9DF0497DD93D7A123C81D37F0359440A689A721", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684683181, "uuid": "019aa202-3227-46ae-bd65-bc801a84b8d4", "value": "3072:aacifXFuDs5ah8dRzoiANZYUHlwl2z/18NyUvgizA+JyDgl:aacif+ThoRzoi4ZYUFwl2zt8NZ5zAeu8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684683181, "uuid": "0326fe54-ef79-42ee-8fcc-d01dfe9138cf", "value": 144616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684683181, "uuid": "c2aaa04f-bf11-4f47-999b-8ab8f7eb84cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684683181, "uuid": "630513bd-097d-4f6c-8abc-213146f3ff6b", "value": "542385c2064773f75a40c7360ae75d3a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91b5265f-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684680517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680517, "uuid": "f2123513-9663-4d10-baa6-cb10324941fd", "comment": "Malware payload (Amadey)", "value": "d059e65301339105668c75777c9c653a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680517, "uuid": "9144c80c-88f2-435a-8417-fe6ab696b1e1", "comment": "Malware payload (Amadey)", "value": "8bc40a1746cddc72b2a9b3c7bc40b87d021a83aff28992460ec3989232c98ab4", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680517, "uuid": "8031e3ea-ae12-402b-9dd3-e406d90bf0e5", "comment": "Malware payload (Amadey)", "value": "83924b8147af24aaac22d7512af89f95b6d10e1f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680517, "uuid": "0d8b09d8-eff5-4bec-86f1-307e8e1a7a93", "comment": "Malware payload (Amadey)", "value": "c1a8beeaf080c7bf17a67ff90998a8555d480e4bba74da319ee72737dc54ebe6186ab5fa6acf346ca2390b3cbb53664b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680517, "uuid": "4efc5361-b269-4cae-9f58-46114a429ebf", "value": "T1322523026AEAC572CCA423B19DF917870B31BDE04C78D3772746AC5B5C73A805972BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680517, "uuid": "46517663-7368-43a3-a3d8-c043b63c1d43", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680517, "uuid": "87a20b10-c068-4b20-b04e-344f5dc94a1c", "value": "24576:hynis241XvafGqBwaaEgeSzQUXONdiMe7Dn7I+t19P:Un7241XsGqBwmgVzQyV37IU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680517, "uuid": "7ea5e3ed-0b2a-4092-89ef-9f49d55e6157", "value": 1046016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680517, "uuid": "a89e7bc7-258a-401c-9431-e2c3001e59d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680517, "uuid": "f290b30d-2c51-45fc-aea9-ff530dac699f", "value": "backup169.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48242b20-f800-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684691561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684691561, "uuid": "3b9168a6-7837-45f2-96ce-e7fe92637199", "comment": "Malware payload", "value": "0401db4416f3f7f6bd150e55a6d9ce8b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684691561, "uuid": "75adee14-b785-4e12-a5de-256e0728ad40", "comment": "Malware payload", "value": "8be21f38b7ebf33ea996ee88c941f5b31ef043102b29c67f5927f91d0b4e807a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684691561, "uuid": "c2cacd51-970f-49bd-a16f-c470c6593725", "comment": "Malware payload", "value": "f36f10ed82a46bf5b303eeee40225a9708e05aaf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684691561, "uuid": "a0bf6669-efaf-4952-ba82-15d593a42af5", "comment": "Malware payload", "value": "78049ba522d666b5b98a26342dc56150948d32e4ca3a9c3fb4073a3da7f7b95776a3d0137bc8a658f95a119df26bfc8d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684691561, "uuid": "3981fd3d-9f73-40d4-ba61-144e97667643", "value": "T194539D76C9E85D48D0494AF07928CE74A323A104D39B2FF9D5A9C39D8883DACF1197F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684691561, "uuid": "f390574a-5921-4763-8ed6-e215ff5accb1", "value": "1536:6aYJ8w26X321tbIJ4yG/0upk3QxK0OT3CLOqCr+547:6rJ8w2s23bIiyG/0orY07LOqx47", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684691561, "uuid": "5e3256fb-a0b9-4798-ae2b-efa34491f098", "value": 62980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684691561, "uuid": "e4018143-8bfd-4330-80e5-8b2f0aea9de8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684691561, "uuid": "d6565eb8-0bed-47bd-912a-175cd1703787", "value": "0401db4416f3f7f6bd150e55a6d9ce8b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e35755df-f7d0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684671205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671205, "uuid": "89fab4b2-9f08-4b56-8930-b990e6b8869f", "comment": "Malware payload (Amadey)", "value": "e05cee8239cab01e7ab5dbb7cead2c5a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671205, "uuid": "26f28d3c-7a33-4ca3-921d-6ca1f9b7432c", "comment": "Malware payload (Amadey)", "value": "8c0bf1a477dc0ed73b1a592a8a71618d0e970b63c35cc7c61a537ed61a119b31", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671205, "uuid": "5a0d4dcc-04fd-4760-a92a-3543650d93c2", "comment": "Malware payload (Amadey)", "value": "8c9b7dba45b1727d2aa5b2e711f9d25c30e2a06d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671205, "uuid": "8849862d-c983-4742-8297-913f4805ca1f", "comment": "Malware payload (Amadey)", "value": "ee65dc24f1628b78d7257de1ee5d1171e5b25449adde878348f0acda5ce0cf1a30c43ba314d285c522e5ef573f47bf7d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671205, "uuid": "6279eac1-6ce9-4c01-ac9b-52a818b1cefb", "value": "T176252253F7DA8826EC78277044F643530F36BD90DC64877A3B46A65A2D33A104972B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671205, "uuid": "96d96599-8668-458f-acfa-124a1ab9fa55", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671205, "uuid": "aa527cdf-0365-4908-90a4-f5c02eacfaad", "value": "24576:my1im/qOWGhO0njfZzEdGaMWTC5DvGqocE:11ioqOWGhO0jfZvaMWTiDvGK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684671205, "uuid": "b8355ae6-6129-4a17-8eb3-8d0baa5e269e", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684671205, "uuid": "19386c82-fd88-4023-9818-4d3f975e6437", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671205, "uuid": "aedcaa10-2cd0-4b29-8d90-1a136b446f05", "value": "4743285.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90e94fbb-f7b1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684657753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684657753, "uuid": "0de080ea-0e1f-4297-880e-01d6b4d0e95b", "comment": "Malware payload (RedLineStealer)", "value": "daa158ea32d7e33c0fbc73da0e1e0177", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684657753, "uuid": "741bd665-df25-4c91-8a2b-7fae949abe9a", "comment": "Malware payload (RedLineStealer)", "value": "8c0c542bc27c4bdc61e08443a807495cbad9f2d854e83c746dd3cd274bb707a6", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684657753, "uuid": "beb23b0e-a763-4326-8b28-974208a76306", "comment": "Malware payload (RedLineStealer)", "value": "b3612c1065b57cf2ddb4804cbf074a5f51492e40", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684657753, "uuid": "8a169b9b-d884-4fed-b674-579d0e223f72", "comment": "Malware payload (RedLineStealer)", "value": "9923c5e4e2da20758dd67de34a446da0f77d9bcce8e255ce1e429a3406eb164be8121f868ce98cd37bed613b11a22cfe", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684657753, "uuid": "69ac7db7-4e3f-44ee-8128-ed80975e6d67", "value": "T1CE252313D7D895B3EDBA133098F606E30B31BD906D74431F3294896D5C726C8ACB6B6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684657753, "uuid": "cfc50bc3-5b50-43e1-a41f-f5c31455562a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684657753, "uuid": "344528ab-89e1-419e-8cfa-b9941eb20e82", "value": "24576:XyEiVgC2RqKP123yaxuxnO+OZwUmISwcT:iEiCdRqKP1yPZwUmISw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684657753, "uuid": "012fe90b-f253-4e0c-be80-3c7cd456e9d0", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684657753, "uuid": "e584ea77-6752-4f22-9d96-6761b66f9323", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684657753, "uuid": "b9ee45da-f1ec-41ec-9b34-297c347ff1c5", "value": "42345.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9421175-f7d0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684671135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671135, "uuid": "a6d8c35f-8cfa-4260-9ad1-2c0592da1975", "comment": "Malware payload (Amadey)", "value": "4e3d2a901e19bfffe2969e11ac573d26", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671135, "uuid": "1a7d2803-9009-48b1-8604-e3d436ae86bd", "comment": "Malware payload (Amadey)", "value": "8c77da1c4771ed7ecf6340dbb800f2c968843465f176e22936ea382fb3bbc48b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671135, "uuid": "7370ebd4-07d0-4adf-81db-3a3c8307bfc0", "comment": "Malware payload (Amadey)", "value": "3c7a4871f5bce65c0369759416800d72c1a3f9e2", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671135, "uuid": "83ea5782-9a44-41ab-afd7-e8b0e770efea", "comment": "Malware payload (Amadey)", "value": "6c7e754f1fd93aaf8aa112cb6363090a04c693a88e5f078b7d01134b2ff0f235c9fe36fa04658e83ae1322c358fb2296", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671135, "uuid": "900e790b-1fd9-4424-83e7-5268f2c0e9af", "value": "T10F252356F6E980B6FDFD1B7058F613570739FDB15E34821F6692A82A0C7329098327A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671135, "uuid": "52867b92-7779-4ea9-9252-70c7718e2eef", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671135, "uuid": "79668b4f-e569-40f1-84b8-70b873e1c2b4", "value": "24576:dy5hX4h4Ws9/BiLwZKwwGkfvRkjIF/pGz+N4Im9PjxLOEjA:4fQM3DKuSvRTF/Uz+RA7xb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684671135, "uuid": "6c6f22fa-7d55-4747-af96-299dde3a46a0", "value": 1056768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684671135, "uuid": "7d8320d6-90a2-471f-b9ac-2b8d73c15694", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671135, "uuid": "2f9c419e-799a-4a40-bb07-4c9c33457937", "value": "watcher235.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31bb4605-f790-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1684643420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684643420, "uuid": "2a77a8b4-2e25-4849-9cb3-fbcf102388ac", "comment": "Malware payload (RaccoonStealer)", "value": "e260f17fd37846b32850600c4746fb36", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684643420, "uuid": "2d90b114-148b-4720-9f28-0c22c14dc08c", "comment": "Malware payload (RaccoonStealer)", "value": "8cc4949716b82a84488f1b2129d6b8b320a40eb1c2698a2a63af64df260b3f0c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684643420, "uuid": "50af5fe6-de76-4057-b81a-79952b8816f7", "comment": "Malware payload (RaccoonStealer)", "value": "fc3a66c7f5b34ba57ba5df7540f2784facf14671", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684643420, "uuid": "bf7036d9-2134-4bf8-9eb1-38881ee0f493", "comment": "Malware payload (RaccoonStealer)", "value": "8f3791c4cf305f337f3d8555e4f099d3b4353fd1a047167b218a35b4db1e8c58117411e951c08f586fb92c0b62356457", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684643420, "uuid": "af4e7bcd-e943-4e71-b956-febaea3a8c22", "value": "T1F184AF23A2E1BC51E526BB718E2FC6EC761EB550DF497BBA12189A1F04702B1C573723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684643420, "uuid": "83488b76-1a9c-4ed2-9451-955aa0daa074", "value": "c26aa34e07553395b9f4b332479ac4dd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684643420, "uuid": "186acbc4-851b-4f3e-8e57-8e1f81befdd4", "value": "6144:fH13VLi2ZxUAr+zsTqsDtKjeKD4Qf8IEjvdmSf3i:NFG2ZT+wujeKTfCxh/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684643420, "uuid": "2df84ad7-1335-4358-b791-cb3c9494d2b7", "value": 401408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684643420, "uuid": "90fa1870-3807-4998-ba97-e59a741798ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684643420, "uuid": "39237eed-f71d-46e8-a77a-3b3b98e41713", "value": "e260f17fd37846b32850600c4746fb36.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb8b178b-f7c8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1684667783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667783, "uuid": "0e074fdf-38fc-40c7-a409-55fe939ae6c4", "comment": "Malware payload (Stop)", "value": "21f9782d9a94d0b50c647f9646179f71", "object_relation": "md5", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667783, "uuid": "1ae70e59-5288-472e-861f-555f19af9777", "comment": "Malware payload (Stop)", "value": "8cd54880215988e7d01e964c1adbfda42666c0610bc4bb491eea272c7f24d498", "object_relation": "sha256", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667783, "uuid": "ecf83953-cf51-43cf-9298-70de860d2e33", "comment": "Malware payload (Stop)", "value": "e4b0da208eef41a2bceb98ae9f10bcbe931eeda9", "object_relation": "sha1", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667783, "uuid": "b71beab4-f4f0-4c26-b6ec-d654e5374654", "comment": "Malware payload (Stop)", "value": "3b2bdf6a3dab8bf3676c8dd3e189bea8a862f76ffe6a90755a7c4e98407d8e2d5a09bb796eea69b5cc1a3c4c989d0db5", "object_relation": "sha3-384", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667783, "uuid": "66afd161-e59e-4397-a695-0b44aaf1034c", "value": "T15505E04792B3BCA9EA124A729E3EC1F8765DB5104F183BA722186F3B18711F2D5B7701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667783, "uuid": "7d6a6e32-a2ed-4794-8646-25ad25ea5268", "value": "885df6b18e739ee3563619e20c0ba91a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667783, "uuid": "22cbdd73-12b5-4478-ae30-caed3909429d", "value": "24576:zXyGxVFC+lcXJ0vdDxHGO5OtBBIdNacBkjJO:zJxbxlcX+vdDxHTyBIdNpk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667783, "uuid": "1f6fbcc0-5e21-47de-97ff-f0a961e4f0df", "value": 846336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667783, "uuid": "f1c06e64-5a76-4e2f-855c-9ee28c9e7475", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667783, "uuid": "5d2f4af9-d3ef-4a8b-942c-f135f5770e9d", "value": "editor327.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1d56d2f-f7f9-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684688758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684688758, "uuid": "fe380227-e135-4b43-a3d3-32f16ae511da", "comment": "Malware payload", "value": "900c8cb3006aa770a4a484d8eedb29e9", "object_relation": "md5", "Tag": [ { "name": "VS Code", "colour": "#A0C761", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684688758, "uuid": "03c48dac-af29-48ee-9063-8044ee39b131", "comment": "Malware payload", "value": "8db49ab9236220c0da6262ab156849b43942ea30a16cc34e9e2f9c0f10b04948", "object_relation": "sha256", "Tag": [ { "name": "VS Code", "colour": "#A0C761", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684688758, "uuid": "bbd3027c-3fa0-4ab5-b694-c82809c4ff1e", "comment": "Malware payload", "value": "60ddd2639f31f460ac4eaa22a336fa3880d9181b", "object_relation": "sha1", "Tag": [ { "name": "VS Code", "colour": "#A0C761", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684688758, "uuid": "77d7a121-5552-4f30-8784-100e1d10d82f", "comment": "Malware payload", "value": "602c58eae4ccbc8eaa7f7074a5fb505043b4fefe036b280966898f6eff94f3d21cf2d8486b306018bcf821b9125d2a4d", "object_relation": "sha3-384", "Tag": [ { "name": "VS Code", "colour": "#A0C761", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684688758, "uuid": "a2ad0722-8b2f-43db-8653-f7473eede45d", "value": "T14C8533D1FF9DEA380ED2E967E8326772D66A00E578022A7FB6CDE10D4E1C501BB91417", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684688758, "uuid": "99f478f4-f03e-46fd-bba4-b7d8fbfa1736", "value": "49152:vC1vti2z1KAQdJ7ThUGMqlvC8ROKP41ubF:v21i2zoAQdtdMe6RS41ubF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684688758, "uuid": "c1eb4f1d-48ff-4b9c-bf62-80a97d4c4832", "value": 1752243, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684688758, "uuid": "bab1eb02-71a6-4ba8-bc94-d116ea0a7da4", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684688758, "uuid": "2cfc0ed0-8899-4c55-8d8e-f73bf55eb384", "value": "NealKornet.theme-darcula-dark-1.2.14.vsix", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "916ce811-f7e5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684680087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680087, "uuid": "5affae4d-bdc0-4481-8e8c-67f1779caaa0", "comment": "Malware payload (RedLineStealer)", "value": "46e1c10f9cdc69723a284d6770c411ba", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680087, "uuid": "13574bb9-03c7-4219-85e8-13a3a36cd2df", "comment": "Malware payload (RedLineStealer)", "value": "8e2b05a71718cd217be4d42b9b3cc2917a39b80b48dec58fb7d3020446817cf3", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680087, "uuid": "5dd58602-9120-4e01-92f6-f4863d4e47b4", "comment": "Malware payload (RedLineStealer)", "value": "d5cb0a2d193c156eaf0f7571f1a38b0d75c9d53a", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680087, "uuid": "2e343503-2fa4-485d-a347-04bc96f40e31", "comment": "Malware payload (RedLineStealer)", "value": "02c982b76024c2063aea0ef9c4319ab01f4cc7ea2742fd181d3f6a747ecd3df112cdd04a63720b5e83ac9c926dd4e355", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680087, "uuid": "8fc36624-00e7-4ae9-bed4-6999baf3a026", "value": "T134252313B6CA9065C9B90BF0A9F7419306377CE14FB6936F2781A95B19632A0F43173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680087, "uuid": "ffd22c78-cfc8-4a5e-a35c-2e627b2843af", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680087, "uuid": "33e6c45f-d6d4-444b-87f3-81f46d054da5", "value": "24576:dyJ7UtpV4INAzzD143igZxUajPTQOjSJfpr:4i2IGzW3JZxUajPTQ4c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680087, "uuid": "17b77380-c107-43dc-86c4-04b6dae7ae3b", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680087, "uuid": "fd5afd1e-493b-4147-9338-4a0bf3412b52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680087, "uuid": "08e14888-e9fa-4740-89de-fecfb2006f67", "value": "listener120.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf4c9cc4-f7c7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684667279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667279, "uuid": "3a1fcbe5-038a-4f68-8497-450ed9807085", "comment": "Malware payload (RedLineStealer)", "value": "0f7d6c453ca1eb7197b9e99c9cbc1be5", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667279, "uuid": "97993374-6e47-48a2-b25b-6ea7be8a4c25", "comment": "Malware payload (RedLineStealer)", "value": "8e4e219c523af48baa71683deec9709e3e29d038e3bca4fc9a6814f5c443c4ee", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667279, "uuid": "2ed37771-7aef-4cf9-8992-135715e56842", "comment": "Malware payload (RedLineStealer)", "value": "e6345ef64850cc4566815bc17fd48555a9c89651", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667279, "uuid": "b273038f-c62b-4189-a148-5747419e47d5", "comment": "Malware payload (RedLineStealer)", "value": "9e114a148bf9d003f4fe64dddc6f75da710be64d152601537f32650741d2316a3ed7bc16be346fccc0b4f14c27b01aa2", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667279, "uuid": "aeb88598-fc97-42b8-b849-dedf475a3bab", "value": "T189252393BED44573DCB41BB008F343831A36F8F26C7586AA2B95E85B48B21A1D871777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667279, "uuid": "3e5104fe-19e8-4cdc-ac14-96a8598d0650", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667279, "uuid": "a7833006-2b29-40eb-b407-2efd0ea62514", "value": "24576:tyMKmPTLbK4tHa4zV/6UYt26zw8Nmr3ssgAl+mh:IALbfl16dc8Nmr/O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667279, "uuid": "be1eb88d-0755-4884-adac-5d65ac5d0238", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667279, "uuid": "2b04e6c1-a5bc-4893-8028-a954b70c6f60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667279, "uuid": "c7a92dcd-9b62-4e99-b336-4a5f4fb7019b", "value": "changer469.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f2e5a0b-f7f5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1684686929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686929, "uuid": "fb2adec6-197d-43c3-b580-843b7ad64e55", "comment": "Malware payload (Gafgyt)", "value": "8b3053653562ed77448dee78bd69ef8e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686929, "uuid": "080abfd8-27a6-4c31-9f53-16a593137083", "comment": "Malware payload (Gafgyt)", "value": "8e605f355a7a41cf9546294a89f179588c8d285fb57d665d719b797ea9479174", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686929, "uuid": "2622b630-f472-4531-9189-c91ab85d93a3", "comment": "Malware payload (Gafgyt)", "value": "813bb0cdf1a4e640f6718af2546d65a61ede2047", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686929, "uuid": "185a01f4-2f56-4038-bd42-1a37238d6963", "comment": "Malware payload (Gafgyt)", "value": "48b2099267a901239f3f1fa0f7c2a696f9db07c38252a62f6669fe2416e013b717ed8779ddec7c9ef887143582c7d771", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684686929, "uuid": "70fe5e12-55e0-4d0c-acb2-19bb5787730c", "value": "T1D2B30804F8448727C2D327BAF78E439D7735566457DB33116A38BEB82BC6B982E29170", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684686929, "uuid": "a320f4d6-ddac-4ea7-bd1c-2518e03408d7", "value": "3072:9lX2jKRi0ZDvCTpTv7DSubUmGVrQAXiUXouX:6j6ZUpTv7DImGVrQAXiUXouX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684686929, "uuid": "3cac5f00-c560-444e-8106-9290d168fec7", "value": 112657, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684686929, "uuid": "c284ad17-0f78-4e23-bd1d-25be6762ce51", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684686929, "uuid": "ea02e3fa-62c7-44e5-97ff-8dc4f7f1b6fd", "value": "8b3053653562ed77448dee78bd69ef8e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3e7c04b-f808-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Fabookie)", "timestamp": 1684695258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695258, "uuid": "063a780f-94e1-4b34-9fd6-c32fa6237b65", "comment": "Malware payload (Fabookie)", "value": "69525fa93fd47eb3c533afe3b1baba48", "object_relation": "md5", "Tag": [ { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695258, "uuid": "db93385e-7b9e-4a58-9bd0-5913b805f83e", "comment": "Malware payload (Fabookie)", "value": "8e9c6b72a19705e65d654814d0770a67c7c4a2e52915f6115dc740ab254ed4a9", "object_relation": "sha256", "Tag": [ { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695258, "uuid": "20d3ce4e-6774-4f48-8866-9280f6dc6060", "comment": "Malware payload (Fabookie)", "value": "3dea1b337987177c73c64e89b370d90dc94c64cb", "object_relation": "sha1", "Tag": [ { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695258, "uuid": "c9626ef8-fe49-49d1-a3e0-10a411473861", "comment": "Malware payload (Fabookie)", "value": "de52275e000cd182d457b54fd975097efb6182872249f70a977c6bbb2836186633f37d16638463e2b5dce5ef55575659", "object_relation": "sha3-384", "Tag": [ { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695258, "uuid": "42cdb534-6947-46c3-a573-2fd46688e98d", "value": "T108C1C81AF3C9867BD1768F740C738300233EF6525C27C70D25C516EAAF22778C59AAA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695258, "uuid": "b096993d-b7ed-4877-9cdc-abc22ca2fbb0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695258, "uuid": "60a62609-4802-4739-928c-e425fea1f6ad", "value": "48:6di2oYDjX9iqhf3FXfkQHjJhyPFlWa8tYDdqIYM/cphuOulavTqXSfbNtm:uNiqp3JkQHyDUtE2WcpisvNzNt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684695258, "uuid": "154d0c45-48a8-4091-be2c-d4c9dd705d9e", "value": 5632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684695258, "uuid": "69141bb4-1236-4f7b-8e3f-36856069d897", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695258, "uuid": "e7818a0c-43be-452e-97dd-e5c9bcdb6657", "value": "UI721.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06712124-f7c9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1684667828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667828, "uuid": "2142e27d-de35-4f9f-941e-a4fb6cddc233", "comment": "Malware payload (Stop)", "value": "da04b7b2be45b569d89ab8289a92ceb2", "object_relation": "md5", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667828, "uuid": "4840299d-5c26-48e9-91cf-c125b311c53d", "comment": "Malware payload (Stop)", "value": "8f07652a83851ae8be7dd1371b82dc5ef035e74954f7f0c2ed73e85fe6b554c6", "object_relation": "sha256", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667828, "uuid": "c3d2689a-9ed2-423f-87fe-74d82e6a3b1a", "comment": "Malware payload (Stop)", "value": "83b329c463d201c023e99b19b6f2b869c704a537", "object_relation": "sha1", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667828, "uuid": "21e571e1-e334-41d3-8195-c0bc5b7e8a40", "comment": "Malware payload (Stop)", "value": "afbee50b47207323d989132eec636b6059abe08a5413c88d17429887d5728d6d9f1485b7ca36e6f6ad23eac90343fd5c", "object_relation": "sha3-384", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667828, "uuid": "18eed8a9-bc37-4745-9877-1d7e9535936c", "value": "T1EC05D0026191BF65E9664F72AE1DC2F8B6EEF4518F4D2BDB62146E2B04712F2C673301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667828, "uuid": "3937cb46-cf6c-4d2f-ad47-ffff442edd76", "value": "7de32ae9ac35dca47df77c89a634ed40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667828, "uuid": "0923811c-d465-4c8d-9a27-df4914ec8359", "value": "12288:WEOpgQ53NdpVb2jcsajw0FAM73gYj+Xi/9UKuuoDjUphEpa3Ay0qzr1hPX2kUF:94P3N9b2jzyjAM73g7iKap33Ay0CzzU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667828, "uuid": "9a5a4634-5ea9-4ecf-9352-8ff745d770dc", "value": 842240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667828, "uuid": "19833d4c-85e2-45d1-8742-beaa411d001e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667828, "uuid": "8e0029c5-689d-442f-b2b2-fa8bea1fb8ac", "value": "scanner593.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee3b1f70-f7d0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684671224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671224, "uuid": "c3b977c4-e135-4e93-ade7-35763d4a05ea", "comment": "Malware payload (RedLineStealer)", "value": "9c12c5a070a6f1288cb6659e9d07429d", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671224, "uuid": "e54e85d2-202b-4fa5-a6d5-68cc9a0e80ba", "comment": "Malware payload (RedLineStealer)", "value": "8f21cf7d6410469726b93a40e2fb9eb7c8085b341b571790f3bd9cc55fab74d6", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671224, "uuid": "1cc14368-59bc-4085-bf04-cbb21fdefb21", "comment": "Malware payload (RedLineStealer)", "value": "3a92a53e55450d73525a4bdf11fddcffab5c31fd", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671224, "uuid": "a9107090-086b-4f1c-b8a8-c01fd4a12d3f", "comment": "Malware payload (RedLineStealer)", "value": "a600d80f3e1caadf2552fa8854d4fd39d5a0442bfb05c527abf7e1a2dd0d51a4a5829f0d7d0c53659573e2103fdaab32", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671224, "uuid": "e347dc64-8df9-4f1e-b090-d8379f070407", "value": "T18B252346ABC82572ED72077068FB01D31A31FC929832932A3B45956B1CB3B85E63137F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671224, "uuid": "0051e54a-5546-40c4-98e5-9d768c464327", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671224, "uuid": "86a8da10-e5cd-451a-bae3-e8ebc3ec38b8", "value": "24576:TyDTH0q7NwZqa/zz6102LBiX6oO9FxNXTpEr6oXJqR:mHH0q7NUqa/zzHGQybTpi6oXJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684671224, "uuid": "fd9db7c4-55b3-478d-910d-4c42b888f0b4", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684671224, "uuid": "fffc1c87-d5de-4538-b656-ef8e1753b55b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671224, "uuid": "abd77921-f743-4358-bb22-03737d42386a", "value": "catalog471.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75450392-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684680470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680470, "uuid": "9d914ffe-960e-4dc2-8905-b48c2b545148", "comment": "Malware payload (Amadey)", "value": "18c48dac08a570bf0b7a50be4a309959", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680470, "uuid": "dda98130-480d-4c37-ad30-3a58272b8c20", "comment": "Malware payload (Amadey)", "value": "8f522003d390a3c050386ddd6441381e5be45c79a18b3c90d7920fbb40d6a653", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680470, "uuid": "7f495a01-7f0e-4756-a2ef-c070a37b37fe", "comment": "Malware payload (Amadey)", "value": "fbd04551ed74b704bf0b22343fd7c952f735c92e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680470, "uuid": "4301b69f-59cd-412c-992a-e248b81db630", "comment": "Malware payload (Amadey)", "value": "aae4745a0c59b36b66d282ab1c1cf853f49bc0f3a4bcc3fd95bb4ab77fbf3af8511ddc3d18e1ddda273103e1f184a6d9", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680470, "uuid": "e474a8fa-64f3-4601-a7ff-a27fb1e2cdfe", "value": "T18D2523236AD84473D4391772E8F513431B32FDA19671C33B27169E9B2CB3941AA327B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680470, "uuid": "ba85a4af-47e0-473e-bb7a-e67c05ee45a1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680470, "uuid": "cf998997-b2ed-44bb-89bd-2c33714246e2", "value": "24576:ayh9E9AVO/tWwSqBt8khx1NKrURs6HSTzoNrgi:hhC9F9SqBK2x1IARs6HSTzG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680470, "uuid": "f424fdb7-779b-453e-8a04-d984d9f16166", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680470, "uuid": "67ed330e-e59e-479a-bb4a-a20bb5fb1d8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680470, "uuid": "b63f5719-6ab0-4db2-8793-9b2dc2e54407", "value": "4743172.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e138256-f7e4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684679464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684679464, "uuid": "0a91a721-d43b-42cb-a10b-526cb950774a", "comment": "Malware payload (RedLineStealer)", "value": "9d340ec1fdbb7a4d0656ec92bcd34f0d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684679464, "uuid": "eb187ad5-df21-493d-b488-4dfa3b21fe84", "comment": "Malware payload (RedLineStealer)", "value": "8f6aa2a9a8cf9ffba7d970c5963cdf559b820075169aa623dd3ca1069d475e24", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684679464, "uuid": "a3eb11d9-4570-4b12-ad34-4c561528d4bd", "comment": "Malware payload (RedLineStealer)", "value": "dba34d192055271a5b149b10ced068aa884f10ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684679464, "uuid": "10cefa72-7c4a-432b-b27d-86d1bcdeac7c", "comment": "Malware payload (RedLineStealer)", "value": "0866922fdced0c7980a9d0d083a0a053cb7e592fa0b40b7bbe9bc27857e17f9c78196c84476b0165603496988a59f715", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684679464, "uuid": "d4829fb3-9888-448e-9116-1bb5660e0b87", "value": "T166647C3366468036EC2B56B842C59AA945EC74701FAF40E7EFF49FDE4D90AD06A3170B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684679464, "uuid": "4596fbfa-ae50-4c51-b97f-f9a5a18474a0", "value": "b46b7655f5ed701dbc7075afa681ec5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684679464, "uuid": "b007bf94-6c5e-4e48-9cd7-7a515aac0a41", "value": "6144:mtHTo6IHQy/mxpFQ2tBVTDEIaOlEQi+o66coZzTz4QQMJeQ2rg9HkI:ezo6IHaxpFQY/ax96xo54cMdS3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684679464, "uuid": "091069bd-9852-4b46-8918-1a76995b6e1c", "value": 310544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684679464, "uuid": "150e7726-648b-4b40-b3af-069347022366", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684679464, "uuid": "2cc2d4e0-5e68-422e-b4de-cb1ae1f11902", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcaf7959-f7c7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684667275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667275, "uuid": "79ca2723-047f-483f-b681-03fe58e80b4f", "comment": "Malware payload (Amadey)", "value": "6ca06ab0cafacb7aa1f6534c59a51fbc", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667275, "uuid": "e05687cd-b880-441a-8ecb-e0a114ea555f", "comment": "Malware payload (Amadey)", "value": "8f78ff8bbb6a47cd85706aaced9020c9182e84c17241a9f124779aa0ae510e92", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667275, "uuid": "5cdb1e47-4efa-48e8-9454-ca020a762d16", "comment": "Malware payload (Amadey)", "value": "5efb697aec8b209f809f5842c4b8a934ca2cedd4", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667275, "uuid": "36be2236-16d0-403e-8ce9-f417a9831bcc", "comment": "Malware payload (Amadey)", "value": "95182adef1b40be50f956c41f7bfdc712da2ca71d496c345a8b6f4118a25848a2454a9512239cd21e6ee17f377096edc", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667275, "uuid": "b6041ee8-0978-4512-9cae-820f7ff2ecf1", "value": "T139252352F6C89073D8B9573058F60AC71B327CE65568C2AE52866C5A0873EB0E932B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667275, "uuid": "9e6e0040-6b8d-4fd8-b8c1-9b19687b75c6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667275, "uuid": "fdcb6f7b-2437-4d1f-89b5-f3ab4aab1b56", "value": "24576:cyvREYTHFe4LBHvHwNMQBGe6l4t9SqFJF:L5NTFZtpve6+X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667275, "uuid": "654cfd81-f8ba-4863-9225-ac2233876dcd", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667275, "uuid": "042de9a6-dfb7-4591-ab36-633c4bfbd65c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667275, "uuid": "bcb917e8-44fb-4246-8285-9bacba4a2e75", "value": "calculator962.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34a435eb-f770-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684629680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684629680, "uuid": "e2763dd7-a5e1-47a1-8dc7-a992c0a8a55b", "comment": "Malware payload", "value": "a8885cfa2dbe0a585dd077d09b614bc9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684629680, "uuid": "289702cf-b2ea-47a8-852c-e335e27a1860", "comment": "Malware payload", "value": "8fe68aa249013e9dab2f77200a056617ef65c20df93fa5e1a298682f6c5764e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684629680, "uuid": "2e197a1f-0747-42f5-85cf-11c86a5e6d12", "comment": "Malware payload", "value": "5899daaab76fe3dc0f630e02db85717a4dd3d228", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684629680, "uuid": "501bc3f9-f1ce-4e88-be50-b08f4c95bec7", "comment": "Malware payload", "value": "69bb8d7a20fae5dc7eaf880c11e266feecd941105d15b66ec3fa018f28d9076ff557aebdbdf086aea58bd2e34d0a0d94", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684629680, "uuid": "d0f9de4d-90e0-4544-8e0f-3ddc4fec2593", "value": "T1BC252206EBE88457E9AC377098F757C31A313CE15634D66A3316685E0C73A84BA31B9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684629680, "uuid": "91459578-6b49-4a29-b974-b419f45686b3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684629680, "uuid": "230b4b26-4f44-47ca-93fb-43850abb1187", "value": "24576:vyuv1GBLn8hq+i0NRlISmAufhkLTKKKNs:6WO8FNReAuZkLTKK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684629680, "uuid": "2baf5239-6294-4d4d-b6bb-0bc8f3b3554b", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684629680, "uuid": "c4fbbd4c-ff5b-4ae7-9d9e-05b1714ca275", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684629680, "uuid": "1632d3b6-bd9c-4acc-ab7e-5f141a054a30", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41872ec0-f7b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684658478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658478, "uuid": "81b3b344-f3ff-41b1-a643-a5c9ccb40801", "comment": "Malware payload (RedLineStealer)", "value": "7e148bc866fd91b339be35b1657ec09f", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658478, "uuid": "22fd6a36-4bd4-401a-8ef6-f29b7debd67f", "comment": "Malware payload (RedLineStealer)", "value": "90082f2488d59759b0471e9f4b0f5df72466dcb8bed29a9939a33cb6defe9192", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658478, "uuid": "8da3895a-89e4-41e6-9f45-4a16a2ff2ada", "comment": "Malware payload (RedLineStealer)", "value": "2c81f967144b8ef1a3aa083fa3890eb4be0897aa", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658478, "uuid": "1e49d2e3-cfde-43e6-aa55-3dc93f1483a8", "comment": "Malware payload (RedLineStealer)", "value": "9897b5c715a3576862d6273e2c26242ce779cfecbb0ba9753b6e74938dc7906635726ca9f0454ffe003e8cc7f7814993", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658478, "uuid": "f636b969-832e-4e56-86bd-d725d63e5077", "value": "T1E484C022B2D1E872E5554E31CD2AC6F8662EB861BF1516CB3374EF6F18301E2D63A741", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658478, "uuid": "cc78f32e-9ebe-4d0a-9107-c105328d0bd5", "value": "bb27c4958c76443fcfe46f9765d838a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658478, "uuid": "f916dfd8-3638-42b3-a21b-ac2e141fb5eb", "value": "6144:HHONY2iG2CW1VVCzGBU69fOEjCuiZ1CUZc7smRkTTH:HSYo2H4GR9fJCu41CGakH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684658478, "uuid": "9aa2c7f8-6592-4705-81d6-e27f62b7842e", "value": 390144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684658478, "uuid": "47cdbff5-6aa2-4a57-bebf-e334ed9e6624", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658478, "uuid": "2b54c5fc-46d6-4c65-b4d0-a287ff474ddf", "value": "renderer771.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7681b20b-f808-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1684695074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695074, "uuid": "a34ce303-fac4-4172-8075-0431f109d447", "comment": "Malware payload (Stop)", "value": "66e218f922ad408361198ffcfb953715", "object_relation": "md5", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695074, "uuid": "081b9227-6d44-4c83-b013-21313cea11f6", "comment": "Malware payload (Stop)", "value": "90ae3d6de1cdc5120a1bfaeeb558fac4905466a28bb4fc56673cade24859f7fa", "object_relation": "sha256", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695074, "uuid": "ac54093d-7d87-4aac-950e-d384a719c06b", "comment": "Malware payload (Stop)", "value": "7ac17fd93d4476ddeeebd67c4a5cae4a8399f7cf", "object_relation": "sha1", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695074, "uuid": "6dc22f64-0e38-4aa1-ac18-9b23010719ee", "comment": "Malware payload (Stop)", "value": "695cdd3f7ba0079e7d6cb71bd6bf57c57ff1cb1c4dc395676db5f14c2f603d0a5dc1d278d87965ff687afd88efc68c32", "object_relation": "sha3-384", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695074, "uuid": "f5d74e70-5c7f-406f-a2eb-ddd2130fb5cd", "value": "T16605E01362E2FF61E51586724E2EC2F82ADEBD619F093B9722196B2F44711B3C673341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695074, "uuid": "52fd8cb0-74ec-4d28-8f37-8a76e64d14b6", "value": "40be65705a95a43e6733e98c1ce5e92b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695074, "uuid": "7103bd27-0e0f-4c94-ba95-e46e1ac98c92", "value": "12288:sZMGg7poZZweYnLYYaKivGYuxZ+vv2yA6+OvbNYriW1IeyL7:sJg7ur2LYtNwxZ+vq6+CbNYOWDyL7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684695074, "uuid": "e4512361-674d-4ef9-b62c-26f4c175ef26", "value": 832512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684695074, "uuid": "fdc0eb84-cd97-468e-9fd1-2d8ae8324dfb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695074, "uuid": "2f2c0431-82bf-4238-bbd9-b2e7b480b85a", "value": "registry622.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc127d01-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684680588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680588, "uuid": "dc066186-24bc-4f86-bf37-9f17d96fd3bc", "comment": "Malware payload (RedLineStealer)", "value": "187675a06df3f395accd21d5cc0e6da0", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680588, "uuid": "ac7d0277-c27c-416b-83e1-68370766fe9b", "comment": "Malware payload (RedLineStealer)", "value": "9161b52b2789708e9ce349ca3db1b5fb4183a945b1b71a883629f2e02642a15a", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680588, "uuid": "b03e075a-f736-4f1d-9cfa-81cc258ce23c", "comment": "Malware payload (RedLineStealer)", "value": "ec75e26b15939adcc0907cdb52907a201c27a840", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680588, "uuid": "64ff481b-1f65-4cfb-82f4-7eb56da4a53d", "comment": "Malware payload (RedLineStealer)", "value": "b25a67db7efb556f6984935ec1ce4857b38d4313fc6ddee23e426d1eb5cb9ba7500cac8a8f2493485c26b67ab99e03fe", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680588, "uuid": "ccf309cb-fd05-4a27-884f-774a85be603a", "value": "T195252323C7E55023FEB9277068F202470A357CE06D64C64A27C6686E1DB3AE46D3677A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680588, "uuid": "f76d995b-7288-4097-9d2c-6eafb9617e82", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680588, "uuid": "a2ed37d5-5581-4350-a074-b1442c218852", "value": "24576:Wy7Fv4jnr4YWAGZNN7TFuhKnK10WBezHD7vYxZkVQQLfaVE:l54jnUYnGZNN7TIKnK10WEjLmQ7a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680588, "uuid": "b649a4fa-5216-4ec6-85b4-d014a8387140", "value": 1047040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680588, "uuid": "3cc46ded-aed4-4982-81ef-0bb5065635d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680588, "uuid": "7f2da36a-6f5f-40e2-b4cb-851ffa576d2a", "value": "installer399.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3239b1df-f7b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684658453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658453, "uuid": "b4754db4-24cf-4f10-95f1-ce130dc04b1e", "comment": "Malware payload (RedLineStealer)", "value": "8f5337994e643b91a829665ba56f5b34", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658453, "uuid": "0ca22f58-561d-4da8-8f47-e464d22e2f44", "comment": "Malware payload (RedLineStealer)", "value": "91627566af481fb26635669ba9f6bdfcdfc2b2b0c85892f7b0c260d33cfc8cb6", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658453, "uuid": "ebadc304-38b5-45e2-bbe4-ae430902f2e7", "comment": "Malware payload (RedLineStealer)", "value": "4456e5e19420210d410ee92daefa783047d3b993", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658453, "uuid": "95bfdee9-6094-4674-b839-506534ab77f4", "comment": "Malware payload (RedLineStealer)", "value": "c0b36f9b0dc51e9a0a9d0819fd5ff84ec1c5e7f69041aff0eb464af84995d30fe5208606c96dedb93c8cca3968cf9faf", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658453, "uuid": "b7ee2953-5e87-4520-bfcd-f9250e0748e3", "value": "T1ED252312E7D48072CD7617B568F24AC70A36BCE0DE78926F3A42A46E9D72584D67033F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658453, "uuid": "aa04c92d-4b6a-46d6-a9a5-7d0c3bd5f33c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658453, "uuid": "bc575be5-0655-449f-961e-2e2db94dd45a", "value": "24576:Py6X8JSDR6qd24cqDeJ/bRNtDhO94nWlYGN4T2a4+LOI5Wsm2/:aAc5dqDeJ/bVij9s2Lb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684658453, "uuid": "ba52638a-687a-45c6-8460-6365d7867453", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684658453, "uuid": "423e2bc3-6481-445c-8aed-c5064a5493e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658453, "uuid": "bff8bfc3-8c13-4e8d-9009-2e19e55dbe23", "value": "invonce157.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "723211cc-f771-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684630213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684630213, "uuid": "0562e14e-dc81-44d0-a7f4-1f48c9791406", "comment": "Malware payload (Amadey)", "value": "c320d8def78fa0577256986f9bb81177", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684630213, "uuid": "02bd3a91-8824-49f7-af98-9d84bbe1dea7", "comment": "Malware payload (Amadey)", "value": "9192489339ea4a463488952864e652068c50c2bfd93ec252ac9155e74181bf95", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684630213, "uuid": "ab13e258-916b-475a-8c77-acdc968e0024", "comment": "Malware payload (Amadey)", "value": "0228e42dff292b11d170d418db8eff016564b201", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684630213, "uuid": "af7b1ff7-322c-4a23-884d-35ac2977d96d", "comment": "Malware payload (Amadey)", "value": "3bd4ad4c9fa0c5e6b4c3f22398a03191707d4c66bbb00fcfe753342f0aa6cbeeb1a1aa671f5033bf7b716be1e1bfc1b8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684630213, "uuid": "9742be01-e351-4ecc-ab3a-215396fc4a9c", "value": "T1B1252313A6D99066D9B21B7458FB0BC70F32FC705EB042177606AD791873AC46BB2B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684630213, "uuid": "a2a7540a-f9df-4611-b16b-4c2dbdce9fb2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684630213, "uuid": "8465d40c-6149-4142-a587-c5471da4ff72", "value": "24576:PyRMAshC4thHgm/qNGtmMXeRJIE1LsRgXtinulWVyY/:aBurHgm/qw8pRJIELVXtVm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684630213, "uuid": "964bf49f-650e-42e6-9463-4f493040208e", "value": 1046528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684630213, "uuid": "7710bfe0-f094-43a8-9e20-b3acee9b0bc5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684630213, "uuid": "84276d50-707a-4454-9d10-ab5e390b2a34", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "450886f0-f7c1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684664497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684664497, "uuid": "ec920ce7-a20b-4bf8-9a33-81b27aaa29ae", "comment": "Malware payload (Amadey)", "value": "23276c30da32c53bf7590430229af1ba", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684664497, "uuid": "cca1afbf-baf4-4f61-a7f6-3b6b9e481c0b", "comment": "Malware payload (Amadey)", "value": "919504138b778539b9744c620a6a134ad685a0d7aa8eda719930b80c56798349", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684664497, "uuid": "5a3cff3f-67d5-43fe-9e4c-dbc334ac7d25", "comment": "Malware payload (Amadey)", "value": "3640076f68e95021dea075166e943fa9c555c96b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684664497, "uuid": "f33d011e-7937-4b03-beee-08a3edbf30ce", "comment": "Malware payload (Amadey)", "value": "8ed722eb796d99c50678777d6892714a77ecf4aa6f8e326f5c21cc78b21bbc20256a3848f03d76c7b4c8874f869d632f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684664497, "uuid": "90c06088-eeab-48cc-8577-088ef3742fe8", "value": "T163252303BBD801BACCB69B3598F513931730FCF69235966F27545A2B2DB2941A47233B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684664497, "uuid": "2af16135-159c-4c9b-a5dd-6a309fc7953b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684664497, "uuid": "6189b87b-d820-4a7c-9473-dbe73ac0257c", "value": "24576:DyK+RD59eqi4HVxRqwEm1r2QlFHAwQFM2r4wv7:WbRDq4HVxRqwEm1rh1AZM0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684664497, "uuid": "e9c96999-26dc-4e8c-8561-e41039fe0a65", "value": 1044992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684664497, "uuid": "d5b60df6-3ca2-4c78-b043-3bcebf32b4ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684664497, "uuid": "4e85c28a-1375-4ac1-a3d9-5fa1dc2cbba8", "value": "23276c30da32c53bf7590430229af1ba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35b685cc-f7b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684658459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658459, "uuid": "dece498a-c7e1-44d9-87e4-7de3447613e4", "comment": "Malware payload (RedLineStealer)", "value": "b828ef556edbd1643fbb7cb3d638bd32", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658459, "uuid": "05c02143-fc6b-495c-9c40-ca837da1b58f", "comment": "Malware payload (RedLineStealer)", "value": "919fc572fe5f394c6616d4f791cb7757ddcdb23bd5d99a24a823f89868726a3a", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658459, "uuid": "183e266c-d74a-4c88-80b0-231fdb2e9dc8", "comment": "Malware payload (RedLineStealer)", "value": "baa2d7915f1ec69747e8a723e6f8b070f504932b", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658459, "uuid": "1ea45671-a768-4377-83b7-ede533413982", "comment": "Malware payload (RedLineStealer)", "value": "6dd0d9cde3fb6a2d0e7a07de2c6cbe735ddd6023c9e47a28a3b94b360e011b53bcd65b0079791bd83f8e74f119233470", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658459, "uuid": "5144fd91-0b6e-4770-aa6b-35e992306555", "value": "T1B825232799C9613BEDB32B7058F347C30B39BD6106B447ABB255EC4A0CB3280A835767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658459, "uuid": "76f829c0-beca-46ac-a00d-f672b584d962", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658459, "uuid": "2a656fdb-18bf-419b-a581-dc5a22e59f03", "value": "24576:ty8Yk+XM1mTugZ6MqrZzs+6mZuhQ238eN/glb+A7TXQjKJn0d:I6+Xs+u9MqrZt6mUz8c4lbn7TgjK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684658459, "uuid": "e42bd11a-fb5b-4a56-b275-22fe618e66e2", "value": 1056256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684658459, "uuid": "67354503-7b0a-4494-a64f-a626d3599d1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658459, "uuid": "705180b3-d8a4-4f7f-b0a9-de2dadefdaf3", "value": "monitor793.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b57f495-f770-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684629745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684629745, "uuid": "a92e0ec6-34cb-4cb2-b8b4-7f6c7ef3e6dc", "comment": "Malware payload (Amadey)", "value": "5527222452b0ac4a46e0487c5b65c91d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684629745, "uuid": "eac4668c-7173-45c8-9d95-81568846f863", "comment": "Malware payload (Amadey)", "value": "920ddb7075453c4804500c97ca35188411d0a5c468e8eeb5107ca84d745a4f8a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684629745, "uuid": "29a8b31c-c515-4d61-bbb1-830a7a8145f4", "comment": "Malware payload (Amadey)", "value": "dc91dbd5eed2494ec30f9ec3aca86a94f7e863be", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684629745, "uuid": "33dac45c-4007-4362-a74b-7f420bae76f5", "comment": "Malware payload (Amadey)", "value": "7c5277742b047464d3b170a573a32e0d6dc6e78c1b827224f74eace3c9fb40fc046ea43a6a53a31a3bd71b6959d38fc2", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684629745, "uuid": "5ab2c0ba-4408-4f6d-a8bd-758f29d3a3ed", "value": "T11C252301AEE980F7E8E53F70A8F717431B31B9E24D78475B2305A82B5C72589E97172B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684629745, "uuid": "6e79c649-d014-4c00-9f6b-fe4d3cc85368", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684629745, "uuid": "9f9ed7af-a300-4009-aae5-7419efe075b7", "value": "12288:QMrby90Ax460JRxgJH6eJjhRqBorKqg51pSOV27A66+72q1lJQ8aULrNqZSDN:by526rHLj7qiU1pnVwfIiJFa0NqZSDN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684629745, "uuid": "61230f23-cb57-4c8b-97ec-3458031604cf", "value": 1046528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684629745, "uuid": "1b4bd2a7-e2e0-4e77-b408-cfb865bbefe1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684629745, "uuid": "8bf377b5-1d4f-4303-b09e-212160ad1b68", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "027c20c1-f7c9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1684667822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667822, "uuid": "8507866f-926d-41d9-9a39-c2aea93e05c3", "comment": "Malware payload (Stop)", "value": "8b612d0e37e93dda55287036b20850e3", "object_relation": "md5", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667822, "uuid": "227cee74-100c-410f-a2f0-26cff7c693de", "comment": "Malware payload (Stop)", "value": "9247472f015c0e1b814196278542f3b96c9d7850d67394240e3e4b0ce0a2cc10", "object_relation": "sha256", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667822, "uuid": "3cf182d1-44e1-4dd4-b2fb-4e07022cab67", "comment": "Malware payload (Stop)", "value": "8a03486f49536d43aac325e00331cacc581fa9de", "object_relation": "sha1", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667822, "uuid": "5c737ed7-9b9b-4571-8860-95aba3f66c48", "comment": "Malware payload (Stop)", "value": "1b9663d9b9adcdd5d8ca38977397ba219c8c0e58fca39ec9c11d0b791be1b062b773c57711659f3dda319197703ec0d1", "object_relation": "sha3-384", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667822, "uuid": "836cd72c-8d44-4217-9b25-24c1a3b45c23", "value": "T15505D04392A3FC69E52546764E3EC2F8761EB9518F096BDB22086F3F48701B2D6B7341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667822, "uuid": "8ace506a-f9a1-4689-b992-d65547fb340f", "value": "dc368f441a884fce22ecc585e2bd5326", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667822, "uuid": "7814ff64-434b-4125-a160-784fd17a1d87", "value": "12288:IKVgzjHonmETS4oX3NduKY5U4CR5zmOvz185PDt0Tj6s:IKC3HobS4oX9ds5U95zp1yPDCT+s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667822, "uuid": "0fe1ca00-0642-4c17-8c2f-2bb1be6c3155", "value": 839680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667822, "uuid": "f51dac83-a731-48d5-a181-8ae30636e038", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667822, "uuid": "26ff4449-a4df-4d1f-a686-a534a139b292", "value": "renderer755.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f58a36a-f7ff-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684691278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684691278, "uuid": "cbfe9bcb-d5cb-4133-97d2-8960a6196f25", "comment": "Malware payload (RedLineStealer)", "value": "1606cdab6219d4418a87efb260bbb5b9", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684691278, "uuid": "e882306e-ff68-4e88-a7e6-ea972a14f78c", "comment": "Malware payload (RedLineStealer)", "value": "92680ce899f7ca11a1d25c5bf273781e378809652e7a805a73d7e8ace50a86ab", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684691278, "uuid": "b8935a89-180d-4be9-b748-cbf12e9e440a", "comment": "Malware payload (RedLineStealer)", "value": "9be8f8b3d4b91706bdcec97c54c127284ebc67f5", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684691278, "uuid": "fcc5acd8-7d26-46c7-9fee-1dafe965e4fd", "comment": "Malware payload (RedLineStealer)", "value": "335f8d01a8beccb526a7bcc9c9cf2a4bd0cac80a5926599b162efade8fa287bd32294038dcad460cf9a5dc83a0cea8c8", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684691278, "uuid": "2f16c4e3-b7d0-44d4-a482-62614d434ebe", "value": "T1DD252305EFD850B2DAF157729CF603970B34BCE28879826657A56EE71C73681B43036B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684691278, "uuid": "23834f1e-98b2-4a9d-a757-159e835ea039", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684691278, "uuid": "48bac440-8458-41ec-96b7-dc675e4860af", "value": "24576:Aynbp5m/hQszL0W4cE/QtYxYNggFy2TYJYqQoY+QeN:Hbp0xP/H8Q9y2TYAoj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684691278, "uuid": "0c2667db-c55f-4366-88cd-38d07ced850e", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684691278, "uuid": "b5e642f7-48b8-457a-b4a3-dc39a5ad2e84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684691278, "uuid": "cb0ad095-c104-44b7-9fbb-bf04bc908a65", "value": "resolver863.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e29abf6-f7c5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684666257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666257, "uuid": "7c6a8b90-f69e-4913-9360-2934139d2104", "comment": "Malware payload (RedLineStealer)", "value": "be714a2a57af86500ec25a524f2e8a97", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666257, "uuid": "88786b63-48ed-4574-9623-e94b3ab07fbb", "comment": "Malware payload (RedLineStealer)", "value": "93f55a8067106355e8fab8004935f3bba5a8397830cf2adac6fe5cb06e6a233d", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666257, "uuid": "26fc451f-4f5a-4fe4-bffa-6970ca60d644", "comment": "Malware payload (RedLineStealer)", "value": "aa0432c7cd77dd7b90ef15bf4eb346a603798394", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666257, "uuid": "fb54f3cd-cb28-4478-af92-9dae66241157", "comment": "Malware payload (RedLineStealer)", "value": "f4a2d54babaf96564979957b846d073689b5034ce8c7dbfa2b27b1c539c8dc67448a2cdfa9e05b86fe40195f9b8fbaa4", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666257, "uuid": "4fb655dd-5e90-46b0-aaea-42c2f362cf47", "value": "T190252306D3D8C6B1E8A22B7054F607931B31BDA98BB5876F338679365D33B0521317AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666257, "uuid": "e674ac37-fe5d-4c2d-a85a-007dac08aa5c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666257, "uuid": "c6518018-5fcc-4cae-8fec-4d75e796d323", "value": "24576:SybeAfxyR8kOYCLqwGMR38bPhE3gA2xiHQnxLFmg:5bekxyR8RYCLqwXR38WwxiHQBF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684666257, "uuid": "25c9a282-3884-459c-b3f5-1c90c591cf0d", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684666257, "uuid": "ec7511b6-c45e-4d2e-9d0e-e35d76a5467c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666257, "uuid": "7aa4a613-cd1c-4a7b-b668-2b4edb9e2ae1", "value": "245245254828.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fed753ad-f7d0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684671251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671251, "uuid": "eba2889b-935f-4ddf-b3a9-78f7239479d8", "comment": "Malware payload (Amadey)", "value": "0ab527629a4a3647a357b53cf2f24519", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671251, "uuid": "90f58186-c6c7-4874-8f00-ea7cd768ddfd", "comment": "Malware payload (Amadey)", "value": "93fa3bc7957f21b3392fcc38ab1890423a629dce4df4bb7c9b062890f769e04d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671251, "uuid": "41e115f2-9a62-44e7-a8b5-bc69d35b6f5d", "comment": "Malware payload (Amadey)", "value": "3c09565002a399a750e3fe12073965bfc6e91bd3", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671251, "uuid": "c57a543d-7cb2-4fda-827a-bbcaffa3ca1d", "comment": "Malware payload (Amadey)", "value": "17f987e527f4f32e1e769c483da4da4263e187a810e6779e27e76b10d82082dc76db3e4506adc172e64f4f8d770ce44c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671251, "uuid": "765818ea-8ab0-46d7-b119-e2ea8009db6d", "value": "T14E25231596E85433F8B517719CFB17A30C3A7C1699B822AB3382E14B0C725C5FA7636B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671251, "uuid": "d7e2dd90-038f-44d1-beec-efb4b3e32837", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671251, "uuid": "4f9e61c5-f2ea-44c1-8658-c8564aa28918", "value": "24576:vyaGT9Daw6xXmKbrQHxDbVJZUTiYN99+:6j9Da9NrQHjii2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684671251, "uuid": "e91c11a1-a16b-49cd-8431-40749a520063", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684671251, "uuid": "5ca30aea-6381-407c-ad3d-3ce573144170", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671251, "uuid": "2b8990dc-a98c-4562-a3d7-221bb420303b", "value": "renderer283.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee4c5e64-f808-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684695275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695275, "uuid": "b442b887-4b48-489b-a176-88b4953708d8", "comment": "Malware payload (RedLineStealer)", "value": "f82af12d2fd7ca46515961b1c1ad31b0", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695275, "uuid": "9e17cbd1-9336-4317-9668-fdd598f493f4", "comment": "Malware payload (RedLineStealer)", "value": "949cfdbfc3f8d49e49d040c1992be93fd06556fe998925fa2e83ddbeff73d633", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695275, "uuid": "b4b0d338-e607-457c-befb-a81f4ad5cec4", "comment": "Malware payload (RedLineStealer)", "value": "63a94de12d89158871c52299acbf28d4807285cc", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695275, "uuid": "73a34bff-c679-4c5b-b118-01cd9c8fd619", "comment": "Malware payload (RedLineStealer)", "value": "208548d09b3f84b36a4cdd83c0fa8dbcf991a8023905eca89492593e4320602640b74af4a4cc4fdce92617e6922667d1", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695275, "uuid": "41013449-8a56-4d0e-bb5e-4366e21a06f0", "value": "T19F2523039BDD4872ECF0177548FB02631A32BCE1AA65879F2741958A0C72BA169717FF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695275, "uuid": "89a73840-53a7-4ec0-b285-4429e67dfb06", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695275, "uuid": "4f23d65b-936f-4aea-ba89-06d085755c2b", "value": "24576:EyhOKlIs1eJGa1ALaKxEd3QvwO6ojjno2S:ThGjihIio2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684695275, "uuid": "75dd020b-d3da-4111-8113-b5da3e220f96", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684695275, "uuid": "0f6c701b-5ffa-49c4-820a-13f37a69ae9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695275, "uuid": "7d4044c7-f1a7-46eb-b5c8-01bb3e0117a9", "value": "catalog643.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df1a0255-f7d0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684671198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671198, "uuid": "f0695806-3322-4938-9caf-d39a6c753bb2", "comment": "Malware payload (Amadey)", "value": "981c32a745ea7656e6f19cc6f2039f41", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671198, "uuid": "50af01d9-801d-411b-8250-ecbc2c0ec53d", "comment": "Malware payload (Amadey)", "value": "96182078ec26f025b310009765701ddd5fc07410b4e454128e3bc79464af824e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671198, "uuid": "53e72d6d-92c5-427c-b19e-b8bbd27a3ec2", "comment": "Malware payload (Amadey)", "value": "5efaca337ee23b26bdf54951d9cb9ee7bf6f5710", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671198, "uuid": "3564a2ff-a70e-401a-b0f9-860da129824c", "comment": "Malware payload (Amadey)", "value": "965f1dca035cd516a9a905f4b407d06965b4acf2c4d1767601227b289bcc00361c35112caffa1574112a7bb888b21a9e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671198, "uuid": "2a734c6f-7959-4f53-a0e0-d0a432676d8f", "value": "T1D0252303F7E9E032D5B23B7124F747831732BEE286A515862A11AD6E5C73A80AD31777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671198, "uuid": "cf98d443-e822-4de8-a39e-5787ad320a23", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671198, "uuid": "62716cef-5ce5-48d8-a937-8de1b30fe4e4", "value": "24576:GyZjabBozQH0r0qDO7iTrGuGf4vJHBrEbUngz8ELtvNolv:VZ+9PH0r0qSOTCunJhDng9Wl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684671198, "uuid": "4b64343e-69d1-48a7-943f-d809d7b85030", "value": 1047040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684671198, "uuid": "e27bed52-39ea-402d-9c06-68251c41bce8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671198, "uuid": "04866c48-8c30-4d13-9eac-d1f4031faf3f", "value": "248990s972.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "776651a9-f7b1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684657710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684657710, "uuid": "535dfb15-3ae9-4298-b1a8-e68c421cf570", "comment": "Malware payload (RedLineStealer)", "value": "e27efde9cd029b5356a0d6c7dc1d23d3", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684657710, "uuid": "e36b6409-bc97-4d97-9774-eebc53999651", "comment": "Malware payload (RedLineStealer)", "value": "96431e057072ce668c0f1574978faa0ca53ac8f998539cf790c6e9a82b0e78db", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684657710, "uuid": "7405d501-8ac4-4c8d-ae9a-e6c74a9f7fd2", "comment": "Malware payload (RedLineStealer)", "value": "250d004b3a7d29d682d201679e0e30ef28a4d9fd", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684657710, "uuid": "646d850e-f3c5-4bcd-8e14-7a458b9f2fc6", "comment": "Malware payload (RedLineStealer)", "value": "980c03340ce88b97bff879a9600cefaba8f26ea1d507623f610c193c60902cd1bf138e90e2c75bf3cfea215ef7a42024", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684657710, "uuid": "0860f7a0-a530-4d77-9952-b2388fd35980", "value": "T1862522639AEC58B3EDB1477028FB01530B3BBDA09D74C6A723A1995508B25C8B5313BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684657710, "uuid": "f0f641d7-856f-48e7-9bd5-4cdc823aa9f6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684657710, "uuid": "305567d1-a048-4b07-bf91-3b453fcc69bc", "value": "24576:jyaJnofu7Gh+zTSQShXu02kInZPexPTXyQG2JVs:2aR8u7JSzFokIZGBTCQGe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684657710, "uuid": "398bf9ca-14ce-4bab-9922-7aeeec8b3787", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684657710, "uuid": "2a20e181-53b6-4b14-9f02-e73451156ccf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684657710, "uuid": "db480419-cc9a-40b8-b762-b5c820051822", "value": "2724243.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ac18b07-f7c6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684666708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666708, "uuid": "1e4e4189-e0a9-4c9c-9077-59f4954e31bb", "comment": "Malware payload (Amadey)", "value": "09ede5f5ee1b809d95937efc00518b3d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666708, "uuid": "1c8036b5-2180-4f67-b067-88a12b1623ec", "comment": "Malware payload (Amadey)", "value": "9645236c966014a88eef9537dd6c6e9b473f1101f5ceed950f7747c2457abb1d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666708, "uuid": "72be1a75-496f-43ae-8bc8-b82f3d16f6ca", "comment": "Malware payload (Amadey)", "value": "514140ca7ad0306bebfe58ddab55b4ad97446c3d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666708, "uuid": "8e92e21b-9a4c-428f-9048-d7e37fea3816", "comment": "Malware payload (Amadey)", "value": "d707135e139e655d18b92faf899aa35948d1adf1c6a2202005e97cb9b38f54e628014399c636234eeb95488e7615a5d7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666708, "uuid": "abc54f6e-0ab1-4258-9629-10dc6a734074", "value": "T168252343E6E89432D8782B7008FB63D31737BDB0DCB8811B26D55A598C332E52A7576B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666708, "uuid": "125a2663-69c9-4959-a655-8ecacda47b2a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666708, "uuid": "15473168-631f-4a13-af5f-62129d4ec059", "value": "24576:7ybNKpjQCWDrqTBFdCphvpmqWgLvhmQF364:u5oHKqTPdCpFp1WgrhFZ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684666708, "uuid": "f9b3de7f-63fc-49b7-afb5-acfaf4120adc", "value": 1046528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684666708, "uuid": "0b515793-b65a-4d0a-9d5b-41ff63c8eeb4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666708, "uuid": "b97c66dd-e208-4b3b-916f-4737727985d4", "value": "payment910.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2d5cda5-f7c5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684666426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666426, "uuid": "c067e6bb-8b5b-4669-8168-1a52a0a5dfde", "comment": "Malware payload (Amadey)", "value": "b51bdbb590d81fa9791ab9d69f5b21d4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666426, "uuid": "b92d24c6-72a4-48a6-b69e-94a1da4e7e26", "comment": "Malware payload (Amadey)", "value": "96971c721b2cc244519a5acbc0cca7691ebe490c5a6688b5e6a67484321ad72f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666426, "uuid": "ba35e2a5-5b6e-42e0-a1c7-70b22ac966bd", "comment": "Malware payload (Amadey)", "value": "245af5ae9de8baea5e017874dc1847f5a6deff82", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666426, "uuid": "4710bf1d-7293-4d7c-8830-75597f844aa6", "comment": "Malware payload (Amadey)", "value": "f42546830a5fa81c3a4499181817cb634e49ec9476f4ffc52f8e662467331a74bcb687b9fe9c62e58048a23941e1fa62", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666426, "uuid": "e08892aa-799a-44f7-b3c1-cb11468090cc", "value": "T119252363BADC8077EDF12B315CFA07930736FC619E74821A6655EAAA0D73B805930366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666426, "uuid": "a6c01ade-495d-481c-aad8-c935a8427764", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666426, "uuid": "50bf4ff6-1e1a-4b7b-b96c-91506dd89d80", "value": "24576:PyFxDKpEa2EIjaytqbbt6ADxAnfX+XuxxYO9I0VX3:aFxDKpObWytqH0mGnGknS0d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684666426, "uuid": "304d37db-d9ba-4409-86c0-1288904bd842", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684666426, "uuid": "735238c1-69b0-49b8-9d9e-39b7bfb2f939", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666426, "uuid": "336a877b-6670-46af-8bdd-591eea3d5eba", "value": "909000664.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef000d81-f7c7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684667359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667359, "uuid": "ddfe06f8-4f99-4ed5-8b89-3e9f3543f3ab", "comment": "Malware payload (Amadey)", "value": "ee3c51ce524342a06f5ec1e82d5ccb64", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667359, "uuid": "a069b591-7912-4c5f-bf28-240bc5fcdc9f", "comment": "Malware payload (Amadey)", "value": "96b880619fe38a257e50c93bed17db0dbc2a2a640940b18ebf3d58730cd47674", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667359, "uuid": "33687dc2-350a-4d8d-b661-76608e722a8f", "comment": "Malware payload (Amadey)", "value": "a174375f380714a8aa94eaa8038db72ae6be7a1f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667359, "uuid": "92a97afc-bef3-441a-a397-28ef30d2a1cf", "comment": "Malware payload (Amadey)", "value": "0dc2687785a7f7f22d91b9a42ea7f82f7c2e1fb4080545b7067ec43e77f92f686726bc94232ab9acc2e5ba652169cfb5", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667359, "uuid": "b0b38f80-a04f-4e06-b10d-e32af6868f9f", "value": "T153252202FBD485B2E8B853B088FA06830F76BC905D39852633456E5F5D726E4EDB6339", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667359, "uuid": "66a7d63b-9916-44c1-9214-c2a89a7e9a0c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667359, "uuid": "b65a4f05-73d2-4824-9706-c3741677a75e", "value": "24576:WyBAXesHLPcqi/WUD28tgOPn+25Ww814qxRxh1woo:lBAXesHLPcqiXft3+25WjpR1wo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667359, "uuid": "56500a1f-3c0d-4b17-97f3-4307ab2b532f", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667359, "uuid": "4ea4c2e2-004e-4e57-8cc0-3a7da8c36c23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667359, "uuid": "1b5ad058-4899-4d30-b467-73354408f2c6", "value": "multiplayer406.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cec35e4e-f787-11ed-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1684639817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684639817, "uuid": "919b9868-7e13-47bc-93e4-2635221c9b6a", "comment": "Malware payload (njrat)", "value": "d0751382c1a349e5e42b05d291e7f7c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684639817, "uuid": "ae0bd312-8835-42b0-acfb-1a528b5e3e7b", "comment": "Malware payload (njrat)", "value": "96d45a92c24e72e6bb39c7b7557d6f1fc96bbd81b123685c36bf57d5ea801bd6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684639817, "uuid": "c3839e20-050a-4cf5-872f-c09fbed34f37", "comment": "Malware payload (njrat)", "value": "d1942646148f53efd845f029a56f8f78c953d88c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684639817, "uuid": "af73e400-c923-4c8b-8d7e-47e27d4c56f7", "comment": "Malware payload (njrat)", "value": "ad7f27ead20b79b7e47aab61561418ff59d8c4be7f6d55f7f8145099ac192217fcd173e948e58050c6d4828a1f99c713", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684639817, "uuid": "5f785b00-ad72-4abb-89b2-e7ee57bb8701", "value": "T1EBF2FA8DBFE24194D2FD5E734671D2220376E0471A23E66ECEE844B75BA37848E48ED1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684639817, "uuid": "e212e2d0-72fa-45a5-99b6-27784b63b3d7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684639817, "uuid": "a4abea2c-3a88-44c0-963e-46ede895d57c", "value": "768:tOSYEQb9aHLDnnasFCUeE3E3XEhq5lxOBcmZPtIQjC:tOSY5bU/nnasgUB3s5lxOWmwd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684639817, "uuid": "8b50b421-ec30-4859-9785-47fa84f9c9c8", "value": 36864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684639817, "uuid": "c37f21a3-a25e-4f18-8c89-8a5550d7ca26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684639817, "uuid": "8a45ce18-65e0-4116-9b83-433306b39a5f", "value": "96D45A92C24E72E6BB39C7B7557D6F1FC96BBD81B1236.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f572011d-f770-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684630004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684630004, "uuid": "45b6c188-271a-4a7a-8f9d-7d3f445f4a19", "comment": "Malware payload (Amadey)", "value": "55b3002b65f329ee99468f4cd24a4e61", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684630004, "uuid": "22eac88d-0826-4e7d-9780-9ae33fc594cd", "comment": "Malware payload (Amadey)", "value": "97948e02d57455389c6a4b89c29de03dd2d1f870dbb3b71423c62e8e24b05fc5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684630004, "uuid": "ddd18fc5-245d-47ff-b096-90e16389f3a5", "comment": "Malware payload (Amadey)", "value": "b697d691cc1c7f49f73df10a4d671e52deefa343", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684630004, "uuid": "fbecb386-1f01-43ca-9571-2b61ac20510e", "comment": "Malware payload (Amadey)", "value": "18c7dbc07fabb09ae38937f7d1a489e238d99c01955ffef6cb944604553ab6c16b2d074be9293236f52a413d5c6a100e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684630004, "uuid": "657a2a6b-c06f-44f6-8da3-e75a5621897f", "value": "T152252313BAC584B2E5B5773059F703830E76BCD1DC78862B22847A294DB26D4B5723BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684630004, "uuid": "619660dd-04d4-4e06-b6e1-7f5385d64c33", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684630004, "uuid": "84e5d549-8729-4a46-a247-6bd47940874f", "value": "24576:ByTZt7PWsWjqN1aXpDXyQjKdSUhAykKMEU4AFm:0TZt7NWjqCX5j0riy+EU4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684630004, "uuid": "2635f623-8aef-4ab3-8ae0-995e19d6db92", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684630004, "uuid": "1952c937-8246-4d60-9dd3-2ef7a8fdc003", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684630004, "uuid": "7bb75406-8118-4e2e-aedc-4499d844478d", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbafdcfe-f7f2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684685849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684685849, "uuid": "dcc1a33a-e412-443a-9eb4-4d4b0e7ff90c", "comment": "Malware payload (Mirai)", "value": "5f824e149da84d42f402215a24222219", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684685849, "uuid": "5d6f48b3-0107-421d-b8ec-58b0abed5b7d", "comment": "Malware payload (Mirai)", "value": "97bb064ad225c1270073ef683ef7bcef2957e005f5f55ba8f98791f5cb5ce528", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684685849, "uuid": "8aa1f499-327d-4e38-9e00-9303eb806178", "comment": "Malware payload (Mirai)", "value": "d9963820aa1023a7c7537d57264f18f3c99cf4b9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684685849, "uuid": "b2487a80-3fb9-4239-94f5-fe2ad156ddd9", "comment": "Malware payload (Mirai)", "value": "020c505e548786f33baaee83a5074d8360981a1671ce09a0c3fc5b53d0fc16a8764b47b456ac2c5e03843e34969ace69", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684685849, "uuid": "fe566f22-9af4-4e8a-8cd0-5892de923c7e", "value": "T15C338D67E82A9E54C04641B075349F341F23F5C493532EBB2AA9C2B95093EACF604FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684685849, "uuid": "85e786a4-c4ca-490e-bdea-8b013fe43ffa", "value": "1536:FaQpz/FIPf7349AY3KbTWVyd/hCcUHNxK:FnpzNIPzFY6bzd/h8NxK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684685849, "uuid": "de482747-cd8e-4dbb-830e-b9cc28ebd643", "value": 51328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684685849, "uuid": "586f57fb-6b9f-40f5-8660-d2551d61a1a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684685849, "uuid": "609505e6-600b-4876-bed8-c4821f3dc653", "value": "5f824e149da84d42f402215a24222219", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e849645f-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684680663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680663, "uuid": "374d5883-eeea-4743-bf33-9d05cf964eb9", "comment": "Malware payload (Amadey)", "value": "0ffaa5cd9fee2393740c553e2e68a21e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680663, "uuid": "f69f47c4-38d8-4eb0-bd08-8ac9c9c283bf", "comment": "Malware payload (Amadey)", "value": "97c6f1a13c0fcd9cf3bed79b0e1527cdb7885fa757dcdcb0475aa013b620a477", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680663, "uuid": "f3deccfc-5f28-447b-a91d-6d8bea7617e9", "comment": "Malware payload (Amadey)", "value": "2e6ac716ae254196198983b6d4e8be98c155d204", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680663, "uuid": "1bab45fa-44e6-463a-ae69-6d6693f070c1", "comment": "Malware payload (Amadey)", "value": "bf54271420f4c42451795229ac525b322d89194831ff19c92275e101d8093120e9289eb757e8e3e11bb1bebcc841a485", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680663, "uuid": "7f98fc14-3ae1-4017-bb69-bcf00bd3601e", "value": "T187252317AAD460B2D8743B7058F285870B36BDA20E7846B73381E95E5C72EC8B573376", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680663, "uuid": "96bf8f4a-25ef-4ade-a252-6bdd06bde5d2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680663, "uuid": "b7f14f7a-2ae8-4a67-8f20-4b74d82407ae", "value": "12288:JMrEy90FC2KTgcsZuZi5RtdWRqNQLtalYXdobcTv/T5pRsiezupJzXqFPi8Lqk2S:ty1xGZu6R6qXYXdobcKIzUL74m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680663, "uuid": "e30bdb9d-04b4-41f8-983e-92d6f1e57ae1", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680663, "uuid": "87c746a2-3b27-43c4-8e0e-e3366b6a1f40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680663, "uuid": "c21b7b85-e361-45ca-bb2a-fc8f82f49ed3", "value": "scanner232.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8706508-f7c7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684667348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667348, "uuid": "9b83bdd0-d49a-49f7-b574-0b5664d822fc", "comment": "Malware payload (Amadey)", "value": "bcdf665596800f3e364f6cff58346cd2", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667348, "uuid": "4b181489-6944-4e7b-b53f-096c938028b1", "comment": "Malware payload (Amadey)", "value": "98018f43a981fa28446877a8e9b72f24e5f444e145de2a2d5ae43883169a9af7", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667348, "uuid": "e10d9561-9018-4c78-af90-5d0cb0ad7611", "comment": "Malware payload (Amadey)", "value": "adeebf41651db8dfb6498ee447a801c599d4c344", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667348, "uuid": "b57a045c-b6bb-4433-bfb7-2c798835d601", "comment": "Malware payload (Amadey)", "value": "5fbb3ca6d8240ed06c1745b2868f7dd45396a34e88f2bb7633232b937022d24372adf73ed16120483b0633272e3c8fc2", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667348, "uuid": "015ca86d-968d-4423-af38-0f4c962acd25", "value": "T127252397F7ED4037E86A377064F702830A35BD65EE7883EE23802A8B4C7255459717AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667348, "uuid": "348150ba-2576-4426-a3e0-46f7bf6310b8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667348, "uuid": "2097c91e-253a-45d5-bec5-0b3ab5fa5c00", "value": "12288:dMrJy90ewvhCsL6/zziN/uoufiuMjwib6pKzpwjETcUyIBy9ioj6DleQ/ypFENbp:UyPzmduflRpEOdzIBsBj6/Ed43HGa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667348, "uuid": "67e3cb65-88de-4109-942c-af6b1e9e7623", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667348, "uuid": "3003f04d-64d9-4aec-a987-9327d3831382", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667348, "uuid": "2ebda365-4e56-41aa-831f-5e5d4ea086e7", "value": "listener137.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b5732fc-f7c8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684667407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667407, "uuid": "96830998-c710-4864-9858-2cff6f1d5507", "comment": "Malware payload (RedLineStealer)", "value": "21f535751e62bcc7bcd2bc7b07ed72ce", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667407, "uuid": "b008d833-efc2-41f1-9b7d-70efc4a5a3ab", "comment": "Malware payload (RedLineStealer)", "value": "9802613d2e06c692d5a76105ea897dde92424dcf17fde49192df0873aae4c425", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667407, "uuid": "7485f4bb-41e5-4bc5-ac29-c500de22d79a", "comment": "Malware payload (RedLineStealer)", "value": "5ac8d6523cceac308f3bed72167fdf3d8983f375", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667407, "uuid": "4f965a77-ae60-4958-8543-ce2a70b35d96", "comment": "Malware payload (RedLineStealer)", "value": "5597c3877d1d0f548cbfbc37a0ca253e386dec32cc4dfeb0820466a3c84a8c6535144c136386b80deca2b5d92914dc50", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667407, "uuid": "c6ba5a26-e3bb-4952-87ff-6089a76737a9", "value": "T153252302BED884B1EDB1977498F603D70B3BFCB16E3995AB2750AD191C722C4997132B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667407, "uuid": "706cbecf-e191-4d46-be89-0ae7f79f1bfe", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667407, "uuid": "51f1db8d-2848-4d3e-a6fd-d69f350dbab3", "value": "24576:yyhjQMHnMSHTtoqfBJ8r2LOSvNj6Na91VrHDLxPH9K:Z5zjHTtoqsKTNjiavVrHHxPd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667407, "uuid": "670e6be6-27b2-4ffa-8b4d-fc8285563cd0", "value": 1047040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667407, "uuid": "99c5d64e-5b2c-4fdf-a54a-17714eafd54c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667407, "uuid": "b797324c-8ffd-479c-9d22-439f8e1451eb", "value": "starter952.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "619b7779-f7f5-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684686879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686879, "uuid": "31476c33-4257-4ab2-8795-0c15d6d929f5", "comment": "Malware payload", "value": "aacb6408a51ffa5abfa1b6ed3942e217", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686879, "uuid": "00aa0055-2ebb-4cff-b5d7-0e6849660cb6", "comment": "Malware payload", "value": "9802bc2fddaab7801e2490014cc7e6149c1e05c8f11c22d5b7b2dbdbec612fae", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686879, "uuid": "67000bc9-f326-415b-9c6f-e5ee581f3347", "comment": "Malware payload", "value": "eae0c93f7d3b30d1a7bed3a737fe2c30ed9fe924", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686879, "uuid": "6e700977-0315-44e2-9ebe-9881880b8cd9", "comment": "Malware payload", "value": "664262c17b04df2100e40d6cefb232edf623810975781b3b90364e095d8d0e943db266d70fe0d305d4645847b3044ac6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684686879, "uuid": "05dba340-e305-426c-89ed-105b91aa774f", "value": "T1C1434A02B30C0A07C0A31AB0253F5BD197BEEAD022E4F684756F9BA69671E375585FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684686879, "uuid": "b5f9652a-c4a2-403b-a469-e14a7a1cffc1", "value": "768:qsB1TlZL/FoCRuzRPp7WoGsnYuJ3DPimj0MZ96m1NdSj8dm+lxeFRzt5Sswx2Ix:f7+CEFGOTP7YC6edpdm+3GzrQx22", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684686879, "uuid": "4a40068f-1a76-4f38-bff0-4e031659a6c9", "value": 55864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684686879, "uuid": "cf586e61-9c8a-4403-8981-e51bdfdc4a01", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684686879, "uuid": "e86579a8-99d7-49d1-a099-26456e7f8a98", "value": "aacb6408a51ffa5abfa1b6ed3942e217", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7d4dad1-f7b1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684657898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684657898, "uuid": "eaf32912-0653-4b46-a954-81a580313629", "comment": "Malware payload (Amadey)", "value": "99e7337acf7af8e9fd8deca5b81baa20", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684657898, "uuid": "a5abde2d-e772-4ee7-897e-43f6990cd6c6", "comment": "Malware payload (Amadey)", "value": "988681f4bbac85c3ea33cf9b246ec721fae11fdbfb4ae5c534c9f784f9e36aea", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684657898, "uuid": "990fb66f-1346-4fd4-8d35-2edff761b9e2", "comment": "Malware payload (Amadey)", "value": "943400924fcc01cf1d429c8e718e98f8a15e26a4", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684657898, "uuid": "3f8d84da-0960-47fa-863f-002693a4a7c3", "comment": "Malware payload (Amadey)", "value": "73fc2a0af8515328ff41b8eaff78f6a50094727c035f722c90fe23eedccd02258c45f4f2fe1ed14db8faa981412f7823", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684657898, "uuid": "54509246-7f06-451a-aa52-d835580c2d8e", "value": "T1C92523437BD86533E4766B3064F207C30723BE918924736B2661B8DE5C73944A6B37AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684657898, "uuid": "c663f2ff-57f9-4674-a1b0-a305f73c8932", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684657898, "uuid": "d1da5418-4cc6-4fd7-b1af-eb9978fdcd4e", "value": "24576:Py2yaDSGjuzag/qnzhUviF48hxHrz04IfonuuJA:a2pSjXqE+P3nu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684657898, "uuid": "f83521eb-2a80-4724-b103-b9fabf054687", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684657898, "uuid": "3d572022-6070-488c-81ef-140c2991da88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684657898, "uuid": "724a2dc2-1770-4109-876d-c99d0c9ee102", "value": "filter.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e133979d-f808-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684695254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695254, "uuid": "b95f4aee-7a5d-4758-83ce-33bd1248e99f", "comment": "Malware payload (RedLineStealer)", "value": "fc43ee5ad5c1ef1323df2b5839f1ac2a", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695254, "uuid": "928d1eed-45b7-48e0-a87d-881deb2cdad4", "comment": "Malware payload (RedLineStealer)", "value": "98954bee71bcc795e04a6ee33c8b6e0b0c0782abf8592a6b520160f294541688", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695254, "uuid": "2c46cac9-76a5-458b-9c77-1145ddc9220c", "comment": "Malware payload (RedLineStealer)", "value": "d5c4dbccfa85caf2fc3936ae74f81288d320c580", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695254, "uuid": "a6d9a35d-f49e-4c45-85d6-cf34246112a8", "comment": "Malware payload (RedLineStealer)", "value": "b252b7af6d497fc70e0fb699c5c0f4a7b8e713e59a70e4969221be0d71212ba227795fd224d94d676f68d13e6c7257f4", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695254, "uuid": "187d401e-609a-4af9-85f4-52ac9ef4e64e", "value": "T198252322D7CE8071DAB957B818F902C31F32BDA24A3D83577B06A81B1D72AC90975777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695254, "uuid": "c4c98a66-25c1-4f0c-8b37-ce3e3d6e1844", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695254, "uuid": "796c2f4f-87f4-4bbc-a72f-f7c5d1314392", "value": "24576:fym0yoIRsqcANH8MHbU6yGd3MZ8XfsQ/g5:qm0NIRsqcoHPU65d28XfsQ/g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684695254, "uuid": "f3062dd3-3443-479f-917e-ed982c29cd75", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684695254, "uuid": "9d685c8c-14b2-4d31-89dd-70cba716845b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695254, "uuid": "11da674d-447d-4035-af1f-58e8cfdb8cae", "value": "NoxerCheats609.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "228500ee-f7b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684658426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658426, "uuid": "832af6b9-ef1a-4abe-9b05-e3b3e8ae7860", "comment": "Malware payload (Amadey)", "value": "de67efe6f86e3e9bd6eb06f1616c574e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658426, "uuid": "6b2efc99-3b36-406e-9ba2-30f96c3fe86b", "comment": "Malware payload (Amadey)", "value": "98b863e25e9482ec70ace01c843c48d8a29244b7e8bae862ce7a2af3f5e09178", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658426, "uuid": "fd198133-0272-4ecb-8387-28f3485638ae", "comment": "Malware payload (Amadey)", "value": "8bef5c59afc6929dacd4123834ed47f7549c8a32", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658426, "uuid": "9fa31ea5-c7d8-492d-98d0-1f8f3d24aaf8", "comment": "Malware payload (Amadey)", "value": "f7c9bb77ea2b00ccb5148742bab0cf9454021a7416e591d3bdbcf27a14be8f96e50639c4fc05581a579bfca7ce5eda5e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658426, "uuid": "d0fd3a9c-af2b-4b1d-a467-b75dcd7fccb6", "value": "T1A22523076AEC8572C8A6373119F542C70B33BCB09938972E77989A5E5C73AC0B671367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658426, "uuid": "2f5b4f47-aab2-45ac-8ad4-6d417ff20a8f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658426, "uuid": "e0626ca0-4ec5-4f1d-92f5-1da08c7e6fdb", "value": "24576:UyJJVrHk4m6nqsIKJCeXDQKCz5+duXmp+44Xca:jJTrHk4FnqsDNCz9Xmpx4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684658426, "uuid": "4e09d065-4a3b-4f3c-b454-0a5c11c19f05", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684658426, "uuid": "759bd526-578e-4e07-a76a-ce8c3b04eda6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658426, "uuid": "23ef22cb-4fc2-46d1-830a-ff660161ff85", "value": "controller297.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "260125b5-f809-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684695369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695369, "uuid": "813141d7-f303-4647-b7a6-9eff58c53b16", "comment": "Malware payload (RedLineStealer)", "value": "846eda5f9e2d9bdcec473cc0d1a00531", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695369, "uuid": "bbe5426f-79fc-4318-a1a1-5c4bbe6080eb", "comment": "Malware payload (RedLineStealer)", "value": "99054132d8a19f4fcd4169f7a2dff965a22f020155f92e23703b139676c27621", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695369, "uuid": "2cedb924-2c24-468c-b9cc-dcf5283a0425", "comment": "Malware payload (RedLineStealer)", "value": "c75cd4da21e887f8271c67253337485e06954814", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695369, "uuid": "6c65be49-324d-423c-be31-4e9a64c07e52", "comment": "Malware payload (RedLineStealer)", "value": "0affa67cfa4f031f5650103446730ae75cac746d610c1522a7309a3cf9fec157ddc49484311aeaed61619e74946801dc", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695369, "uuid": "160d2c13-f268-4987-abe4-47f348f99a39", "value": "T1F7252353FACD50B2CCB16B7045FA47830A327D76C9B49B6F1B869D5E09326C4983137A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695369, "uuid": "da34bd18-d06b-486d-9a78-7abb6969753d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695369, "uuid": "b3a4f167-6767-4dc1-81f8-cf860421a164", "value": "24576:/ypIgfZ9EvlUt1BOqMBrldaw1o1ieZGbZdpi7l6tslW1A0ddf/Qs:KlrEvEXOqxw1ZZu7x50zf/Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684695369, "uuid": "ac977af8-a582-4826-aa1c-0eaa725d2b92", "value": 1046016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684695369, "uuid": "f9a74671-08f5-443b-aed1-57dc48a95a08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695369, "uuid": "d8017e1a-8a63-4301-9b75-672f2df3d847", "value": "updater745.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b9f7b3f-f802-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684692372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684692372, "uuid": "b4ce21cc-88ca-4fb7-b127-269567c23f2d", "comment": "Malware payload", "value": "023e7d6d5846fbd95add7bfbe65c6fd9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684692372, "uuid": "cc17090f-db01-4a22-8bf4-6940795430e3", "comment": "Malware payload", "value": "995db2f4938f5c72475d8d9da2c4c4307821cfc8e78ca701427257d30140d0b0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684692372, "uuid": "44921506-c555-4408-99b9-0804494cb5f4", "comment": "Malware payload", "value": "03ab61011dc382c5171268877ba2292d31dc5980", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684692372, "uuid": "91790982-3e9c-408e-84a6-a57f50069e01", "comment": "Malware payload", "value": "ad7b2542f9fb39d0212d183ae3159343c55cfc7802d358ece88b082a8e05545d2be59adb0a5dc0a8a79cfc58e75f5558", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684692372, "uuid": "6baecc32-de7a-405e-8f2f-166ffa9257de", "value": "T1366307DAF401ED7EF80AD77B4497090A7630A3E146821B37236779ABFC761954822FC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684692372, "uuid": "e0e59b23-c8ac-44aa-92fd-c8e4af94fef4", "value": "1536:dkvvDeyESrTNlG8LEH57tu73oT3pBKJtwSjYHhG:dkvvDe7SrBlM7E74+twS8HhG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684692372, "uuid": "13f841e6-a953-4685-9068-9d8d84770de5", "value": 70772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684692372, "uuid": "d07b2fc8-ed86-47fa-9f6b-d879819720e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684692372, "uuid": "7fc01bd8-c20f-4f99-9a42-425bb2af35aa", "value": "023e7d6d5846fbd95add7bfbe65c6fd9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e54ee735-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684680658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680658, "uuid": "6c48bed5-6628-4aca-9ce0-30233c800df7", "comment": "Malware payload (RedLineStealer)", "value": "9d006a0fe9081b4d1d4e30bf656c1f42", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680658, "uuid": "53d688e4-d6ed-4e1f-a18d-b9a516e44d03", "comment": "Malware payload (RedLineStealer)", "value": "998c352179ec4b15a7eec17acef443e971239d839a1c71979f5ebdaf52cc3c2b", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680658, "uuid": "c40b8f63-0de5-46da-8fd5-4f5ce1ed101b", "comment": "Malware payload (RedLineStealer)", "value": "dacdb72b9eeca14242dccf5a413cb5de69bd8244", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680658, "uuid": "ba93f4de-f772-43ff-9561-07c710e9af57", "comment": "Malware payload (RedLineStealer)", "value": "cf88cb655ee717b8e90a4d7fb9f43cc293eb3e13b98befd0861e3aa7d0275e3017c4584026f732fe1a8ac25b64c6f6a0", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680658, "uuid": "30dd0786-86b1-4231-8bf2-f85d0e4aabd9", "value": "T189252323ABC454A3D8651BB0D8F606C70B3BFC919D38C32516869F4A5DB2784E6317BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680658, "uuid": "446d756d-a779-403d-a5f2-c5d018275b3b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680658, "uuid": "35b654e6-3ede-4285-9b9e-457b4082bb88", "value": "24576:LyHiKUdmJ6Pqp1iIlPoH6xqih7XzesfPS:+HiKUC6Pqp1HlPoaxlzesn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680658, "uuid": "f5e5859f-2209-44a5-ae5a-976f5c6b19a7", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680658, "uuid": "b135964c-faf4-4529-be7f-05399233ada1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680658, "uuid": "67bcfe7b-f535-428f-b639-a8548a56f050", "value": "resolver431.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1bc32f2-f808-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684695281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695281, "uuid": "c3d47ff6-60b4-4a96-9485-e1edc74a49c5", "comment": "Malware payload (RedLineStealer)", "value": "ac518e1d843e6a39803f3ceae53d587d", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695281, "uuid": "40b1fab7-1458-4eea-9e66-026db6d13efc", "comment": "Malware payload (RedLineStealer)", "value": "99bc82852a4bd0d62c626dd27eb3963f78421283d741c1aad0deaa2abf44e33a", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695281, "uuid": "e6cc77ac-b753-477b-ac9f-1fd053aa4b5e", "comment": "Malware payload (RedLineStealer)", "value": "633a59528a208d39b6f07882fe599f005b87c3ff", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695281, "uuid": "f1b29502-b8ae-4912-b052-fe74357058c2", "comment": "Malware payload (RedLineStealer)", "value": "72eae731a59e8fd22af28ade120d8824858da3912be182b66f35e0c62bbd18b5fc1e3a0d0931b5fd3ef03b7ac3206a58", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695281, "uuid": "62afe7dc-4ef1-4fa4-93a2-d15218666e7a", "value": "T1E5E3D624279F8930D6BB4E3D6CB19CC076BCEC12A542D74A4ECCF5593A73B809B116B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695281, "uuid": "a6cfdf74-4f52-4557-84cd-d83cb45d2c80", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695281, "uuid": "226542d3-f72a-41e6-986b-00f4e5c47847", "value": "3072:2V+m5cNQmRSxWWAcP+DDXedh7Z58e8hk:2jwCUudh7z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684695281, "uuid": "5911353c-d93d-4bf0-b1c7-b5bb7441ce25", "value": 148807, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684695281, "uuid": "45dc34ab-4173-4a27-8b74-e0eb09455d11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695281, "uuid": "f960ed11-f61d-40a8-b8f2-f37506bfbc72", "value": "controller234.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5a9c498-f807-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684694751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694751, "uuid": "db356025-25c1-4683-991a-c94e38216d37", "comment": "Malware payload", "value": "30dbc09169e300eb671b4003e45405a4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694751, "uuid": "64ed23e6-5dc0-41ce-a979-585cbb645d5c", "comment": "Malware payload", "value": "99ca242cd5be03319fe44b2b582b9d8445a4cdcc9ba30354d8be31befaeb4fa6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694751, "uuid": "d723884d-b618-4b66-89a7-7faf132c7b3e", "comment": "Malware payload", "value": "1bcd2f59bbcff9e599bf6de85c7e70592da161d1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694751, "uuid": "9a282718-803f-4954-84c1-88f80b551f54", "comment": "Malware payload", "value": "fa7ced51ee6e395510375fc586e9ce6e0ba179b97d0718933f162397fc7edd58e7cc9538077f8ed186e1fc5e0a101811", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694751, "uuid": "6edc96ba-d746-4ec6-830e-bfad267e4f83", "value": "T111252252AAD44573DCB0337048FA06930B36BD954D788F6A3356ACAB5C731C0ACB679B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694751, "uuid": "cbe2572e-9528-4542-b4cd-c428496f6373", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694751, "uuid": "93c0b1a6-f772-447a-8090-4b03badb3556", "value": "24576:Yy/D/bzB+T7v4qPUdoqLns+uHPc9E1JjJF8Zm:f/D/bzgIqcdoqLs+uvcmvXg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684694751, "uuid": "7dd58c88-4bf1-43f4-afda-ac7937a9fff7", "value": 1053696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684694751, "uuid": "a888e288-5fbd-4c1c-80d5-987004e38a84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694751, "uuid": "86fc4245-9011-457d-a092-6998cf7788cc", "value": "LightCheats429.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "322caa5b-f771-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684630106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684630106, "uuid": "afd89840-1aea-4475-b9a6-5d3b2ee37508", "comment": "Malware payload (RedLineStealer)", "value": "80c28acc69bfbd2035c5dc0f3b699de5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684630106, "uuid": "12785a7d-b178-406f-a69c-1cc27f728dcb", "comment": "Malware payload (RedLineStealer)", "value": "9a371ec0e57ee21ec47422a566e44d4aacd17186a943c124c89b4b59849eed53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684630106, "uuid": "7148eddd-e9e1-4cf5-8e7c-6c0d48db4a10", "comment": "Malware payload (RedLineStealer)", "value": "347556f158c6a461d06fa9f589757587216224b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684630106, "uuid": "f470fdaf-f96c-4d2e-a9c7-35a078b4f9c4", "comment": "Malware payload (RedLineStealer)", "value": "6035a4f7a8ace6874edd400357500fd74eac5809f6b2dcb50ffc6427fae0888231bff2addd725464b3880a57180c3f33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684630106, "uuid": "2307278f-e0fb-4867-a0d7-0587689432c1", "value": "T16C84BF22A291E871E5654671CE6DC2E8762EF8517F792ED723446F2F18312F2C63E702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684630106, "uuid": "a9221634-f2cd-4b45-9901-1477088cca4e", "value": "bb27c4958c76443fcfe46f9765d838a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684630106, "uuid": "6a6f3e82-279e-469c-a5d0-8d47c47d7cbe", "value": "6144:bHElxV7craKtdIgsBPPRl3InoRVQBJG2lrdZsYtmROJcTM:bQxaraKvbs159InoRVEz2YtmZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684630106, "uuid": "8a282bd7-d259-4c59-8f1f-1ffabbeb48aa", "value": 390144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684630106, "uuid": "a7056e68-f943-4a47-a38e-b6c023298898", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684630106, "uuid": "9656f3f8-dc09-4e5b-b36d-411aae57d51c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83149807-f81b-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684703256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684703256, "uuid": "4fdf2739-3367-4048-9935-7a81bee791ad", "comment": "Malware payload", "value": "222dcfa4e1ee01ec103a3fc47b66084c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684703256, "uuid": "16f63560-ba1c-43ba-af8e-44a04cb1db5e", "comment": "Malware payload", "value": "9a6e74d559557ed65cb6af049704e12152ffad6cd3c6339bc872caefdd312bfc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684703256, "uuid": "4c30f987-3e3f-439b-921a-8a675588bab5", "comment": "Malware payload", "value": "c8f947c72a4e671bc50bef113aafc8ff00599af0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684703256, "uuid": "13047a62-be2c-463b-8c07-e95c819b3f44", "comment": "Malware payload", "value": "c0a99fb7f621597d6e32d02444ed612969829e4d7760a444513e763966e6372f393abd351e8b5da0394764c325fac019", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684703256, "uuid": "f6ec1022-e417-408b-879e-730d919cec10", "value": "T19B849E03A2D1FC61E72546718E2EC2F8661EF9518F2927DB2A546E6B04713F6C673F02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684703256, "uuid": "6ede4929-30f4-4531-b50a-d29a286e056c", "value": "ad1da3007d39bc21ababd35f90247ee4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684703256, "uuid": "bbf89314-366f-43e4-a65b-d976d0d0a0c1", "value": "6144:kUVJZKE6PkBkvmhqa6ep6Dl+9e/rm9n0opXMqJz4uv0Z4T:XJH6f5aGDlCWWn06NP0Zo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684703256, "uuid": "7e8e9049-5061-449c-8d1b-bed215179a87", "value": 406528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684703256, "uuid": "05cf7fad-af1b-449d-886b-38414d5fb2ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684703256, "uuid": "51a2199e-5e1d-4467-9a87-d99168ea5b2c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1d7cfde-f7a8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684653916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684653916, "uuid": "841508bb-8cfc-4d7f-b93e-92290324a433", "comment": "Malware payload (RedLineStealer)", "value": "74d6cc59fb6248496ff3490ac16291df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684653916, "uuid": "24ed8166-940a-49f8-821d-ebd845c38e64", "comment": "Malware payload (RedLineStealer)", "value": "9a91e4ee1396ce8f73926beb4c8ec7626414613f253a8bc1905ef856d26848a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684653916, "uuid": "647dd888-29dd-4d3e-9a64-925f8a91831c", "comment": "Malware payload (RedLineStealer)", "value": "b40507e475f57563fbdcd1949c9d5d623c3b882b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684653916, "uuid": "d9214a3f-2ec4-4d07-bbeb-2ed44dfca529", "comment": "Malware payload (RedLineStealer)", "value": "9383f0b6df3ea7bdd98fbe25a2498e83c6ae3ed243115e2be9af0ee5222e0723fcf4983d7a7a47a0346c4b0a67e9b9c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684653916, "uuid": "fc2ffa86-486f-4d88-91f1-fecc8539a9e9", "value": "T1EB2523035BF5A512ED347BB019F61B970A3BBDA1A878435F678A9CCA0D32B44643077B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684653916, "uuid": "45ff97ee-12e4-450e-ad25-f0dbf950b7a0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684653916, "uuid": "5a3d2973-3638-4149-9456-d9ce18fb41dd", "value": "24576:tyYaNrkfleJqSDm5Pni2dQLHlvIPQLH7t:IYMrbJqSDm5ylQo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684653916, "uuid": "298ddc25-8a3e-4a1b-8fab-2cec49ae79ad", "value": 1054208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684653916, "uuid": "a6e090cf-847c-4835-be0b-620994811283", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684653916, "uuid": "5da55f03-046d-4e6d-b4a2-461dfe2b2bbf", "value": "74d6cc59fb6248496ff3490ac16291df.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06dd7894-f76f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684629174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684629174, "uuid": "6cc8cc05-031a-4287-ab49-d501f5dc93f1", "comment": "Malware payload (RedLineStealer)", "value": "e9b27f55a18054d5c54dd5d55d3b2264", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684629174, "uuid": "d8d1dcc2-f459-4799-9641-4a176567a707", "comment": "Malware payload (RedLineStealer)", "value": "9aa24f45e364a29eb92748cfc1e318beceb909fa19b5b5dfe043a495fc5fd2d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684629174, "uuid": "0d7b4a3e-f01f-4785-a210-baa72e9fd362", "comment": "Malware payload (RedLineStealer)", "value": "f87ff8c75ccb481931c4ea16af5bdcb7bdebf27e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684629174, "uuid": "a57ef012-b9d4-4ec5-9ee9-fe44cf215803", "comment": "Malware payload (RedLineStealer)", "value": "dc4aeb49f6f0b0ff0ecc5b26700120135ef12142161c76e00b4ffa0962c5c5fa5916a85af06d39e08acd8d205ea02077", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684629174, "uuid": "71516875-d91d-4cd3-90ac-752bd92881eb", "value": "T10984CF22A3D1F871E5664675CD2AC2F8652EF861BF5427DB33486F6F18301E2CA3A741", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684629174, "uuid": "d1193e2c-66a3-4943-a488-2301b0101f7e", "value": "dc368f441a884fce22ecc585e2bd5326", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684629174, "uuid": "18099202-6d6a-4911-b8f2-0bc3f6df6118", "value": "6144:gm9PdTaA/YfDsrl72WirgYYKZqVBrhNQcYjBVAGZv5gTz:g+duCplTirgvGArLQ1jAGdSz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684629174, "uuid": "824fb90b-c942-4a8d-97b6-77bc271d4e1a", "value": 381440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684629174, "uuid": "19c0c768-0167-48ce-8033-a7a3d35cd686", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684629174, "uuid": "711dbf10-e2b9-454b-b61b-a1d6a92f956e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0759b4d6-f7b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684658381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658381, "uuid": "42219886-2238-42ae-b795-6a7c9fa9aa5a", "comment": "Malware payload (Amadey)", "value": "ec5c0a0492c424fe7678fca8b97e35e4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658381, "uuid": "52f02e11-93e0-4138-84d1-ffa25a64cbfd", "comment": "Malware payload (Amadey)", "value": "9b72c9825295f9eb33659c40a11c4b6d6733fc6ec9cbccb624171266ae470c6c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658381, "uuid": "6d48b68b-efe8-443f-9f90-5e9c942a01af", "comment": "Malware payload (Amadey)", "value": "cf95aa248d00f0999def1e20b07064b2543a97f6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658381, "uuid": "cef4bf1e-c8b2-4a6f-b954-fd40425d0b7a", "comment": "Malware payload (Amadey)", "value": "1755c0adf1c82706e486dcc76312205b186a83859f2981aa23f12f336137dcb60b9bbb381eb18fdb7808f8e036a3d755", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658381, "uuid": "52c6bac4-0b0b-42db-b878-7ecf43d6f369", "value": "T1D4252352B6D04432DDBA27B989FA43D70A377CF14EB08AAB3245C8590C72789B476377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658381, "uuid": "dc93f0ff-09f1-4aa4-9f31-97f3f5bbbcea", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658381, "uuid": "fa2b5bd1-1e44-4987-a5c8-6cee02912871", "value": "24576:+y9yQE+bjuAvaVi6WAYEpHr8np9AmW6LQhG/vuWrTnn5:N9yQHbjj6PXL84mWG3uWn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684658381, "uuid": "74795e89-1737-40e8-a980-1b0963962e13", "value": 1056256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684658381, "uuid": "61aa4e82-0bfe-4834-902f-d42537d9eba4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658381, "uuid": "3c6a682d-ce91-4916-a550-7c2eef72c640", "value": "248990s405.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9b02440-f7ff-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684691295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684691295, "uuid": "d502cacd-9bed-4ad5-b5b6-64c03dab1c44", "comment": "Malware payload (RedLineStealer)", "value": "ba8f66ae947be7eddead5aab7d718a0d", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684691295, "uuid": "9345542d-d207-4898-9165-fd7b0c2f0801", "comment": "Malware payload (RedLineStealer)", "value": "9be13a0392ceb201326d1291a84bff887e060653dea3f94ab5df597d3f2abca7", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684691295, "uuid": "9b99d095-7c63-4d99-a46d-1f6791df55f1", "comment": "Malware payload (RedLineStealer)", "value": "b10ae837908814ef4c64f2ba0b00e651abe88b98", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684691295, "uuid": "f136ff67-8837-429f-9a18-ea849d5f6796", "comment": "Malware payload (RedLineStealer)", "value": "306bf94e8870dcb3eeb83bd43f668172d0d4c7a2cbdf0986cf5c8706be71eb0b787268695e5751acfab54a06fe2f3bc1", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684691295, "uuid": "58694508-8396-47fb-8bbe-2ef4e9584316", "value": "T1F5252322EBED4133D9761B7168F606831F367DD19D34923A7B89A41F4CB36C0A931B26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684691295, "uuid": "375a7d84-4fe9-4b2b-9dff-c4719f4ab844", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684691295, "uuid": "7be63c61-d93f-4d2d-a0b6-f274b7ee7b4b", "value": "24576:myyFYUA4xBqUNzqtimElRMMDY8qdMmkPi5Uzg4YAifB:1CrqUNzqtjolqdMmkP4hAc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684691295, "uuid": "a31efb1e-031e-4834-a63e-c75f8a770493", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684691295, "uuid": "d6076e34-2a1f-4dc2-954e-53586a58adaf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684691295, "uuid": "55abb1f9-99f1-4061-98f1-122817a3025e", "value": "token575.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b741030-f7b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684658495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658495, "uuid": "97657082-eac9-4ed3-b213-b49d90c08b03", "comment": "Malware payload (RedLineStealer)", "value": "a7ee47828411f7da12c315a29cc58abf", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658495, "uuid": "e6310982-3ae5-46e1-a804-4feae99cf9db", "comment": "Malware payload (RedLineStealer)", "value": "9c2fe3424784b295eb867a4317b0ac7417edaaf81385669599ad3f902bdaec67", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658495, "uuid": "8c6e1f69-80a0-4cbe-aef3-70013c31bad6", "comment": "Malware payload (RedLineStealer)", "value": "57b7fee5e6c4bf37750a2d385095e1420c8c7f97", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658495, "uuid": "514c1c07-61b0-4302-a7ad-225d2d62d9f4", "comment": "Malware payload (RedLineStealer)", "value": "a8c46f737033d6ffb92ad280df8290570b8b6b68e83d42f14f4981f85e48399a087836bd174b47c0d425bc101e5b1a7d", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658495, "uuid": "306ef8c4-9ff9-493f-a6ee-db056406e8c0", "value": "T1CB252312E6ECD161E4B523B188FA57830B37FDB05838D3FB3551588A58B2BD1993236B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658495, "uuid": "accd2a69-76c0-4373-aaf7-ecc8f29c3288", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658495, "uuid": "4a6819b5-84ba-4fb1-b4b0-c6c791552243", "value": "24576:cy4Rzdg/8svXIaS3PXDq0asCsGENk9+wJ3GjSfwVe2g3fxpFs7o:Ls48V/Dq0am7wYcQs3f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684658495, "uuid": "26f9be75-2025-4f00-9e7a-e46428aed09a", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684658495, "uuid": "ee73552a-4c32-4b0e-9583-fb2f11f42e28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658495, "uuid": "b5bd4aab-a9ee-4dad-8ecc-337e25833a66", "value": "utility953.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "124345c5-f7b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684658399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658399, "uuid": "d3b0093c-6ecf-4768-a33d-35bf1b0ba22e", "comment": "Malware payload (RedLineStealer)", "value": "e1122c5a0b61c879ea011303a6f0fd41", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658399, "uuid": "9894df63-8188-485c-a725-2a5145ac1d2d", "comment": "Malware payload (RedLineStealer)", "value": "9d28e91ef8f0d362d2940ebba914ac584975d92838233f45edf40f846a6a197b", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658399, "uuid": "0e278d6a-9c24-43be-921a-091a6a356f20", "comment": "Malware payload (RedLineStealer)", "value": "fb8b17951a592e50cd7b6a1ded2ccc2cd6991a52", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658399, "uuid": "639f7ad6-9b68-470c-98d3-41133d789eaa", "comment": "Malware payload (RedLineStealer)", "value": "2d9c152f7ef10559c34d60b878bce47fa2faf3d5aa32ee0be3cd981a725f2917dc6719adb8614b54ff00cdad68dbe162", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658399, "uuid": "5d275efc-bc3e-4353-97a1-6eb6198e7487", "value": "T19B252307FBF8A174DCB66B30ADFA03970736BD519931932A13942D9B583235095327BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658399, "uuid": "0829d09d-d3ea-432a-914c-2b9dacb6f187", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658399, "uuid": "d41ac876-66ef-4a72-9a0d-7e9d27ebffd3", "value": "24576:RygSqtFXoLP/HReDqqegP9FAbdxwaygi64+3yM/v8Jw:Eg1tFXoLXHReDqqegP9FRUiad/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684658399, "uuid": "cb2a1dc2-5031-45d0-85d0-8e9420b5c52b", "value": 1046528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684658399, "uuid": "fc0cfc67-40db-4215-a320-212bae5a036e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658399, "uuid": "d997297c-2405-48b1-b201-11038b2d9c6c", "value": "AI331.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5946ce9-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684680577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680577, "uuid": "1150946f-5fd6-4646-b8e4-38f10ec95ca8", "comment": "Malware payload (Amadey)", "value": "59ba1540d84afc898f2f394fbf2b8460", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680577, "uuid": "487670a1-795b-42ca-8e38-3cbebd5dcf96", "comment": "Malware payload (Amadey)", "value": "9d41db4afe7d4db389f21cdac4e02105107e8a3e0c47b6212d37eca128e4f1bd", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680577, "uuid": "7a8ac024-bd81-4342-be86-8cfafd5c02f1", "comment": "Malware payload (Amadey)", "value": "745caaa3aa2dc272689b159759ea500357443829", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680577, "uuid": "37f1a9ab-a6ba-42cc-84dc-c9f804d96ca2", "comment": "Malware payload (Amadey)", "value": "a9332e0fa322ef265e24a2bd0d844c02c47c20940c881ffcabe3c0bf8b8ccb2fa0f3826a676e65bce722c0f6095dfa0f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680577, "uuid": "f97f0760-2d82-4f99-9a7f-6beb1452d705", "value": "T133252203A7D48071ECF22B7085F603831A37BDF2A936D35B2746A9986D729C5687173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680577, "uuid": "3754b87e-e00f-4fdc-9789-86bad70662e6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680577, "uuid": "de9134e4-79c9-4812-9e7e-435f4eb9f703", "value": "24576:tyWAQJ40m8GQqq4OqiT65SM1REWtQsFZ/M60KJeJ/exO:IWAY4tpQqq4+T6X1CWysFRCK49", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680577, "uuid": "29e75e65-ac93-43ab-ab5a-3864fa125ec5", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680577, "uuid": "2216ca7d-c0b4-4501-a888-0ad4e8e6b82c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680577, "uuid": "f9a4681a-e2fa-4c57-b4e3-151826501a34", "value": "formatter240.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dfdde08-f797-11ed-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1684646420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684646420, "uuid": "ffe95214-f302-4ef2-b044-8840b7ddacc0", "comment": "Malware payload (njrat)", "value": "ef1c175647c2aaf9038cfeba008d71cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684646420, "uuid": "a5e57e5a-eae0-4b25-9a16-d4e45f5bd8c1", "comment": "Malware payload (njrat)", "value": "9d5a787b4607ecd4535eb002d37073bccf3627427014b1195aaebc7ed70a15f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684646420, "uuid": "055ac5f3-7464-4f2d-ac34-f66a12e0b456", "comment": "Malware payload (njrat)", "value": "46fdde8a416561d2ea89c65400c0d90896f757bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684646420, "uuid": "dc906148-a940-45b2-a03f-b49809b1a22c", "comment": "Malware payload (njrat)", "value": "076399153fc4eb660caa4117ff7dd7f7e01eb7caf2f382df86e217b18bf2c7cbd456bdc3f93e86c1c3c9112608b7b1f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684646420, "uuid": "796fa3c6-ec54-4a63-be15-50db258ea7ad", "value": "T180032A4D7FE18168D5FD067B05B2D412077AE04B6E23D90E8EF264AA37636C18B50EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684646420, "uuid": "c59f80e7-6b66-4342-966c-13af11115756", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684646420, "uuid": "394c2628-843b-4dc2-b141-c5ca130ee490", "value": "384:7uSvEiTbTvpWNcZ0y8fvCv3v3cLkacpjrAF+rMRTyN/0L+EcoinblneHQM3epzXE:CS7TZ38fvCv3E1c1rM+rMRa8Nuhct", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684646420, "uuid": "4f74f4f2-67ba-44e0-b33f-be14e1398ad9", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684646420, "uuid": "f840825f-a411-4d8a-ae68-ccbb4cba4ced", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684646420, "uuid": "5edfd55d-5e08-4c81-b92c-2b3c78ac6f37", "value": "9D5A787B4607ECD4535EB002D37073BCCF3627427014B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a207c8a-f7f4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684686491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686491, "uuid": "28b4ecef-e74c-45f0-8211-513003c3c87c", "comment": "Malware payload (Mirai)", "value": "56af70e247bc7757750a7cb315fd6ec7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686491, "uuid": "27927bf3-b56a-455b-8cd5-cda76047c4ad", "comment": "Malware payload (Mirai)", "value": "9d5c196800b915e5b299e6a803fe555a198faeea8b46d10cf7d4c579289c6717", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686491, "uuid": "8d160494-ef15-43be-823f-27e5395d8f5a", "comment": "Malware payload (Mirai)", "value": "4af20b69960583581ee3ec4a71346a424d1d3545", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686491, "uuid": "e94bdac6-6e6e-4fb6-9dd0-02f113af3bc0", "comment": "Malware payload (Mirai)", "value": "9a5526d743f853b6bac10a98988ca54bb1455eab916c920bc9516ddfe8ea70ee3ca5f26e144eb2ee0c9256c15677c150", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684686491, "uuid": "9e112e2d-671f-4c71-aa72-f95deb2f0c8b", "value": "T1B9433B21BA760E27C0D5A4B621F74B25B6F147DE26E8CA0B3DB10D8EFF615406543AF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684686491, "uuid": "804509ab-c36f-4871-877a-e441dd262b96", "value": "1536:rnc1gFIkpvQk7e/JtrtGZuF+eGjxa3QuI75DytG075a:rc1gFIkpvQk7ll4nIV275a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684686491, "uuid": "a8fb8b33-0a35-4897-b905-f41ebaa68173", "value": 60408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684686491, "uuid": "1a6b1ff6-f016-49b3-aacb-3e542f6cfc78", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684686491, "uuid": "9de22074-c0fd-41b8-8a62-2001cc8e14f0", "value": "56af70e247bc7757750a7cb315fd6ec7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c3add95-f7b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684658470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658470, "uuid": "f4236a41-58f6-446d-99ba-38a8097498bc", "comment": "Malware payload (Amadey)", "value": "721898d4b028b2dd547b4e90a6c93fcd", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658470, "uuid": "4543a04d-c01a-4ca0-b95e-218ccc69e46d", "comment": "Malware payload (Amadey)", "value": "9d85924e93bd365d7bc5a67f863a3c6f767241a1564a483d76b8e5d20dfbbcd9", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658470, "uuid": "b1048a12-2934-4785-b323-788751fed350", "comment": "Malware payload (Amadey)", "value": "5da38ea185f1ae5addb950044f40fe4a943a88f6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658470, "uuid": "0ee7d4f6-6c6d-4f4a-99aa-af4af3e1deb5", "comment": "Malware payload (Amadey)", "value": "ebb83acb9e1f1247e9b7f8003f87fae5d2f62ab374fa8177905761191c97e01b3385452e8743618f9f341b15c5279359", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658470, "uuid": "2cf72a66-0c5f-49c8-8e6e-499a8e4399b8", "value": "T13225230AE6CC5171D9E417F158FA0A530A35BC5299349A2B0F05FD6B2EF3684E930B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658470, "uuid": "579ed8a0-ebe4-4621-8234-c8b0f9bfa59e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658470, "uuid": "7055af82-8711-4386-b086-308232f7f3e8", "value": "24576:9y9yf+uozHiJqGE/Z0dDLuG0c1/WfYvYRUoB5UTHifP0w2:Y9heJqR/Z0piG0cofiXK5UTCfP0w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684658470, "uuid": "fbefa1f3-07f0-4571-929a-81b4739c3d76", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684658470, "uuid": "830940c4-97ed-4c73-8b63-737d2443f325", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658470, "uuid": "c6c2bffd-80e0-472f-9042-f819b0b43c0a", "value": "physics548.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf09fb8b-f808-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684695196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695196, "uuid": "ef3d664b-8c37-4e43-b3b2-9d8c2acf5657", "comment": "Malware payload (AgentTesla)", "value": "18a014f609a3c4e28caf6e39ec90676d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695196, "uuid": "e687774f-58a1-41ea-93b6-2395ebd582a3", "comment": "Malware payload (AgentTesla)", "value": "9dcbee0454cf7f6645f8d0dc63edc727c16d6d8c6bbf60f5e1980b41339ac441", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695196, "uuid": "ef8e1d96-eaa0-4e63-a209-1450079134fb", "comment": "Malware payload (AgentTesla)", "value": "90aa0eb8cdff811717f3357618d502ae37eb1f64", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695196, "uuid": "012c25e1-4a51-4ad3-884f-f5ddac3cd77c", "comment": "Malware payload (AgentTesla)", "value": "0f640ed2def3c5ea74e2c4661c4693b7564b9aa1bb795551ad283355802886387f3cf756adc64df275bb2d708fbb8955", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695196, "uuid": "643957be-a31a-4a4d-b286-c1839f6b0efc", "value": "T14B15E05122B88F15E5B96BF66272E53447B12C61FB26D21D5CE02CDB3E7AF822B00753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695196, "uuid": "048a5736-73b0-4b3d-a988-e0791b2432c8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695196, "uuid": "3756a8ce-ee3b-4df7-ad03-bcb55d6637be", "value": "12288:q00cJLpNaPn0YPX/N5ZHDLyfNwVHiHK3U/xKiQqqYvxjo8IueBHYYQr9G2GqVD10:T0c8P0aZ6aSxK7GzIuYYVrYqo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684695196, "uuid": "1451943e-92c2-4953-8d1f-cc11954d8a01", "value": 905216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684695196, "uuid": "f3a75090-e9ed-4f72-8b4a-695d218dd0e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695196, "uuid": "394bca95-d2c1-4c87-a481-a79101842f55", "value": "21324322.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb3d365e-f7c7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684667353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667353, "uuid": "66d6829e-82e8-4225-add5-f8ef7951304d", "comment": "Malware payload (RedLineStealer)", "value": "153bac8af9de0193861cd1389e214372", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667353, "uuid": "0e6968a7-79b6-478a-a8fa-37de31755dae", "comment": "Malware payload (RedLineStealer)", "value": "9dcd620ac1e048c0ad0cf37e137ea4ccb6ead5e58e4305d375ceffc3faa7cb35", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667353, "uuid": "a3a5dd1d-e47b-4773-b48a-d6ec7742cab6", "comment": "Malware payload (RedLineStealer)", "value": "3a0ed3027c13cb725dfbf4ef5d2ca105e4266786", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667353, "uuid": "f1735550-b79e-4f0e-bc41-859db995a26f", "comment": "Malware payload (RedLineStealer)", "value": "e7f263cc3a41bf1958e2d4504c57d4011c65f224b91646a3944501dfc65ac8de0f59685fec3619dad55e35abd8ab3106", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667353, "uuid": "54a6911e-2fb9-4d47-9d52-8a5add7a7336", "value": "T18A252313FEE41172D8B227B01DFA86930535BC918D74CA6E3749EA6F4C735806A74B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667353, "uuid": "493c2ee6-fe7c-4d31-90b6-b95fd137a903", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667353, "uuid": "a70ad44c-f0d8-44d8-81ac-5669aa832c98", "value": "24576:9yU5HC5qqVfu26NVELblDw4xzz4WTVa2W1QR:Y0i5qqVfuPELblDhkMIh1Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667353, "uuid": "926a1753-22aa-415a-b36b-9e81d9061890", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667353, "uuid": "30203461-70e7-41dc-8a86-638719aa6d7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667353, "uuid": "a0ef7057-2976-4fbf-a076-d3b3254719ec", "value": "logger737.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c5e9d5b-f7c8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1684667623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667623, "uuid": "d3bd8d7a-17f1-4846-845e-51b2d9f5a123", "comment": "Malware payload (Stop)", "value": "54043c42b0af6646884e2681e8656bfa", "object_relation": "md5", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667623, "uuid": "d182205a-1295-4345-915b-70711229657c", "comment": "Malware payload (Stop)", "value": "9e7621cec7fa7eb0af90f68d7d42896f5eb83a2d412c0abe00b877ec261dfdbd", "object_relation": "sha256", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667623, "uuid": "c61fd963-c59f-476c-85da-68f9666f3e6a", "comment": "Malware payload (Stop)", "value": "5b5de09e8383902b73b86c0bd4e53f9b526b1664", "object_relation": "sha1", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667623, "uuid": "ec3bea4e-4357-4abd-a13f-43e1c918093e", "comment": "Malware payload (Stop)", "value": "3c8625a35ad6552903985b1c43a1680a1fbcb58d615da23adc969611d0d8bd4c7363dd7be2519e3ad9c1a0848594acaa", "object_relation": "sha3-384", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667623, "uuid": "992be723-8f30-4229-a0bc-0aa2c994f193", "value": "T18F05022A72D9A832E6254671CD39C2F8252EFC257F181BC723487B6F19711F2DA3A741", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667623, "uuid": "3beca901-f625-4ab2-9f1d-01e2ad735860", "value": "bb27c4958c76443fcfe46f9765d838a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667623, "uuid": "edaf573d-0a72-4471-8f9d-2edccd8296ac", "value": "12288:Tt2ztxxdJUjyEjJ6SRHyKR6hhPpdIRPRbMQfvJqrPoJ6mT3pRM68+wc:Tt0xxdKjTjJ6S4KgdIRPhd8Plmzpwc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667623, "uuid": "31489922-0e12-418b-a225-e5f1b61ec205", "value": 806400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667623, "uuid": "501d42d5-301e-4b5e-9179-88e3348de91d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667623, "uuid": "9a97702c-39b3-41a0-aa5b-502a11a7d098", "value": "logger852.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0d9d600-f770-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684629862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684629862, "uuid": "00cc1cc0-9ac5-4ea4-8cc3-e7a014193c6a", "comment": "Malware payload (RedLineStealer)", "value": "97b5a652d41e319493f7796b3c4e4436", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684629862, "uuid": "dd912cc7-c71e-4ec6-8ddd-99c1c2d7608a", "comment": "Malware payload (RedLineStealer)", "value": "9ea80d5502df7a4f17a90c2e043daeec3e6b4497504b52e94423cc4fb59bc063", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684629862, "uuid": "a12f8fef-8e79-4682-b8e3-c324235a5024", "comment": "Malware payload (RedLineStealer)", "value": "e32b75ef7892021903c3fbcd5411f6005b836d07", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684629862, "uuid": "965c3ced-f21d-4ec4-bb1c-8ff114d8b723", "comment": "Malware payload (RedLineStealer)", "value": "5658f6db171c74debf9d7ac36bcf857113cacd06046b471fdc9df296785404d11641ac19332398434ba8ac7b70bb6a83", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684629862, "uuid": "a81fdfbe-ace6-43d0-abc7-0108f6e6b09b", "value": "T1FB252352FFE98A62C9B1377058F743C31B3E7DE48E74875F2305A81A0DB2561A8357A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684629862, "uuid": "172722ac-e44a-4196-9aef-eea54875c9bd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684629862, "uuid": "9f113adb-f529-46ad-b89d-d4c751bb05dd", "value": "24576:ty6fDA6SNjdH/XrqMdAIDYcMNW9tAQIt/JCQHm:I6fDA6QdH/Xrq0DP9tU/Jl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684629862, "uuid": "e37da364-d4f8-41e4-b7f3-f5e4dd54fc13", "value": 1046528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684629862, "uuid": "b30fdd91-b810-4ab1-8d72-d92209006f71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684629862, "uuid": "bcc54c0f-8f64-4a27-b3e1-e957d9ef617d", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5427568-f7c8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1684667746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667746, "uuid": "2480be65-995d-468d-86b7-c71f1dc948ad", "comment": "Malware payload (Stop)", "value": "91640715669668d027f88e0a7de39c34", "object_relation": "md5", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667746, "uuid": "57a3ac84-f1eb-4c73-bebc-4ea7a8e18b31", "comment": "Malware payload (Stop)", "value": "9ebee44cdf471a2b69c261d3ff33d6be7bd07f755061311e3ceb8590b54369c3", "object_relation": "sha256", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667746, "uuid": "cb3f0f19-8486-48a3-bd0e-2603e7862e0e", "comment": "Malware payload (Stop)", "value": "f8b64b752dcbd7dfcdc121215f00b573fd046ff4", "object_relation": "sha1", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667746, "uuid": "54e8d0f5-fe51-4826-9775-b48762a813f0", "comment": "Malware payload (Stop)", "value": "80e3f2f748dfa60102e720ac2617c39a66e132747a9fe9b72be17743e69d14f819924f9806450d4aa0a6b3f1df11ca0a", "object_relation": "sha3-384", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667746, "uuid": "125085f2-e6c0-4857-a58b-0d03b3fdb760", "value": "T15805D01392D1AC53EB254A728E1ED2F4765EF5614F492BD722146F2B08711F2CABE332", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667746, "uuid": "87716d85-ced9-47d0-a2d3-67c89709f695", "value": "52052f823a75c3e49d6f33c06369892a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667746, "uuid": "d8ccb000-1f5e-41d1-aa7f-746955bccebd", "value": "12288:mtGbnRU/7TVXE3TvCF9w/vLs31rVD+bISpwPcjdKFt8/3HTol7Du:minRU/7T+3Gi4FBDF2wCKTS3HUB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667746, "uuid": "cd75df7d-c1ae-433e-b5c0-4c7fafda91a0", "value": 843776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667746, "uuid": "d62a8680-78a3-4a9c-b079-84cf712774d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667746, "uuid": "d069e04b-32f3-4f08-8dbe-36922fbbba70", "value": "4724265.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb3548ed-f7d0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684671218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671218, "uuid": "7c29e594-f1c3-44dc-a129-b3ac31895847", "comment": "Malware payload (RedLineStealer)", "value": "24bc1e2ff3085c4c315cf9a7ab0ce0b5", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671218, "uuid": "ddd9c16d-05b8-4014-88f1-93205860aebc", "comment": "Malware payload (RedLineStealer)", "value": "9ec6b111867aba70b1adad83bf894875dd2e4b7422b9f97767b96134cd63de26", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671218, "uuid": "79550c59-aa23-4511-8b78-b552a4c96378", "comment": "Malware payload (RedLineStealer)", "value": "1f929ca295adb38cd1a198597a6371c556839694", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671218, "uuid": "0cd493fb-2033-46e3-9089-2565cd8892ec", "comment": "Malware payload (RedLineStealer)", "value": "9319bc4b4158dc0c2dd8f50c8e7d831b773b2c656845cd4674ecf349221bf9ff456b44eb059fa3ba1d983b56ab2cf719", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671218, "uuid": "dcaa1932-14a8-4e63-acbe-0a8c388261da", "value": "T150E3D528279F8934D6BB493D6CB19CC076BCEC52A542D70A4ECDF1593A73B80DB116B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671218, "uuid": "c7a22358-8ea4-4663-a742-28981a71f2f8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671218, "uuid": "23b3f7b7-b22d-44f2-b397-5bc8c217b84d", "value": "3072:PV+m5chQmRSZQ1avem1eJwfUuMyNiOhjZR8e8hX:PjENURTIOhj7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684671218, "uuid": "6dbd7bf2-baec-4061-afea-74f5fc164ac9", "value": 148616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684671218, "uuid": "1f44781a-0aee-4d3a-a4d0-ff10c5b797d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671218, "uuid": "4a7bb125-8d7b-444a-bc0a-37d1633fc058", "value": "agent422.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46d3a947-f7b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684658487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658487, "uuid": "ee5ef5ab-ceb9-4b1f-89a9-3f2ee6554628", "comment": "Malware payload (Amadey)", "value": "9ec9100fe9d7497442a05b7c2c4c7108", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658487, "uuid": "b6b7f24a-11be-4de1-9ee7-28a766c1dc93", "comment": "Malware payload (Amadey)", "value": "9efbfadbb7dfa44ffe35c8267e653ac4284adb0a76e43a1c81e6f3a99e65b5b2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658487, "uuid": "de7d5897-a69f-45e4-80d7-f752849f1b8d", "comment": "Malware payload (Amadey)", "value": "3f931296456b1091512525bd728f02129782ad6b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658487, "uuid": "ac6f7405-af04-4b3d-8352-96f0d61379eb", "comment": "Malware payload (Amadey)", "value": "1523de7a5ab2f21fe10060ec3d85190939a8cd61da3e4b7c6439e361ce43152975a330139071a958a5059119d3d5e29d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658487, "uuid": "1a518245-bc8d-4416-afb1-ecfbd889636e", "value": "T1192523079BEC4427DDF2477088F71AC3163BBDA2C93C036A3292685F9DB2681A575327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658487, "uuid": "e34c68e2-2df7-40fd-b53f-91cba51e46b8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658487, "uuid": "9c808181-be56-420d-b2b2-ed25a18ed21d", "value": "24576:byX5uRmJIQcDQQXeXzxnLcNPJOEaEkfh09qVAJPtCthyW:OX56QcPeD5LSPJORJ09VB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684658487, "uuid": "83255dc8-b442-4d78-884b-ea1b713e60f9", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684658487, "uuid": "81221d22-7269-43c9-8477-c27e087dcc42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658487, "uuid": "eba98f4a-6e6a-45fc-bc47-c37e04dee354", "value": "start461.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb289d93-f7b1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1684657850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684657850, "uuid": "14e8512f-c2c6-424a-bd6f-56d0f196cd01", "comment": "Malware payload (RemcosRAT)", "value": "0c0d3cb67b017a0f3cf07064d86f8cf7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684657850, "uuid": "e4df5a55-90e7-45f8-8451-e8e4b1439b90", "comment": "Malware payload (RemcosRAT)", "value": "9f01150d5ad83124137b1326be07d1613ad2c9280f711764c7fda21ff14d0cc5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684657850, "uuid": "a68ba3ff-b3f4-4c65-99be-27755ffef279", "comment": "Malware payload (RemcosRAT)", "value": "b7394821537c3ff9628eba7a2e9fb1dec0ec4ba1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684657850, "uuid": "0a64d830-4ea4-4366-a3fd-edd0b5b7ca66", "comment": "Malware payload (RemcosRAT)", "value": "c20a56cfc3e2888e53d1faa21ee4388437a780186e2ac2b6419977248492a7d635746bb7539be415005399ffc1bae32f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684657850, "uuid": "e97a609e-848e-47ca-9f86-eacaaa6ecf78", "value": "T184A53300BE0D6713E5BA24394D8E56D8BCACFDD70932AFC37788525EAD2B2117D0A5D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684657850, "uuid": "3ebe5c60-03fa-445f-ab55-22bb68ae6239", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684657850, "uuid": "f6ffa322-7495-4a69-8dce-6396c7f37436", "value": "49152:K4J4Er19mn3L1uFaEAYNSOpHZgzN72GicjxDIZfwqBR13:KoslEAYNBgzx2Giv7Rt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684657850, "uuid": "ce7b3175-4fab-4e85-905d-21bbf85ea7f5", "value": 2165848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684657850, "uuid": "a0445565-1830-4abe-b501-0e43cbc19cd7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684657850, "uuid": "b45e9ee7-7c3c-451d-a326-2c01ad7fbf3b", "value": "0c0d3cb67b017a0f3cf07064d86f8cf7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad7206ee-f79a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1684647922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684647922, "uuid": "cdea29dd-43fe-42cd-bff7-db69c4a882ba", "comment": "Malware payload (njrat)", "value": "f605e086ce952ed6b18fbd244ed904aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684647922, "uuid": "dce1cccd-f1f3-400b-89c0-25a7e55245b3", "comment": "Malware payload (njrat)", "value": "9f09479b2efd4707be2208093b81c8e0e523e7c0935fac95ef2b5976377c03dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684647922, "uuid": "fe6258d4-1c18-477a-b2fd-02befed4707f", "comment": "Malware payload (njrat)", "value": "d19889eb74fe7331eff3438863ac5252bc75d2e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684647922, "uuid": "844ca16c-b915-4e14-a5ff-6436ae34cd8a", "comment": "Malware payload (njrat)", "value": "09c94d7658dd4747344a1467546aa45d4ff1b6d3fb4ff30add148cb4093dd2a48925c106e8c5f252ddb88ce38817fee3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684647922, "uuid": "a0bde879-3185-46ae-b326-bbcc34023775", "value": "T177032A4D7FE18168D5FD067B05B2D412077AE04B6E23D90E8EF664AA37636C18B50EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684647922, "uuid": "20a2e571-8561-4ad0-8ffe-463d171ee48d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684647922, "uuid": "66602d1f-6bd9-4443-80f5-81726ff906ef", "value": "384:ouSvEiTbTvpWNcZ0y8fvCv3v3cLkacpjrAF+rMRTyN/0L+EcoinblneHQM3epzXf:dS7TZ38fvCv3E1c1rM+rMRa8Nu82t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684647922, "uuid": "747135b8-24be-413f-b865-7d160a375ae7", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684647922, "uuid": "866b9b51-139c-4c29-8624-6a8f32d1ab08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684647922, "uuid": "7d9f1c6f-5114-41e6-9b15-06814bcdff99", "value": "9F09479B2EFD4707BE2208093B81C8E0E523E7C0935FA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa757d85-f777-11ed-b3cf-42010a9c0076", "comment": "Malware payload (LgoogLoader)", "timestamp": 1684633019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684633019, "uuid": "12ddc5ec-16b6-4ef1-a0d8-fc257180b3b6", "comment": "Malware payload (LgoogLoader)", "value": "8e92c683e644b7e88184427d1b8625bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684633019, "uuid": "58d5d397-7e9b-40b9-a6c9-fbc3f1fefc2c", "comment": "Malware payload (LgoogLoader)", "value": "9f800400f5ed4b80a6d032a437e3b7fc8fa53978854726fdfc0f2737c1237596", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684633019, "uuid": "a948ff28-2574-4d40-a880-671c0abd3a17", "comment": "Malware payload (LgoogLoader)", "value": "8b57d61299f7eaa32df979f54483ff72b47ba8f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684633019, "uuid": "9b600ce0-ba1f-4c7d-837a-7248ca06d986", "comment": "Malware payload (LgoogLoader)", "value": "0d40d1ac4b4ae010cad10655743d3d86014cfd310acea73ac940bc0ae598d7aa335820010b6104e828d8d59e4c35bda9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684633019, "uuid": "b8911830-288e-42b6-a7af-6dcac4cad086", "value": "T13CB4CDCBF1A6B521D9FA9F33ADA128001F7B35B72E99223505C21C661405FF5F382E5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684633019, "uuid": "b368aed2-fef4-4f75-848f-d98bd2449136", "value": "12288:86dbSjl1WZ1oIL0WoxG3arMd9sG3SOH5:PmBMIIoWCN4Hsk7Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684633019, "uuid": "f5334b15-5d98-4302-8461-66fe54750dbb", "value": 505200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684633019, "uuid": "52646176-e021-4285-bb8e-49790436db17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684633019, "uuid": "ff03869c-f98e-42d9-9829-548382c04de6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad08fbec-f7c5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684666390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666390, "uuid": "8c5e9d3e-fc5c-4d7c-88b1-948d0b288aff", "comment": "Malware payload (RedLineStealer)", "value": "31ebb6912da1a4e96a0fb34e7996caca", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666390, "uuid": "0871aabe-12b0-4fa2-b131-4d52730cfe75", "comment": "Malware payload (RedLineStealer)", "value": "9f81978604a8bca324e34318cba126d791a25267718ed677035ebaed4a22ff52", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666390, "uuid": "f73f8d6b-f4f9-47c2-82de-5fd8977633a4", "comment": "Malware payload (RedLineStealer)", "value": "cee94a7b1cd37d3aed00ed80d64a43db5afafc2c", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666390, "uuid": "26e457e6-ae6f-4129-95ca-a376b4a8ce9e", "comment": "Malware payload (RedLineStealer)", "value": "9b04b12792f2998bcc7f667a0a33b2f46569a267e33830c41aaf08c382ab0cbd124d4881541debe871c965b6bc8e7c33", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666390, "uuid": "a98c85be-15c3-46f2-a4bf-de0005321f46", "value": "T1A8252303BBE88536D8793B7548F602431732BDB1DE64D35B7F90A82A1CB2150D5B6B3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666390, "uuid": "9d622a51-cac7-49fd-a123-a1c9ca1f7d4d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666390, "uuid": "61d020a6-f7a8-486a-b9c2-323fed5485df", "value": "24576:3yKbH6N8JrHol2qOwjfCcW45jktQjQePsvM7oXpb:CdN8JrHol2qO8act5ItQjQePsE7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684666390, "uuid": "f8bb9039-9272-4d22-9979-dc4d171bc937", "value": 1046016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684666390, "uuid": "15093a64-a93b-4e5f-a34e-88efddba9984", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666390, "uuid": "9751de86-0fa3-46a7-af4d-681e26bd402b", "value": "423444.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a02103aa-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684680541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680541, "uuid": "344f6057-7084-4093-bfca-ca1c5713d198", "comment": "Malware payload (RedLineStealer)", "value": "b5386b77e412c0177ede534c301a6de5", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680541, "uuid": "da81bdce-f515-4cf1-9208-1d2d25f0246e", "comment": "Malware payload (RedLineStealer)", "value": "9f8ddc5ef73ef40ebe5e422d0ed7ab109c376bce47322d9a643db816515214a2", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680541, "uuid": "e981c972-ad7c-483f-b608-d4f0cc42e88f", "comment": "Malware payload (RedLineStealer)", "value": "bae6165dece62880d0d073fb4a1fa7ffadbf72ca", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680541, "uuid": "a4945bdb-a7cc-4353-b499-a71bcfcb555a", "comment": "Malware payload (RedLineStealer)", "value": "c7d1fd6616ff046365916d77b7c6934d03b8a0c7329e66f08c798146bacdb1152885a7815b3fa5eb8a439999532669bd", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680541, "uuid": "7fcf0542-812f-45e3-a3f9-6e29ce435e8a", "value": "T1AB252352EBD940B1DD701B3508F70A970B31BD619A34C36B2B41C9BA5C73A88AD75B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680541, "uuid": "61a3a002-a2e1-4cf9-8887-c2b565d11bcb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680541, "uuid": "97f193a9-438c-4e83-937f-a3912bff588e", "value": "24576:RyFKEk1dRBpgf7qhxpHvTDHGPSPc4yVuAb3jnGrDAGwJ:EFKvdJgf7qdP/HGqtyVBTGrDA/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680541, "uuid": "10099340-f88c-49d5-86a7-fc9c2672bac1", "value": 1056256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680541, "uuid": "d0540f9d-1cc9-4b4a-becc-958d51147598", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680541, "uuid": "cc55d4a6-c306-4f88-9e1c-7518fd30b9a0", "value": "controls684.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c184ad03-f7c7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684667283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667283, "uuid": "ae97ed71-a6bb-48f0-8571-4e1c8527ad57", "comment": "Malware payload (RedLineStealer)", "value": "b8ce75747ee47cf93ebaab7542b51dc9", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667283, "uuid": "f8911ae9-0ede-4efb-8da6-c5307110068b", "comment": "Malware payload (RedLineStealer)", "value": "9fc7e337a88386b47230631e4e43867f98ae87601b6025dbddd6950fdd0fb00c", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667283, "uuid": "98b5fd14-eb2a-493a-81ad-abe00bb4fc84", "comment": "Malware payload (RedLineStealer)", "value": "8306847aefad532667df1bdaaa5b761efcf2d3c5", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667283, "uuid": "473974c2-09ea-4527-9cc7-267fbb327d34", "comment": "Malware payload (RedLineStealer)", "value": "519b69ac347777a9249942415a2e1065926e18a597d5c161b0c02d9b80f44746a0b079379b8348a8977eaaa17b472cb0", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667283, "uuid": "2c7aca72-9ce2-4142-af18-bbfc67b6ac83", "value": "T111252307EBC80479D8B40B7408F6058316797CAA9A79A72F37469D5E08B6BD03A7137F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667283, "uuid": "e4888fd3-4a83-468f-b7a2-83cc2a15f238", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667283, "uuid": "c2b8da4a-0ac0-4a3c-b7b1-8613f0f777e0", "value": "24576:MyBD/L5v7EcTOOhWJc0OS1JN+pTie2idnm9:7BDT5v/TOOGcG1JNcTiDAnm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667283, "uuid": "a76afc4c-5e38-4fb9-aa4b-8c34fd77328b", "value": 1056256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667283, "uuid": "3d383895-d753-44b6-9023-c475125240d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667283, "uuid": "b895e216-8ab4-418a-9a6f-bbf9cd05b09d", "value": "client549.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f7c0920-f7fd-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684690285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684690285, "uuid": "05455284-194e-4b6d-9215-61cb10f4d1c2", "comment": "Malware payload", "value": "81e53ca389509ff2ed97e663a07276fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684690285, "uuid": "b5ac283a-8687-4000-aece-3f5148457f30", "comment": "Malware payload", "value": "9fc929ce4ebf76192ac2ad62a29755feeed57fae7d4420f9f42acddc42e5efdc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684690285, "uuid": "f382ce5a-ff9b-430b-90fb-82f4867ec003", "comment": "Malware payload", "value": "869c560b4aee299daf9375fe053ee859bb54913f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684690285, "uuid": "501f52fe-51e2-41d7-896c-2650e2a46558", "comment": "Malware payload", "value": "cea7931fe070670ac51f7a13fdfec6ffb93452b5e172254f896b885207877b2b26cca8e988d682b31ffbbba6a52cbecf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684690285, "uuid": "e046a5a6-e03b-4569-87ed-31a36fc8539b", "value": "T15FF2E05B867BE878E075A472A86455C4F670B81F6104CA7F0CDA367FDDE7081BE01BA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684690285, "uuid": "9491dc83-0cb1-4ccf-ac72-6e0eaca554a9", "value": "768:fdXCmnwQozrwoXB2hnYQoaDXNPbOT0wHc4Sv9sPCl:FS2EzrwgwhnYQo0NPbY3YFuCl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684690285, "uuid": "c7ae547a-d3f8-4fca-ad08-9c6f17b54302", "value": 37380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684690285, "uuid": "480f7dfc-0a83-4864-87bf-4df0aa1b75b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684690285, "uuid": "932c2c8f-15ca-4a54-b9fc-7f8b6978c683", "value": "vulc4nr4nsy0u.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ddca79c-f7c6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684666740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666740, "uuid": "960596e2-47f6-4dba-982c-c6d3a384f902", "comment": "Malware payload (RedLineStealer)", "value": "1bb770a7a548ae6e97f986ad1fe997d0", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666740, "uuid": "89b071c8-9e06-4aee-816f-6f17824d6539", "comment": "Malware payload (RedLineStealer)", "value": "9fcc503dde1e5fb14238525502a71921bf1fd43b7d29393ecb0e0ae01e91934c", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666740, "uuid": "1ae313aa-9957-4e31-ae4e-b05848d5d503", "comment": "Malware payload (RedLineStealer)", "value": "05f0a5ef885a390121a9f248e626423ef7ffb416", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666740, "uuid": "ead89fc4-6a64-4eb2-8583-6de2e16aaf50", "comment": "Malware payload (RedLineStealer)", "value": "cb97f01dadd02dfc13d9915b46f2ce8982dde7625731342f6144be57241d9f38bbbfdb378a634f6e3603d2a6fd9bcb74", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666740, "uuid": "6aa9f5dc-74c5-4f09-bcfa-c1bceecbbce9", "value": "T186252342D6EE54B2CDB24B3014FA47C30A32FD625D7863272F9689A61E321C49674B7F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666740, "uuid": "5c76a5c2-2803-435a-bfb2-d242979f2a2b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666740, "uuid": "093e2538-f27d-4e11-824f-6fa7233429d9", "value": "24576:wyIW4ARps0M8CXtMuEX7mzcskvWhoImXOuj:3vXMNq1X75v+ho3Xt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684666740, "uuid": "f83f00ee-5b0d-4a08-af26-d29c87fc0e95", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684666740, "uuid": "5f40f64e-a29c-4e3e-b18e-0e4147855646", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666740, "uuid": "f3e5eac2-982a-4ac1-8929-17715f41db5a", "value": "physics240.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88e0e594-f7a6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684653015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684653015, "uuid": "0f387f52-e2a8-4c9a-8f84-3c3582a3ba6d", "comment": "Malware payload (RedLineStealer)", "value": "372de7c8e5eb07dab0409159d8532de5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684653015, "uuid": "6712e63b-cad8-4506-88e6-942932de98ab", "comment": "Malware payload (RedLineStealer)", "value": "9ffad643b4575d725bfbc94e744edb9452141f289ced510dd5f6aab19c418f57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684653015, "uuid": "6f9e7b74-d93a-47b2-b2d9-9ccae7549827", "comment": "Malware payload (RedLineStealer)", "value": "53d0cfe6aa9590a090091e7f252774703376e664", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684653015, "uuid": "f0e7054f-ed5b-4a20-aaa0-7d300d45ea29", "comment": "Malware payload (RedLineStealer)", "value": "3f67925cba98af6a484f24d22f3fcfe432fd8673e649d0a99674557ae05b9fd336c8eef9837f3e789a26c6c913307abb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684653015, "uuid": "608cdc4c-b8d9-49ff-b90b-63989c2bb812", "value": "T189252392AFECC1B7CDB527728CFA13D71B32BC615A64831733429D0998B2A906974377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684653015, "uuid": "dbd0b5ed-e487-4cba-947c-d56d1321d44c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684653015, "uuid": "971a8666-fc45-40e0-90e4-050c67f387a7", "value": "24576:vySGw9z6mLqFkkN8UQoC+Mp5CKss04o5y9E94bScl0LayHOMzB:6SGw9erF1xG0KqVUEOXl0LayuMz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684653015, "uuid": "82ff15bb-0234-4e8d-aacf-f8f1fb627a71", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684653015, "uuid": "b0a275c9-338b-405f-afa2-d301a9e407d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684653015, "uuid": "3049189b-d5f6-4fd3-ab6b-1b5a4388e47e", "value": "372de7c8e5eb07dab0409159d8532de5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5c48cf0-f7b1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684657922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684657922, "uuid": "e27c7c70-a45f-4262-a7f9-f44dd6038285", "comment": "Malware payload (RedLineStealer)", "value": "164926206a86e090f703f3f2abab8320", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684657922, "uuid": "988ff6c7-c534-4adf-be7f-6a79e4f61a8f", "comment": "Malware payload (RedLineStealer)", "value": "a0c23fc2b6cf2029e0e75ddab245e8285b94ddac18b68f043baa6bb158ccd17d", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684657922, "uuid": "56ce300e-ad12-4b8c-9151-991193cf1db4", "comment": "Malware payload (RedLineStealer)", "value": "77736702224b9421b58c6b75b17fae875fa2dbcc", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684657922, "uuid": "0fcf03bb-ceae-4d74-a4af-d13c0197f09d", "comment": "Malware payload (RedLineStealer)", "value": "75baba205e3e0b8bc5849dfca87c24a2efcc549de4c22900b07b43ff0b1f556d65c73d8aeaec551f153f0a82bb851d00", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684657922, "uuid": "f5eb7fb0-159f-4205-afd0-438d268a8b25", "value": "T11625222775D89133F9B427B0C8F786A31B38BD92E87A436B1747269B4C33481653272B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684657922, "uuid": "e36af12b-40df-43b4-acdb-54e324a9b981", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684657922, "uuid": "20d3c90a-cc9f-454a-9024-2c17f0e8f123", "value": "24576:DyUtHzkC0LS6QaqqBZGztI7E0a8JylRhqwwcHpe:WqcQaqeeaZa0yvz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684657922, "uuid": "ec545c4b-000e-4c21-987b-c21b880af15e", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684657922, "uuid": "563a90de-ab28-4c18-8649-d884fd2612e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684657922, "uuid": "99b6673b-7a7c-4451-96d6-3eecaaae5d98", "value": "graphics.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fc8fda3-f7e5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684679950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684679950, "uuid": "06135db1-eb4b-4e4c-917e-dbd3331009cb", "comment": "Malware payload (RedLineStealer)", "value": "b7274d2538459a566123500fb9b4e02b", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684679950, "uuid": "079ad3ec-3dc6-40ef-8d23-b7f5a86ee254", "comment": "Malware payload (RedLineStealer)", "value": "a0ee30175f95bab69a4fd2e405c5a2056b2a16df1b28b9a3cecb4e3f68108772", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684679950, "uuid": "0630a346-a7c9-4c32-b3e2-071d10d90c91", "comment": "Malware payload (RedLineStealer)", "value": "cf9a282445bd7c60dabcc46ca11e63467c49890a", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684679950, "uuid": "30677bad-f495-4fb4-a94f-9cc7ef099852", "comment": "Malware payload (RedLineStealer)", "value": "30541e08ea9185334335631b67ef97f06e03db73d877fd3913d7bc4bc401383babd77b92743e16d6c3f1c87706afd2fd", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684679950, "uuid": "c6834274-7467-41f4-8e4d-4eafa4ffaf84", "value": "T1C3252353AAD8A462C9B53F7058F343831B367CE02C7857AAB3586C490DB3A816175B7F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684679950, "uuid": "aa297b9a-dd16-4145-83db-64858794d88b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684679950, "uuid": "598c2ac0-8d5e-4c2f-840f-5febe19dfce1", "value": "24576:Jy1n1x6BVbk/+JoTumOAn0nv8A6/uwx+DwlOTTIQoV:8x143b6WGuwNOTZo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684679950, "uuid": "19505659-0cc4-4e4d-b957-1a378e95debf", "value": 1056768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684679950, "uuid": "00720228-38dd-48b8-a768-b9aa0cf5c875", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684679950, "uuid": "8d69757f-9b5c-4a34-80aa-ecf9d901de07", "value": "526526.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e50adb9-f7c8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (TeamBot)", "timestamp": 1684667653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667653, "uuid": "37076808-6da0-4aa6-9bfe-de20043c112a", "comment": "Malware payload (TeamBot)", "value": "65bc3dd6ba6a754bc0a6101b4c26c947", "object_relation": "md5", "Tag": [ { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667653, "uuid": "548f195b-fbdb-484a-9eaa-e0dafca6fafb", "comment": "Malware payload (TeamBot)", "value": "a0fa11e6b40033aca4716146186fe5fb4f0102c86d071920c52e697fd85d4f0d", "object_relation": "sha256", "Tag": [ { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667653, "uuid": "7f573640-6c0a-4bc3-a79f-0f7e9fd6508e", "comment": "Malware payload (TeamBot)", "value": "a34c88fb7aba4258ca6b69813510403b2b740c2f", "object_relation": "sha1", "Tag": [ { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667653, "uuid": "f874a6d7-819a-45b9-9e13-970241a6d465", "comment": "Malware payload (TeamBot)", "value": "4c7c4bbf70fde10472e0efb3b3c2ba82bd9863808c10dedef286c90557d870ad39f38fa3c4867196d2d51d1995abf264", "object_relation": "sha3-384", "Tag": [ { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667653, "uuid": "c082e2ad-f36a-4f64-98c7-ff509e1e2c6d", "value": "T1C0549E1272D3FFB1E56686359DA9C2F866EEF8658F1517CB22042F6B14351E3CA3A301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667653, "uuid": "743cc74c-8d10-49e8-ad52-aa46c29c8769", "value": "c37a1f908dc8ba7c67223959bc2021cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667653, "uuid": "6931e26d-cb0b-4784-9ae0-24cc681d177d", "value": "3072:+8dHswvLqKO4+5iAm/r2d9gmDXADHKE2X9la3GH7fffH5QiTo0VGu:RHswjE4+5Or2TDwH2XXa3GD5TX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667653, "uuid": "b7bb0d1a-da46-44d3-ad4b-fe1110a313d7", "value": 295424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667653, "uuid": "c968675f-f2b1-426a-9fc4-6e9162aa4e62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667653, "uuid": "43881fb7-a946-4997-b2e7-b2b67fa00434", "value": "server748.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14bede9c-f802-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684692334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684692334, "uuid": "02c8bd16-42bb-41df-8dc2-167d6b53beaa", "comment": "Malware payload (Mirai)", "value": "6ebf595766c4f058311d15f1bef10fc4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684692334, "uuid": "59b2478c-a727-455f-9aa5-b2843376b105", "comment": "Malware payload (Mirai)", "value": "a13c6c32970ab169da00da26e5472bceb72705b61252c519c3b0ff4781c08dca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684692334, "uuid": "1b2efe7c-9ca7-49d3-9498-273f20550036", "comment": "Malware payload (Mirai)", "value": "9b894baa60f876ce3553fc311bbf047395b0da0d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684692334, "uuid": "674d40d4-9de8-4716-9052-35db91f2a136", "comment": "Malware payload (Mirai)", "value": "333224cb8fe8d8e036b783a269f62aceff1e837081d4b4e3bfbca94f52a508028d8aeb2169d71970585d6018802373cd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684692334, "uuid": "653a6abc-ebda-40db-aded-4babfc5cfe27", "value": "T117E32A56EB418B13C0D22779FADF424533239BA493E773065928BBF43F8679A4E23905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684692334, "uuid": "08d40a36-7de2-4bb5-8a25-5707228f9c57", "value": "3072:NUO2pptdaELGNHPmtXQ6Ee9ZctM9VP9vsM/9X0i:aO2JdaELGNHPqXQI9WtqVP9EM/9h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684692334, "uuid": "bb1585d8-a21e-4039-ab94-a3bccf09aa62", "value": 146807, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684692334, "uuid": "1deb9d9f-bec9-438a-b19c-767836332d9f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684692334, "uuid": "bb57cdc6-dbc5-4b1b-9803-94bf2208a6fd", "value": "6ebf595766c4f058311d15f1bef10fc4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad10e080-f7f4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1684686576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686576, "uuid": "2dc674e8-ec57-4e61-8573-64ad93e0109b", "comment": "Malware payload (Gafgyt)", "value": "5652be1dabdb60e230c921ada5e8fe8d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686576, "uuid": "c9bc0073-5c5c-4284-8e61-031d19341076", "comment": "Malware payload (Gafgyt)", "value": "a13f2f4828566c70eac38f9013640e216f2d50a617c53f4bd4ba088bed4cde79", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686576, "uuid": "f33e51c6-033b-4c5f-9d51-9688be555041", "comment": "Malware payload (Gafgyt)", "value": "1813fde01e12c80daee83df246b5f8bcdbaca054", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686576, "uuid": "33edf4e9-1a81-42ce-90fd-689686250a93", "comment": "Malware payload (Gafgyt)", "value": "e74294f3bfaf256dea79d83d91c28f34beae977f576107287706936ef2c8ebe293d2d5ea74dd0b6d5252ca4301dcc4e3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684686576, "uuid": "68b617b8-d5c8-4e98-82dc-54bd91b9d9ed", "value": "T144835C49D747CAB3C88307B2029BBA764532F93B5E2E9E45F70D7CB49B124D87226712", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684686576, "uuid": "b3298d4d-5d7f-402c-9575-4673cd973b11", "value": "1536:sQmab6bXPm8VjWWHT0im5t3ItTShKW6GLdUF5MI5Atpgw0UOGHfV+mLI2VOYjXUd:Oab6bXPm8VjWWHT0B5t4tcnBUF5MI5dh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684686576, "uuid": "db08d296-428f-4271-ac61-46f9917a973b", "value": 86409, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684686576, "uuid": "44ce941d-864f-48b5-9107-6109c01c2d1e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684686576, "uuid": "1835e351-0e36-4578-b0b4-16aa5ae57986", "value": "5652be1dabdb60e230c921ada5e8fe8d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a675479-f800-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684691538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684691538, "uuid": "f1ecb105-2ff4-46fd-99be-c323a86f506d", "comment": "Malware payload", "value": "4d7f2790f572a9f5cbf72574115cbe2c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684691538, "uuid": "14797f4c-303f-4da9-a996-9ab0bc3df97f", "comment": "Malware payload", "value": "a16b2ed330238398f4a4b3e7cc1c543d3c4010f929c9842c8398268ac564cc9e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684691538, "uuid": "ec3e5537-cce1-462a-a6c8-72c9712076b5", "comment": "Malware payload", "value": "9211408c0d76dac1e8555e6b9eff9dd60d4dfb2f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684691538, "uuid": "4bf113c3-53fc-4a67-b2a3-3c6c9aec6054", "comment": "Malware payload", "value": "253e940c4f49ee04a7385a6ec6aaa3f9de80b0c274ac525879e21f364e47162d1d3de651f436b737dc2659376f6da920", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684691538, "uuid": "1d57b2ee-fb6f-4bd7-90d6-35f29a5d88f6", "value": "T14F63AE76D9162D94C049817060E8CD7A3B93A5C462A32EBA16F6D2B6C807F9DF44DFF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684691538, "uuid": "5642de39-e607-4131-9049-5e2e7ec0d100", "value": "1536:8/E//8AYFayHKisUM6Sk389F+ThkBw24K66oxkru2POCx6rIwbZnN:8c8NxlsUKk3TTEf/6ou2POlIwbZnN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684691538, "uuid": "1819cb8d-8b27-4600-ac1d-27cafc30e39f", "value": 71604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684691538, "uuid": "be795020-f098-4854-918b-310c734b903d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684691538, "uuid": "ed5fce72-c8f0-4285-92d5-3ce2017c474b", "value": "4d7f2790f572a9f5cbf72574115cbe2c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52fd94d7-f819-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1684702316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684702316, "uuid": "e4f4e0b7-ee76-4292-b70e-cec911d4ce4f", "comment": "Malware payload (GCleaner)", "value": "d9b442cabce72277960feb67274888ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684702316, "uuid": "1e3ba85f-9995-487a-b6fd-800203ac992f", "comment": "Malware payload (GCleaner)", "value": "a1ca328c99d46f70495e5cb5d2072abfc1dfe685d1d3f3486fdb23b404b3e128", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684702316, "uuid": "85595087-2903-492a-b54e-a6edce2eec34", "comment": "Malware payload (GCleaner)", "value": "0f7e6f5037220beb250a877418d961f3a7478d3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684702316, "uuid": "0194cab2-56bc-44d2-81e0-0d98e04601ca", "comment": "Malware payload (GCleaner)", "value": "a9d2b04cecd894ec1f4f1ca0336a52b9c5203f9de06a787535f4dd500544f7703612323942e08d539b295afd21e337a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684702316, "uuid": "3d13f6cb-00eb-45df-819f-d97236292ff4", "value": "T125953367BA21A431D1E1DAF0ED5298B9C8BBB8114D6982DDB3240F1F4F27E483452B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684702316, "uuid": "ad8e819a-97ff-48ec-8d56-5151d35932a6", "value": "e92b45c54aa05ec107d5ef90662e6b33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684702316, "uuid": "8c8fb042-0968-47b8-b5a3-9e52fdee9b48", "value": "49152:BiJNH3tOiDthEeHjSK7dbx7sOemuQO7bTLe7SN6CVs8wuP:BiJmOhEeDljXO7b/x6CCy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684702316, "uuid": "c66a3e6a-b29d-442e-b4a6-ecabb4fdf9de", "value": 1981916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684702316, "uuid": "cd0ef4e3-3f79-48e5-890b-c3aeb8e37e6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684702316, "uuid": "4ca20f4c-d1ff-469e-8266-19a4a6031cc7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2905fe5-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684680626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680626, "uuid": "cb316dd9-6e7a-4c99-926e-9e9afcc009a4", "comment": "Malware payload (RedLineStealer)", "value": "be1daded7fdfe75af6d3d19ea8d05bfe", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680626, "uuid": "703ed197-214b-40a4-a51f-002c82de93d9", "comment": "Malware payload (RedLineStealer)", "value": "a1cddd795b5c1d26c034848329ca8a9265631dbff4872de96c6abd04b5de5c69", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680626, "uuid": "27399dab-eabe-4dea-bf7d-da913a98a17c", "comment": "Malware payload (RedLineStealer)", "value": "efc67f89c7a10557d463e433e475f3f4b9d263d5", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680626, "uuid": "e2174c36-7d6e-4f11-b82b-f3cca710df66", "comment": "Malware payload (RedLineStealer)", "value": "d08bb8c6ba126e7906d28ee161c5bc5dd6c16a1e6d099cb75ea3bc90bfd9cc99667a3504e94eb56c247a0ebd55980e29", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680626, "uuid": "3c8c1097-3ce5-435d-8d6b-c44f3e5a4b1d", "value": "T13F252323AFD89437EDB51770A8F612870B32BDA3C9B982670754AD5B4C337409871B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680626, "uuid": "46bc38b3-1d80-4be3-b44a-cee704490b6f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680626, "uuid": "000872b5-4e4f-4721-80d8-b0268165f198", "value": "24576:WyaTGiV2b/+mq7oripZYqVJOCgwZnQ5tBVT/icYTY9mXh:lg/V2D+mqOiFPOCgOQbBVe1TEi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680626, "uuid": "66bef134-9d35-4724-ae78-36da276a7264", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680626, "uuid": "0a20143b-15d1-4f10-bf5e-6f227e126c7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680626, "uuid": "8c477afe-af90-4910-980a-d28abca58b15", "value": "pdf-reader-pdf699.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0d0752c-f7c5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684666450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666450, "uuid": "51ccc685-2b1d-416b-888e-6a5c080b62c5", "comment": "Malware payload (Amadey)", "value": "59c6c1e6d50e6526a695b3640574c8a9", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666450, "uuid": "19b6d315-e6f2-4213-8cc2-2ff72fb79ec9", "comment": "Malware payload (Amadey)", "value": "a1e745b98db6711782580ba37a2f3abc7a3c340eec88c7839c2544855f684591", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666450, "uuid": "1f522133-f5d4-44df-8f99-af1916138d69", "comment": "Malware payload (Amadey)", "value": "0ad5a4f13ecd52a8f16cfaeb92aa575b47f23509", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666450, "uuid": "6396a4c2-5b5c-4bf0-b0a9-98877d90843c", "comment": "Malware payload (Amadey)", "value": "4ed0fd8bfd4220f1c5fa93828f8dbe93bbd0fb81ef251724dd277652b9dbc6a7426d2050e649eddb42d337031aeaa626", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666450, "uuid": "1601d0ad-e1a6-40b7-9ee6-ab096674b283", "value": "T114252312A7D81532D9B527F029F601A32936FCB59A7483173B67EA5E4CF21D4A13233B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666450, "uuid": "22155c29-c425-4495-97af-5f5c805816f5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666450, "uuid": "a2784ffd-40d8-482f-b22d-9dd9891e6a91", "value": "24576:ryt2XP7Q5fN0hPZssJ1k9a3lsqfi8NlaZcLM:et2XkNWt6Ifi8qI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684666450, "uuid": "89196d76-9ae0-4499-ab60-227897e266df", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684666450, "uuid": "8a30fa83-d61e-4110-b06f-2238bf3f5e9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666450, "uuid": "c096cb2d-35d6-4bfa-9f9d-158ec02fcca2", "value": "DiscoSetup663.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf6811a3-f7c7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684667306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667306, "uuid": "a642ccd2-55b6-47dc-9118-a77c742ef98b", "comment": "Malware payload (RedLineStealer)", "value": "df086323897e78496fb85adad637c6d5", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667306, "uuid": "ea2f65fb-81c2-48d1-990b-0907dc09d5f2", "comment": "Malware payload (RedLineStealer)", "value": "a1f602c25097560f93d391dfdd3e191046238034399625a52670b56a13be5a94", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667306, "uuid": "ab26033e-2b94-4939-94a2-38714c926675", "comment": "Malware payload (RedLineStealer)", "value": "360344014b4e0227dd05eb4761786549a487424e", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667306, "uuid": "f653352d-8b69-4c85-9d5b-bb4cbc5482d1", "comment": "Malware payload (RedLineStealer)", "value": "889e747a6f1a5afef7d7778794a1b13cf9d40aeeaab775c6e9ba4c017fd4ab5aad20e25d8ccc305ed607519c960467da", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667306, "uuid": "83b89eed-4dda-49d0-9a54-0e82d039c580", "value": "T1FCE3D624279F8930D6BB4E3D6CB19CC076BCEC12A542D74A4ECCF5593A73B809B116B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667306, "uuid": "f375bb59-87ad-40f7-bc7c-6b6e6e6e2018", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667306, "uuid": "d02bcb2d-9f8e-4889-a5b5-d573562a576e", "value": "3072:2V+m5cNQmRSxWWAcP+DDXedh7Z58e8hk:2jwCUudh7z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667306, "uuid": "7050c3b4-f628-4f2c-a336-0d608e3157e6", "value": 148729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667306, "uuid": "782f04c3-f187-457a-8ba9-6f5605493d31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667306, "uuid": "392c5b71-9632-4ee3-b4b7-dea59b15ca0e", "value": "effects220.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68b16081-f7d6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684673576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684673576, "uuid": "0fd3c504-fb49-49da-bc22-709b43ab6740", "comment": "Malware payload (Amadey)", "value": "8dcb0dfd6697305aa3f89146c3eb55d4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684673576, "uuid": "0e13b676-0b07-4fbf-af22-a85a93a6804b", "comment": "Malware payload (Amadey)", "value": "a2bbc6a97169a76247817debb24bb39507dff07ae3c28b01d3ccc808d578204c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684673576, "uuid": "6a5e1304-9375-4707-ac9d-2eb1163e15ae", "comment": "Malware payload (Amadey)", "value": "c93efc877c7d4634628fc1661ac4cb28053ef562", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684673576, "uuid": "0b6faca2-f31a-4e8f-8556-4eb7c6e9cc0a", "comment": "Malware payload (Amadey)", "value": "5f3675b66791f0a3d44e2a96f925635a97c05f76a1302998d272f57ea23b8b059776c1e39b47e44ec241408201d2605e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684673576, "uuid": "e0e82ed8-2c19-42f8-bfd2-139fd56317a3", "value": "T1B2252303AAD88071CCB117741CF507D30A31BCB5CFB5A27B7758A9660C3369AA5B671B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684673576, "uuid": "7b532ea6-fd7c-4d4a-b8d1-c57be2c84f76", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684673576, "uuid": "ac2f74a1-9150-427e-8270-cf328f7450b7", "value": "24576:ByU2KB3ZHxCEqyrfvqBjUv3LeKzdcPrXp62MDZ6:0UtHxCEqyXv3LeqiTXE2Ml", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684673576, "uuid": "cfc82792-edec-4486-9bad-178b164c38c8", "value": 1046016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684673576, "uuid": "a36cc391-462a-4de9-917f-7d64d1ee992a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684673576, "uuid": "afb9beed-7589-43cd-9b11-1e937a823ae7", "value": "8dcb0dfd6697305aa3f89146c3eb55d4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "234ef314-f7c7-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684667018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667018, "uuid": "453d4194-3716-458d-961b-0beb9775603b", "comment": "Malware payload", "value": "6d13992dd20f670cd714b2e0716e92b2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667018, "uuid": "f5b520d4-df48-4af6-9501-a0e57dc6b27e", "comment": "Malware payload", "value": "a2c2a58995a8d79c4af92a7117d9c3ba5eb2e3b0600a5871b81558fcd7aeb97b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667018, "uuid": "ba5cf5ac-9cd7-41a1-b6ff-117fbb86ab4c", "comment": "Malware payload", "value": "8b7e1ebe462d5d4de65d868f2a881d22f9f94850", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667018, "uuid": "8697d7ba-a237-4822-b7ee-38c7b1db7708", "comment": "Malware payload", "value": "807a1046708ac472940721a26a61d79bab0b9f0da56db39ebb57871ae924d64bd3c41cd8c2b20060b8563245388104cb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667018, "uuid": "630105f1-d688-4761-9666-a89a605d7f96", "value": "T13BC25A85D943E8F0F81903F458629395DF31E976AE31DA47F7A63632E422B1197033AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667018, "uuid": "9bd4561b-ce3a-4d99-bb23-c59ad8dc2afa", "value": "384:fVlqZTOV4yZ7UtEhJRmZMiKXK3wO9wocgPL7XqwYWvnslVkPEr:dEcUtVZAI97cg/XqwYWvsTkPE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667018, "uuid": "294284ca-3e03-447f-a46d-2794acfeacf1", "value": 27384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667018, "uuid": "b4458bfb-9997-4d24-a541-199e0f210595", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667018, "uuid": "dfbd14e6-040f-4e58-bc5a-934eee608cc6", "value": "x86_64.a2c2a58995a8d79c4af92a7117d9c3ba5eb2e3b0600a5871b81558fcd7aeb97b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4f8c9d3-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684680576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680576, "uuid": "73f2de2b-eab8-4aac-b76c-d15d8a8053b2", "comment": "Malware payload (RedLineStealer)", "value": "6ce2da603612b42a1c0da2142d675bad", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680576, "uuid": "3be2d87d-1553-4d8e-8725-31a4a039ff9c", "comment": "Malware payload (RedLineStealer)", "value": "a357fd36ecf5806eac9f5cb6069d16dcb71b3c43fa9db3741be06a435a43d676", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680576, "uuid": "10cce053-54e4-45b6-b19e-4240d388ff33", "comment": "Malware payload (RedLineStealer)", "value": "67cfbea5c65e78a8049b7d96ab7e6d0c29fa089f", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680576, "uuid": "5553a553-3519-4bfe-8054-fd40b694b299", "comment": "Malware payload (RedLineStealer)", "value": "eaf4e313455a7b3fd41054451d36796a4712ae714b7c98f04f18b0e23ce444e63d6613360a816e73d1cd88abb9a94ed1", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680576, "uuid": "0e17a925-e4cb-4926-a26f-c24e864d24ad", "value": "T1B82522532AD80533DC691B3420FB03D70B38FE949AB4933B3B84AD665D73590957AB3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680576, "uuid": "21df5fe6-1704-462c-95bc-e8007ab28f98", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680576, "uuid": "cd44de4d-6826-4e3e-bad9-17d9218948f4", "value": "24576:zyrjs4tgytXTJ0TeqAL7ERoQMcj54yvbBo709CHRMj:GrohytXTYeqe7nncWyvlo7mCxM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680576, "uuid": "2612ea5e-8bd4-4253-a908-7c58b08b5e3b", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680576, "uuid": "a8d9e932-3c44-4410-8e74-4d54db7f201c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680576, "uuid": "6c895c93-ceaf-43ff-bfbc-282d5f46a434", "value": "finder757.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15f3762b-f809-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684695342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695342, "uuid": "54e85d5c-a264-4bcd-b02c-4ae4ba8067cb", "comment": "Malware payload (Amadey)", "value": "cc161d122da1e6b572f6545617599b7e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695342, "uuid": "5868ddfa-669c-4911-a358-e2210f66f8f4", "comment": "Malware payload (Amadey)", "value": "a3775d5d657605018dbec34d465d9868086e41b3e4e369a5bb22cdb61088cdf6", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695342, "uuid": "fa7ef8fd-97b2-4481-a2fd-a2b20fbf87a3", "comment": "Malware payload (Amadey)", "value": "a02ec2aa761bc685f6775b5a7238a245fb3bed10", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695342, "uuid": "7e046176-6b96-420c-8732-ca69f2a3e807", "comment": "Malware payload (Amadey)", "value": "25eaaca1f214b7065a85032149e57b22041278d581a8d69db5f6de911a13ba89f906b8622f31f04feef4eb0ed17736df", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695342, "uuid": "ed7f71a7-464f-4671-9a79-3cc8ce2fffd1", "value": "T1DC252316E6E84473D9321B7499F702D30A3B7DE29A75D77B1785380A8C72BC098B2367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695342, "uuid": "e8cdcd9a-333c-4bac-a737-4fb80172794a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695342, "uuid": "93995cd5-356c-482c-a201-8a41fe9f70eb", "value": "12288:JMrJy90sSLeGeQVF0pImTRq6Y05a8rsg2D8uQRYnTztOVbtw3KBAs1M+vRHf+Sw2:8yOKp1q5/4uQRWT01tkKBAsBYSwW/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684695342, "uuid": "d7b03761-b2cf-4bb1-be33-98db6fc29161", "value": 1045504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684695342, "uuid": "b01464b9-8e68-440a-8bb2-55791b0c1100", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695342, "uuid": "7bb463a0-4317-4b01-b604-266485849d63", "value": "player186.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "449ac09d-f7b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684658484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658484, "uuid": "c05ca63d-27c9-4c7b-b7c2-dd9d5dbcaf7b", "comment": "Malware payload (Amadey)", "value": "30366573f24c1c22725694a2af5143b9", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658484, "uuid": "be65c780-aeba-4050-9893-cb4fa2db79c5", "comment": "Malware payload (Amadey)", "value": "a440e5433c6d1a4db6b0bd770e771602bad717f7bc1757659e156bfcb843e360", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658484, "uuid": "44f479b7-2b7f-434d-bb45-658a2724d4b0", "comment": "Malware payload (Amadey)", "value": "07a2f494efa938bc2d4292ad9e2b9e8f332aed1d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658484, "uuid": "1153c003-3d53-4e05-aa98-1eac30ecafef", "comment": "Malware payload (Amadey)", "value": "014d50e5804c4348b97a51df34eb9ad0e3bfa1cd205caee5a1e4931b90a6db2eed67413b789762137218779897515b00", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658484, "uuid": "47c3609e-3a64-4190-81fa-208c5c2ec9bb", "value": "T15A25234167CC0823E9E51371A8FB02971F377DA5A67C834F2B499C6A4DB3684D1B2B1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658484, "uuid": "387b17dd-9a94-4f76-82e4-28b82b93fbaf", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658484, "uuid": "e65615c3-5096-441c-9501-0ca68362eb0f", "value": "24576:iyWdsJNtTZm9W6F+6Hm5WBY4u/UGfNHG31AlAfToZiA0:JZJ96ZHTfu/U5DfTki", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684658484, "uuid": "40a2f77f-3490-4557-bf24-4289f92d672a", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684658484, "uuid": "9a851f82-58f5-4562-8104-e6a259436ecd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658484, "uuid": "319f050a-f037-4ee0-a837-df9d5f73bbf0", "value": "router594.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "274c160c-f7b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684658434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658434, "uuid": "38fd49bf-3760-42e7-b6b4-10e07d9d1430", "comment": "Malware payload (Amadey)", "value": "b19fe264f3dc934f7aedf8c152031267", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658434, "uuid": "3d9915d9-bee5-4780-95c6-6fdb1d7b9b80", "comment": "Malware payload (Amadey)", "value": "a45fcd80c30988bf96a62955ee8f5dd34c59b87c0e55f531c34130d36792dfd4", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658434, "uuid": "93f96e93-d51c-467e-a81a-ae230ef48a7b", "comment": "Malware payload (Amadey)", "value": "aa407cb5a532440a610d77b74a036af184b2cfbd", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658434, "uuid": "5f81d7c9-3dab-4fc6-89e4-dc59fc7843e9", "comment": "Malware payload (Amadey)", "value": "6b6e896c33c6864a6c0cd237562a60657f0d3ffa69c21e858d8bd83dbd1c37bd7599893775107407dbc616d2c8672370", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658434, "uuid": "cc8057c0-ebbb-475d-9061-612284f6e8d9", "value": "T1D125230363DC9122D97567B59CF207930F33BDD19A7D822B3A85E99F9C729C048B2366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658434, "uuid": "0545f71b-af39-4840-9a74-1d051847d3f8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658434, "uuid": "f34220fb-5d16-4866-aa65-0dfe84101e71", "value": "24576:JydgPzYGpEtHRPM0qw505YLcXP+VQc5B5qQT8g:8dg8GpEtxk0qw53LcAQc5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684658434, "uuid": "fd9a77bf-1e19-497d-a932-e85b3af5e591", "value": 1046016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684658434, "uuid": "dc3f91c8-e254-4d60-9179-d0234859eb71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658434, "uuid": "7ac5296b-4cac-4c3c-864d-ce3ff37e140f", "value": "encrypt396.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "887c600c-f7e5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684680072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680072, "uuid": "3a87cd3b-0d98-4fbf-9c76-ccd2053fc351", "comment": "Malware payload (RedLineStealer)", "value": "c66c42049a7417d8653b6f44687baad2", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680072, "uuid": "80296614-0d6c-4244-a8a2-452f8106c291", "comment": "Malware payload (RedLineStealer)", "value": "a4bec397e995a55f6dc68b0a0cdc524b8bee172be63bccbde6c28d19812ba7cb", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680072, "uuid": "d97378ba-b9d4-4558-bdae-6e044ac296ff", "comment": "Malware payload (RedLineStealer)", "value": "070bf2111d446d852236bc4369b118d4776df52b", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680072, "uuid": "2e82e4c8-3b1a-49f1-a30e-18926d607960", "comment": "Malware payload (RedLineStealer)", "value": "22406e6423facc3cf1dbe8a6b1f8814f4ea1a2f95f9728ebfe8e8ddaf397794cbf4d36ef1674408bb9d1aa2406a4cb76", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680072, "uuid": "d09d93f8-a8ab-4a82-b3ef-bbf499975118", "value": "T1A3252312ABD8A076DDB22B3015F6079307BABCD4AD39863B3355A95D0D739C06D7232B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680072, "uuid": "da1815a5-571b-4019-81d3-5efad8acb031", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680072, "uuid": "433cb8dd-855c-42f3-9c43-a9d5ca6c5ccf", "value": "12288:fMrny90FKL6sYX2zoH8NeX2Rq4MMOsykmE3Q3FgukXeBCvq+100Z/XWzKezPwPqJ:4yg/sYXhHBXeqLM4zDVgljOeWzeoE7s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680072, "uuid": "70ef9c25-eea6-4f6d-b561-a73c42e56ac5", "value": 1046016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680072, "uuid": "059d4311-7f0d-4afc-805c-47aff88e2d29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680072, "uuid": "1cb990f1-cd78-482c-8f79-1ee80eb6bbc9", "value": "interface846.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a624b988-f7c5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684666378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666378, "uuid": "653f4d04-3e3e-4dd0-a950-ef6b4918117f", "comment": "Malware payload (RedLineStealer)", "value": "d55cf446274f65272083e413315bbb87", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666378, "uuid": "1183d493-b8f3-4744-931e-b4e046613043", "comment": "Malware payload (RedLineStealer)", "value": "a51ce6538c362311c8b0d9937afc85edbf3ce14f42f2742973fc916774f53c21", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666378, "uuid": "1e70cea9-133c-473a-a343-215a07f80929", "comment": "Malware payload (RedLineStealer)", "value": "64f2e2a216d525e5ca9ca50787e2f427e6926dea", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666378, "uuid": "44856842-204b-4b08-9b07-38a5a99f754c", "comment": "Malware payload (RedLineStealer)", "value": "9cea89bd55864f27e7f9309924f58752de340f1bfcaa731559550de87f0936b9cde7f95ba3759db6b80dca0bbc8c1832", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666378, "uuid": "015ae3c4-0f49-4ceb-9691-8865653fb8b3", "value": "T14A2523235AF84676C8763BB058F206A30736FDE19838039A3759DA498DB2185FD36737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666378, "uuid": "67ac1654-ee89-4520-a543-645ec27e757f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666378, "uuid": "7b7d21f9-5c3f-47ee-b0ec-63849dc596ec", "value": "24576:kyRCON1f6MCqw/HGV3DB1MFKltnt9uEGsh5fn48mi:zRCMF6MCqwPGV3DB2o7nt9Thy8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684666378, "uuid": "ba45a99f-5b4e-4445-b6ec-914529daea44", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684666378, "uuid": "5befd19f-f7f3-4e2c-a1ab-1b9bbbe012e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666378, "uuid": "2073f0c8-f0ec-43ee-a933-4c4741763f58", "value": "32332948.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b863e556-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684680582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680582, "uuid": "c20707c8-ecd6-4e93-9737-1047e10b0164", "comment": "Malware payload (RedLineStealer)", "value": "1a873483aa47d1133d0620c979eab2e2", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680582, "uuid": "67015579-3b80-4e55-bba6-06296d7df325", "comment": "Malware payload (RedLineStealer)", "value": "a55085f47ded7d7e3f7d5e47643c999b3c03c46100ac70ba3057535d46bd7974", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680582, "uuid": "a355d662-28b1-4942-82c5-9a4a58331550", "comment": "Malware payload (RedLineStealer)", "value": "c56d15895be38c0af2e12825877ecf00c9c38783", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680582, "uuid": "b6f0c83f-b9f1-4396-ad98-625780d21235", "comment": "Malware payload (RedLineStealer)", "value": "4887e3242f1cc1bf38f054a8906585ecc0ad1400421da17576de46e7932bec5185c845e4644b85c3cb5f1c0e09eb1b63", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680582, "uuid": "8e288d52-70f8-49b3-9e30-7fe432a035ac", "value": "T1A8E3D528279F8934D6BB493D6CB19CC076BCEC52A542D70A4ECDF1593A73B80DB116B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680582, "uuid": "3b2e3cd7-bad4-47d8-af03-83878e8b7e0a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680582, "uuid": "6f813d91-c24c-46d6-8c75-4e9657ff7ef3", "value": "3072:PV+m5chQmRSZQ1avem1eJwfUuMyNiOhjZR8e8hX:PjENURTIOhj7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680582, "uuid": "c2b5dcd3-1929-4b07-82ba-e71b75484a54", "value": 148615, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680582, "uuid": "b1c45319-b641-465d-96a5-5fc44af169d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680582, "uuid": "87dbc7d9-5fbd-459b-b549-8aedb3cf8892", "value": "handler335.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9342fed-f7ec-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684683160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683160, "uuid": "47f48100-76d9-4af4-b661-43ee2ded429c", "comment": "Malware payload", "value": "a640260ba278c87b233dfd6995d48189", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683160, "uuid": "68ef0868-19f2-4370-83a6-dab206601257", "comment": "Malware payload", "value": "a56259f8cbcd94f33b6f61af3e1701061f18d8f6bfe71ab11fbc46a5ce56ee78", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683160, "uuid": "20e83557-67f2-449c-a99d-7f62b03b6991", "comment": "Malware payload", "value": "293e4c8f2a763859325a9058ca2bcce37991d9ba", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683160, "uuid": "60180996-9442-4957-b978-01fa15c5eb19", "comment": "Malware payload", "value": "73225ed07ff1b842904b30ffa05d0859515bb5223932b244e7ddb64f84c55a0d19862921c5316782d236d62c405f5d7b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684683160, "uuid": "8de0190f-7087-4994-a984-38f3f601ce7b", "value": "T150D3D617ABA15DBBD80FCE3302E64521109EE49613957B6BB178CA1CF74BA8E09E3D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684683160, "uuid": "8a3f93f8-13bd-4a2c-8216-e450b935f2a8", "value": "1536:76ejNyUhayRB4pa4ggYJ7vOTlX7xhxPYsXm/KBgvYYiCh:74yX4pNLplhx3mCBgAYiCh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684683160, "uuid": "a024e920-9ee1-48b0-8cae-381c210886c1", "value": 140059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684683160, "uuid": "16a0aa36-da11-429e-9926-d349838acbe4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684683160, "uuid": "977443fe-7250-4d5e-97bc-67f15c20eed8", "value": "a640260ba278c87b233dfd6995d48189", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6ab21c3-f808-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684695209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695209, "uuid": "bac09334-0fdc-4c02-8803-37ed5776bf93", "comment": "Malware payload (RedLineStealer)", "value": "241bb8c68042d77970644963d2c0c375", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695209, "uuid": "0bf766b1-5537-4648-a625-9fd970a97661", "comment": "Malware payload (RedLineStealer)", "value": "a586ae4cac2e99158ea04238c8583ee36bf18b72f678651efd9c6186a887de4d", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695209, "uuid": "dd5a9b28-d9cd-4832-9692-cd92345c2b8d", "comment": "Malware payload (RedLineStealer)", "value": "9a0e437f29d0077d2f412cca0e4ec482e7c6a238", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695209, "uuid": "3080fc6a-e132-465f-94e1-262af0421618", "comment": "Malware payload (RedLineStealer)", "value": "2d75edc9dbb4a06dfd8781ae683ec09ddadfac39852c6817effcb8380d7c2fcd065099b9cfa773afc36107d959450775", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695209, "uuid": "07946ed3-0b18-4906-aeab-6dfb2b88a058", "value": "T15C25234756C844B2EEB237348EF709C31B79BCA459B492673781646FADB31C0A5B132B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695209, "uuid": "249860e9-4db0-4d63-9def-44f824d8866b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695209, "uuid": "df03099f-ad73-4f05-b192-ad14e47732c5", "value": "24576:jyq/UhuZeYus5qvG1BDqxdEJ4RqvVAV0vkWlD:2ThSeYn5qvGT2T0M0/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684695209, "uuid": "307522ca-772d-4913-bc25-22dbf34c1834", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684695209, "uuid": "fcafd543-832a-4c35-be44-cf1eb4f47eed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695209, "uuid": "4f69d879-26e1-46a9-bdcf-38a60f8d085b", "value": "248990s532.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f155e9b-f7c5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684666366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666366, "uuid": "a28a6364-ca4a-4516-9789-bf90670fd1b6", "comment": "Malware payload (Amadey)", "value": "2d612a2fe9ca705de28e3cbd4338da04", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666366, "uuid": "6277075d-f337-4234-b694-02a3bb9e0bc6", "comment": "Malware payload (Amadey)", "value": "a5988a1af6261bca51896295c677028a9c9b175c5fa9338e2b5aee4bf6a859c0", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666366, "uuid": "3f903473-4037-45b6-b32a-5c3f9fff5389", "comment": "Malware payload (Amadey)", "value": "9b9a0343905bf7916b90758109a8ef445ed84bf4", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666366, "uuid": "2d20742b-c680-46a1-b21c-90e1d1e6b511", "comment": "Malware payload (Amadey)", "value": "049df928771b083b1d707eec4e85c532a1b7499f4ae7608103cc47bd33b3ab0334b51ee82ecc07dd45324a0212d0afbf", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666366, "uuid": "d1d93cd0-459c-4ce6-beb4-f6b596e9ab8b", "value": "T1A2252313ABC89622DCF11B7044F642930A39FD718F7C56476B992B6A1CB25C1CC72B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666366, "uuid": "c4976168-948c-4c63-a3f1-2af4fe5dc815", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666366, "uuid": "e1f656a2-9121-4e28-bb8d-fcfd303c8a31", "value": "24576:uydh4YWW8ZWDqQRq5Zwr68kelpL4zNTXaCkaa3:9D4Yf8ADHRq5Zf8d7QTqFa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684666366, "uuid": "e6e9ee7d-e3d7-4a72-a0a6-79c8370aa7e9", "value": 1054208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684666366, "uuid": "fe2b7cad-aa1e-4ee4-869b-3680ab784484", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666366, "uuid": "2f4b9750-6ca9-42c7-8316-f862157cd4ba", "value": "32332678.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd8af1cf-f7c7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684667303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667303, "uuid": "6ab8d1a4-5ff6-4896-8807-d634fc88835a", "comment": "Malware payload (Amadey)", "value": "0356e31b685a9c13c943c5966dd8ecf9", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667303, "uuid": "e932e3a2-2c27-46a9-a078-302fb54da801", "comment": "Malware payload (Amadey)", "value": "a59f5159b44aa7e6de22213de0875eee977870259853bb8973b7f98cd8aaead6", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667303, "uuid": "fba39ccd-a21e-49b4-824f-361f0bd03055", "comment": "Malware payload (Amadey)", "value": "37150fe99af34f20b8a9ea14c413c4189e36fcc1", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667303, "uuid": "771aef9e-940b-47a1-9bb3-a958c525192b", "comment": "Malware payload (Amadey)", "value": "65dabc5ebd8b06494ab2db9a8718db5cd07c0f97aa3570faf202391f5147828218f54dd21b9855c735ba4bec2666da08", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667303, "uuid": "5fc38c0f-df4f-414a-b265-36a4a6d48e3d", "value": "T1B62523039BC89032D5B663719CF313D7093ABD908D31A21A3A5A985F4CB39C0AD76B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667303, "uuid": "fb58592f-5438-4719-ad16-daeb8f0ccea3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667303, "uuid": "d21ce4de-621e-4687-a4d4-1c18c5cd8669", "value": "12288:OMrsy90wjpIUenQ0Xmp39ZD28mxKIf4RqXBW7bIT5vW0Gt2I6nknGYdBW1tRydkK:6yZjpxeQ0u+8Ioqx+bAQ0SOkbKnOYUZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667303, "uuid": "72d53f42-c39e-48bb-a012-3ba264528816", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667303, "uuid": "738bd189-9c58-4c38-9baa-731b7d89e130", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667303, "uuid": "e034d97b-cc82-467c-9a32-20e118ce9f51", "value": "driver435.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd639036-f7c7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684667384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667384, "uuid": "ce2a5209-1880-48b4-98f8-8db9dfb4d914", "comment": "Malware payload (Amadey)", "value": "3915c699020c16e0bad449d901d541d9", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667384, "uuid": "e666b605-cb2a-45b4-898f-ba918672d1b2", "comment": "Malware payload (Amadey)", "value": "a5f9cd1dd5a852b0fc03e7e2557dafc3affe1a20f79c561465298c9131606635", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667384, "uuid": "6eee5a70-4a1d-4d02-ac1b-7a2d058328c6", "comment": "Malware payload (Amadey)", "value": "e3e2687bb9c1f0789c298307c3f51689d8eebbc6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667384, "uuid": "9f1b9f82-a20b-4767-a793-41b5bddadb2d", "comment": "Malware payload (Amadey)", "value": "86e42fca9422d124aee653d68084ed4a647bf673bb81754e2ee29634fb81caef86cc6261f607e25f2b4ba4c9b75a1f1e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667384, "uuid": "cd6e4569-8b94-4f1e-af80-1953b2c4328f", "value": "T1F9252316A2DD8873DDB45B7045FB57830738BCE1AD78A7BA3149EC1D0832AD4E5323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667384, "uuid": "9c445d78-65c6-49ee-bdc8-872a1a8daa91", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667384, "uuid": "cfea2434-5c45-4932-8cb7-3175cceeab64", "value": "24576:1ybTux34RJFiFdaqi7GWi+mJ2VKqGjwlhRwS/F8T:QbiuRJ2daqUGWi+mJ2VHBhRwS/C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667384, "uuid": "4a1798b2-8d09-4a61-80aa-9e7749e9dd95", "value": 1046016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667384, "uuid": "b6cba351-e221-429f-91e0-b2d524b9ee9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667384, "uuid": "e406139e-50af-469a-bcf8-40a6d313b014", "value": "preview844.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a628fefe-f7b1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684657788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684657788, "uuid": "11a04942-4d29-42d8-b4b3-5dbb400e853b", "comment": "Malware payload (Amadey)", "value": "d60de70194d08e3ce89c929648b80ac2", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684657788, "uuid": "9405a484-9019-40e4-9c80-eb967cb671fa", "comment": "Malware payload (Amadey)", "value": "a6505a14f33cee63d607b878834968c9a18b5f36676c40ead24df96e13ea54f2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684657788, "uuid": "d8d492dc-5bb7-4874-977d-e05402a11032", "comment": "Malware payload (Amadey)", "value": "93138fcb8dce6241b81a3eea01d9dab43d950f1c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684657788, "uuid": "6242dd2e-5e7b-4fc7-818d-6e100e449030", "comment": "Malware payload (Amadey)", "value": "3741c2c40da5a9ae1c18bd4c6639b2daa149924f9b9c7d9043a1a9db7c7c053b2dc87dcb6566ad71a0af77d28caae9a6", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684657788, "uuid": "15684473-b588-4f49-9eb1-8a350e9cb604", "value": "T1BE252323B9DD9072E871273064F602830F397DA249B4D39B2749A95B1D72BC49C76B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684657788, "uuid": "0d4025bb-f612-4ba2-8c24-19b8d60e549c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684657788, "uuid": "5702b938-3128-4e78-8670-599faff1ace0", "value": "12288:uMrVy90oc+qEuY+xymS2fuuFMF9snGRqvoNPng0cxuG3jAEuBKmU8tXCxOuNYzTA:7ygcJm31F6uuqABgFIGRmXQuzTbKVZb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684657788, "uuid": "2c1c2275-c6ff-46c8-a23a-85a31282de40", "value": 1056768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684657788, "uuid": "a67bd6c6-78da-437e-84b7-fc7109bfe382", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684657788, "uuid": "6e2f13ba-ef34-4c42-9af4-37a82f1e28c8", "value": "86968.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc14681e-f771-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1684630364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684630364, "uuid": "e7c5d2e9-affa-4cfb-9656-a2157dec6125", "comment": "Malware payload (Stop)", "value": "36a3cd0b7563af60beeec0bf41e6c3d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684630364, "uuid": "6a84384a-862a-4a3a-b783-2a70cd901060", "comment": "Malware payload (Stop)", "value": "a6a67fa5e07abe224568f509768ca246d95a3a0c5ee11bfeea7c9760c6c6a371", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684630364, "uuid": "0d9db0b1-829a-4c2c-b64b-c3a5197a5cbb", "comment": "Malware payload (Stop)", "value": "0ca93fe921715a0dc33fdf2cd549ef34912a48c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684630364, "uuid": "7e8978f7-bcb0-4731-b511-96f5495fe309", "comment": "Malware payload (Stop)", "value": "bf8c7e10108c67a28d2ddff5e209a2fef7b3b6519369a33833d2b53551f0e955e43a2f294589845c6a38744f178e54d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684630364, "uuid": "dda3dd9b-e541-452e-940d-a892c04b27c6", "value": "T1280502326291E871EA164675CC6AC6FC652EBC51BF181AC773842F7F19723F28636309", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684630364, "uuid": "0c2c47e2-3bfa-4784-8d3a-2050a1c80fdb", "value": "bb27c4958c76443fcfe46f9765d838a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684630364, "uuid": "bcf453e1-a065-4404-9496-e2cf183a81d1", "value": "12288:VcurwyCz8OFgM0fESOy0tBQuq4unfa8jq7EGZOj7+zPikl70cIc/pavc7:VcQuz1FKESOy0fun5j3GZOIPllXpec7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684630364, "uuid": "efc7bb4b-25f3-429a-9f53-a0265380dae5", "value": 805888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684630364, "uuid": "7c6b808d-1cd2-409c-8a41-8ea96eb1ed83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684630364, "uuid": "b2bdfb68-e9e3-4f14-8b1a-40b792171912", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2582b23-f800-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684691793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684691793, "uuid": "0ad51d83-cdce-4c12-9daf-de1d2ac5936d", "comment": "Malware payload", "value": "5ad1296b80eb92377562ab568f711145", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684691793, "uuid": "db489e1d-3337-488c-9782-5494a8303d0c", "comment": "Malware payload", "value": "a7451d615fd2634da4f325c8e8ae505c2d86a8ff29eef6e13235b64c9244d393", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684691793, "uuid": "db9e1ae8-15e0-47a5-9211-9b90d2d5ecb6", "comment": "Malware payload", "value": "a84046969b0ad0d3fa7e58679655eb3021d4713b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684691793, "uuid": "33b5b508-2b4e-4148-a556-f45a2184d6ca", "comment": "Malware payload", "value": "1990ac00fed195d637be03203db0990dd7d5c46a61e429cdac6430989eaa484d2143ce8be11e49cfd945d32e0dbe039e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684691793, "uuid": "6c0e3a12-2c22-4084-8d5d-b189c5206677", "value": "T137336C85FA83D8F6E8930530103AAF338B72EAF93165D642D774A531EC52502F617BAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684691793, "uuid": "fc49c942-c7ff-4071-92a2-f3cec1554062", "value": "768:uzEoy+WMUB96iw1C7Qdh5wjvBtxVBF1FXy7YH9P2/mi68eJo3M20Y+T+TrfIGlv:EEoHWMnZ2QzmjZ3jH9PQmiU8l5Trf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684691793, "uuid": "c3c7b6ff-62f2-4a27-8181-55b836eb2ccd", "value": 51348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684691793, "uuid": "ec3a0868-d34c-4597-8a3b-55e4bfdb1556", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684691793, "uuid": "cdd62545-935d-4017-bb65-6a3a8432273f", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82de9f77-f7e5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684680063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680063, "uuid": "6b071efa-dc15-49d6-97cf-da1efa011d5d", "comment": "Malware payload (RedLineStealer)", "value": "e8985a7b1326c45e32dd4ca17e2ea47a", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680063, "uuid": "b552b950-6e8b-40ed-b16b-cf9e1eb1003f", "comment": "Malware payload (RedLineStealer)", "value": "a77f5d3a96b54750000a82c1a7242c0381b57e85c66f6bf7d630eff6dbc29af4", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680063, "uuid": "31be49b8-66e0-4c0b-bf27-d4146455375d", "comment": "Malware payload (RedLineStealer)", "value": "cc153c2e1ef5987e3cd568895a2adbfa35303420", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680063, "uuid": "7e600c53-eb0f-491e-aa98-40e8b76f7aa7", "comment": "Malware payload (RedLineStealer)", "value": "e07fe211b319b18a3d96274cb788b02980d3e7bf83ffb4b7befd677e14360a8a483461e797578abc66a80c40aab0f45f", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680063, "uuid": "ac599e48-0fcd-4c6e-b691-17238815834e", "value": "T1DA25231AAADC5052DC793BB185FB06A706323CA08AB5C2273796F5571C73BD0987237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680063, "uuid": "2b7f7e03-46c3-440c-8111-c0743638c9f0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680063, "uuid": "c3242487-e9e0-421e-8444-5eefb8f65e2d", "value": "24576:My2o/u6Vca3FqSfTT7OQRQoVcoAft3S/TkyRf:7oozFqMT3OQeoVAf4TkyR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680063, "uuid": "2bf23e83-632f-4836-ae0b-cb0dc8c3d665", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680063, "uuid": "cec959c3-a969-4d5e-8a26-5ffa7dffae7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680063, "uuid": "75e49dff-435c-4e7e-b4a5-cdf6aca1b76c", "value": "generator196.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "926a98c3-f807-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684694692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694692, "uuid": "be95352b-50f7-4579-b09d-5dc59f8f4eca", "comment": "Malware payload", "value": "3cba32e10b5c4aeff7298e7860432eba", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694692, "uuid": "bb12dd2f-1df2-4aab-9b7d-cf657313a8ba", "comment": "Malware payload", "value": "a7c958696431ff094004208880d9348f7ac25d4b44b55ba5b8d318ae96aa8c5d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694692, "uuid": "68b962fd-f55d-4821-b28a-3ce940c46863", "comment": "Malware payload", "value": "58bdcb8c85dfbc323e1413258b5d42780986e31f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694692, "uuid": "be3ea438-85bf-4910-9c55-f136600bc403", "comment": "Malware payload", "value": "d2698b79d3722322ad1290a37cfd47079353cf6de35ac4513e3fa2c8111cf5a17288916f52425941f92c19491167de62", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694692, "uuid": "1e024e25-8802-4a90-b19e-4259affb5997", "value": "T140252313ABD85572DC746B315DF3124B163FBCA0AD3883AB1789999A0DB2D842932377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694692, "uuid": "d54c0229-b749-4546-9b02-5ad6e03bda6c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694692, "uuid": "c974317f-1624-440d-8086-2e28e7365c59", "value": "24576:AyT9SMS5KJ2wqM75ern+JZKJLVfMcGm2myOV6:HT45FwqM7QrZJLVktnx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684694692, "uuid": "cec2e77c-ee7b-44ba-a3af-c8b26afe3fab", "value": 1046528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684694692, "uuid": "3fc785ce-dfd1-4ce9-bf19-8989bd361d27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694692, "uuid": "4242438d-eb4c-457f-acd9-19431edebfba", "value": "35677201.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c13fd3f9-f808-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684695200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695200, "uuid": "adb4920b-a8f6-4893-9bef-5eaa6353c7d1", "comment": "Malware payload (RedLineStealer)", "value": "037d6e7b3341d00164a53b65ea501ed9", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695200, "uuid": "ea6faa4b-176d-4ac0-afc4-11ae1e5d2fb3", "comment": "Malware payload (RedLineStealer)", "value": "a7ffc2d314559f32e27dd34350f62663ffc6b2bf066bb978ba2189f5db34e299", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695200, "uuid": "a62e7971-84cb-4791-b020-47fe4a20efa4", "comment": "Malware payload (RedLineStealer)", "value": "d8c08a3371551b43643ab5613d4c44ca9afef730", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695200, "uuid": "9ff1e063-0e96-4829-a188-72356049f487", "comment": "Malware payload (RedLineStealer)", "value": "cf40c4677bddea394bb666bce18143fe2d12bf03c6cc9d8cf95cbca2e86b5477bb9bdb2c1f84d35d929b3bab43136b78", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695200, "uuid": "b0e651e3-c5ea-42a4-abfc-1727ec1d756d", "value": "T1C7252382ABC950B2CDF223B119FB57870B35BDB15EB50A1B63A5B8651C731C0A43276F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695200, "uuid": "122f1daa-831b-47b6-9441-d991bf55c37d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695200, "uuid": "1126215b-40d7-426a-a1da-1fae82396523", "value": "24576:VyMUPy9cbdhYbNZttQEeJTZxrNZwm6SgOBVJJsbMM6u:wMsy9AebNxQEeJTZxrgm6SgO8AM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684695200, "uuid": "a071cb97-0ffe-4212-b3f9-7db1c46fa21a", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684695200, "uuid": "4166c5a3-9cff-4eff-a50a-4da38dcc1f40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695200, "uuid": "2ce04c4e-57f4-417b-ba50-26c5eaefd376", "value": "234433512662.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6033db6a-f7d0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684670985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684670985, "uuid": "33b11d7e-08fb-4016-8a9f-39333b4b96a9", "comment": "Malware payload (RedLineStealer)", "value": "32475b53b128a054f78531b0a112d015", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684670985, "uuid": "19bcf8cf-4425-4d8b-8853-345e7ebfd53f", "comment": "Malware payload (RedLineStealer)", "value": "a8763245bd0ad222acb8266c6da83cb608935a5f5cc37de05830fffd771d7ffd", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684670985, "uuid": "a8ed0ff7-2f3e-40e5-b5d4-680409b651b9", "comment": "Malware payload (RedLineStealer)", "value": "2526b0aca652f88702b3384afbc73138ce6d40cf", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684670985, "uuid": "6333d020-4ead-49aa-820e-b081f1d7984c", "comment": "Malware payload (RedLineStealer)", "value": "0b2aca49b2c29e26cbbe01fe11c6b5e580f5493be394d81aed66857129fb4ad55136ab428c54bb869af3871a0bccdc85", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684670985, "uuid": "a5d21255-cb2d-4464-9a8a-a18d7ec6ef20", "value": "T1092523426AFD8066D96563F054F712C30B3EBDB56CAC93BA7748E8461873281D931B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684670985, "uuid": "69e0e3fe-9739-46fe-a199-f97a7a3d421a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684670985, "uuid": "3751b262-72a2-4702-9b8a-e33fab917cb8", "value": "24576:Eypy45TrTsaT4zv+DMIDL+btrI+IE22+Xdo4GYCDTS:Tk45TrTsP+4yLsZIts+XdlG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684670985, "uuid": "5c0a9aec-334a-460c-920a-39fd74fcb467", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684670985, "uuid": "62e10452-06ac-4aa0-9074-f57fe6e7fbea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684670985, "uuid": "1f360e88-5442-46bd-b756-fc54cc97fa8b", "value": "86968897.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2be08303-f79e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1684649423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684649423, "uuid": "788c6b18-fee6-49c5-b3fb-3c8106dad259", "comment": "Malware payload (njrat)", "value": "fa23a9ad9da6d4d0682413d5d4f3ade9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684649423, "uuid": "12593125-d86a-42a6-8010-afe06bf88584", "comment": "Malware payload (njrat)", "value": "a97fca7f8c321e6027088b27ce95b2d9b979ac939174b50887c0ecf68e5df0fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684649423, "uuid": "b78a76b2-b5df-4173-b4e4-05d8a5362394", "comment": "Malware payload (njrat)", "value": "c31501ae85c2e625867a2c458c27757cd6e09961", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684649423, "uuid": "4ab3fc18-bc96-4b26-8ecc-56967a58d7ac", "comment": "Malware payload (njrat)", "value": "d51cf8121346d84fccb836698e0f4dd4ca4264912ad452f340d254a64c96e22510ec26661ef2c83381708c31bd7ca7bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684649423, "uuid": "f5ff2a4b-a8c1-4782-aad0-ae441216793a", "value": "T1AB73294322CE7EA2D5780575B7B323D1D368CE1A1653D70FA4C82269A93D3C77852BCA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684649423, "uuid": "7d8ffee5-58ce-4e12-8bff-3be0d7fe4193", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684649423, "uuid": "44016011-75ae-4fc3-9cf3-aa850273b9b9", "value": "1536:GY1gtFTyA1Cu7yjqTbB7AKEvOV+DmCHey7ZijyK:GY1EyA1Cu7j36/vjxHeUK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684649423, "uuid": "3b87e885-d0d5-4b18-8f0b-fde88b92081f", "value": 76800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684649423, "uuid": "1b3ad500-2d4f-4ba0-b6fe-14de65c8d448", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684649423, "uuid": "1c50105c-a828-4085-aa7c-c05c1b010419", "value": "A97FCA7F8C321E6027088B27CE95B2D9B979AC939174B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9203741f-f7ff-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684691255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684691255, "uuid": "5f0deffe-7746-4b74-b6b1-2dd13a58fb09", "comment": "Malware payload (Amadey)", "value": "1ddcd2d39d9085955cf344399c198947", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684691255, "uuid": "b0a6097e-37f3-4bdd-af15-74e7dbd10151", "comment": "Malware payload (Amadey)", "value": "a99458bc9122cb56d6dd96e1c23f65d7f8704d099c701bd1c3375d5629fa198d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684691255, "uuid": "095592f0-e756-4965-a68a-0ed269cf94c1", "comment": "Malware payload (Amadey)", "value": "8f8665d4842104066ec27cdcc0fc00edf23a642f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684691255, "uuid": "0bbfdced-05e7-46fd-8718-c57fb3f081cc", "comment": "Malware payload (Amadey)", "value": "c5e7b6b8740ef2aaa38cce4291aad7d9fc9597adde2e7607725c1490bb0271ebbf1f41e465f1bdba0dc8c45ef2966dfb", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684691255, "uuid": "d8235070-9787-465e-acc0-c6832bc5a490", "value": "T123252306F6DCD473C9B0237594F242C70A39FCE25AB1579B2B88485B0CB3685EA7536A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684691255, "uuid": "bd122dc8-66d5-4717-9cb4-794efdd71e2b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684691255, "uuid": "4e99305c-74d3-46ae-a837-446e6b47d9df", "value": "24576:1yH/zr2zb23zdiqb/d+7KDTAOV05Xc1p1UrPXWv3g2neu:QH/H2zyBiqb/07KvXV05XwpmzXWp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684691255, "uuid": "9b10e47b-20ef-48d8-b334-980c6c1f613b", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684691255, "uuid": "b1834731-a427-4996-8184-e478bc623387", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684691255, "uuid": "8596841f-bf31-450b-9e78-6555296b33ba", "value": "recorder438.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c6ba93d-f7eb-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684682656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684682656, "uuid": "766fccb0-eb39-470f-9139-f865bf59d7ce", "comment": "Malware payload (RedLineStealer)", "value": "831f43f7292d458da6e050bf4237d6f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684682656, "uuid": "801311e9-e4cd-4be6-b961-711934442a57", "comment": "Malware payload (RedLineStealer)", "value": "a9b100921e01a4e6ecd784f6bf4ddaec797b2d2c5c0f9a1fdbc635d45c46f50a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684682656, "uuid": "03eec59c-a75d-437f-b0b1-9677aa8f05b9", "comment": "Malware payload (RedLineStealer)", "value": "c6f5c29d2d700d44839cde9096fa2bff8456ecbf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684682656, "uuid": "4e895238-ae0c-495e-893f-1dc07a6d155f", "comment": "Malware payload (RedLineStealer)", "value": "0eea67a5384715fab30d7a7a365ca7f388d913271d530c21e548efd5714bc91d28b762f922fafccf2b124f24647ec7d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684682656, "uuid": "061fc0fa-f811-475d-9a3d-b7a63c91f885", "value": "T122252317ABE94072DDB4237054F302571F727D7099B9833B33D2A8A79972184AA723B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684682656, "uuid": "2b2a0c45-cb58-400b-8835-2859ec371385", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684682656, "uuid": "23ca13b6-4b46-40df-a7a8-62e8cfc07374", "value": "24576:tyvbKn8OJygXk7GVHUqnl/FsfdbuOQf0rGG/Kld3kCP:IvW8rAsGRUqnl/yfdbu3f0rGGsd3p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684682656, "uuid": "292f9970-807c-44c9-bf63-a6eb0473f8db", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684682656, "uuid": "b0525a29-a082-4bff-9ab0-fb1513af5e22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684682656, "uuid": "e7e18496-ede7-4013-aebd-0704051228c9", "value": "831f43f7292d458da6e050bf4237d6f6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11b1480f-f7b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684658398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658398, "uuid": "93c6afdd-4eff-46c9-8187-8d770ceae0e5", "comment": "Malware payload (Amadey)", "value": "a8969dba064f5e3eab0aaf03d3b47561", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658398, "uuid": "8770cd39-ab57-40bc-83c1-b1441ea9bd87", "comment": "Malware payload (Amadey)", "value": "aa6b2b54700ca1df281b7579bea210b7ce95f9c99d8a8e14910d7d1ac9a55dfa", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658398, "uuid": "ac4483f7-d209-41e4-b00a-e39af3d2b26d", "comment": "Malware payload (Amadey)", "value": "199c3e08c338a4cf72d36cfd1c3c6139296c34c1", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658398, "uuid": "f073c71c-c075-437b-b3a0-20aa31145b32", "comment": "Malware payload (Amadey)", "value": "0848b3e523a3b868f21b0b407b3d8752e73fd7ae60eddf71e4c9adbfffc564fe59e1f06edaa35537cd4563c040c088bb", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658398, "uuid": "411cb817-50a7-40da-8c7d-626c5228de3e", "value": "T10A252323E3D88073DCB91B754CFA419B1B363CA259E887176385E9150CB35E9A83637B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658398, "uuid": "f41fc019-c501-4828-9fab-d0cf25e40470", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658398, "uuid": "ae6ee26f-0ac2-4ffe-ae17-43a1ea755acb", "value": "24576:YyRnyxvczq5l89wbZWDl6OLNc26zg/TATHJqe:fgkG7898Mx8HkTATpq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684658398, "uuid": "bddc4fd4-fb8b-425b-978d-e0d51f84358c", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684658398, "uuid": "fd049aa0-c9b0-47a2-8e90-54eae86f802e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658398, "uuid": "fa2dc5b2-2bf4-45e7-9d64-6eae1a3bc472", "value": "999208.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa1ffee3-f772-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stealc)", "timestamp": 1684630737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684630737, "uuid": "deff2f4c-bb89-40ce-9994-5a18009f9a40", "comment": "Malware payload (Stealc)", "value": "5d42f1bc7d897b1af4f32d8e7ab630c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684630737, "uuid": "4a32f5c2-6270-4009-bac1-74901e91fd45", "comment": "Malware payload (Stealc)", "value": "aa80ab3d660d0340897cc55f6a342cdfba3b67c2d7335315a371f7bd17cdd3fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684630737, "uuid": "0064dd9c-72d9-4e94-a451-893528f14f5a", "comment": "Malware payload (Stealc)", "value": "1cbd175401727824fda2640da9378283daa1fb74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684630737, "uuid": "72fa59c2-8b76-42af-ba36-e679777bdca5", "comment": "Malware payload (Stealc)", "value": "3f6e11e06e914c08b190cef4a59ac406ed8827fb7c9677db0d132498e2557e2bdc063cef8cf712d5a95c5e7f7e8befb8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684630737, "uuid": "ac03df1a-0143-4365-8fdf-331825fb8fbe", "value": "T124B4D065762A1623E21A2FFDB49A3B719750BC3D7DFA860510B7AB02060D548CE27CDF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684630737, "uuid": "21445c23-3c85-4560-a573-8330f9c89cbb", "value": "12288:4qUvP5KD8bfn7RdtT/j9AL2sw/jAhNVmFOnlBePrz2F:4zs8fnx/RAL2sIAhbmFOlgX2F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684630737, "uuid": "649b0e17-6ebe-4377-8419-745fa5ee0e13", "value": 518800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684630737, "uuid": "b51f022d-e0fb-4e62-97c9-6f193f4b920a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684630737, "uuid": "13836db6-5f17-4627-af4d-3ea22cb3b0e1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81eecb84-f7c8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1684667606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667606, "uuid": "ce08a6ff-84f5-4e7e-802e-9a50cc015116", "comment": "Malware payload (Stop)", "value": "38879ab64e36b6d4397e1461b1b70326", "object_relation": "md5", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667606, "uuid": "0a67179e-4d5b-49e8-86cf-d5d22a05da65", "comment": "Malware payload (Stop)", "value": "ab457635362b65f01ef5371774dbfad1629b797f9d0a78890c13b8fc5714ae4b", "object_relation": "sha256", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667606, "uuid": "5ca3600e-80d4-4a89-b46b-7afdd483e7da", "comment": "Malware payload (Stop)", "value": "72b85403cf7eb6fbebb69091f252a9b0cee4f3b1", "object_relation": "sha1", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667606, "uuid": "dcc39b3e-1e02-46fd-9ea1-24dcf774eebb", "comment": "Malware payload (Stop)", "value": "a4b011f480abb5764b0726dc34d675db06866e312a04c509cdbaeae6eee26673bda7dd302aa08f1672f6a9ce9d444db4", "object_relation": "sha3-384", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667606, "uuid": "ac9af686-8a87-47b9-a858-9c416c9233e6", "value": "T153050232A2E0EC65E5264775CD1AC2F8266EB8617FD41BC773442F5B18302F2DA7A352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667606, "uuid": "0a4a72be-de89-4dbf-9222-e40d4488a04a", "value": "bb27c4958c76443fcfe46f9765d838a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667606, "uuid": "e2adb636-5676-4957-81f3-008e45421beb", "value": "12288:UuSstGxq9iWEhflaqAvJEH/f80o1FjCyPWV3lHAgtKwRTXkPXDaXVA:UudGQwW6flaBvJEHPo1xuV31HRTqaW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667606, "uuid": "a010b57a-ee62-4290-a972-3518c4f78ca9", "value": 806400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667606, "uuid": "894dfd58-827a-4799-a268-9c3e32b8f1e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667606, "uuid": "617e50c4-a479-423a-9547-5f5c8d57a469", "value": "handler233.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "884d59aa-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684680501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680501, "uuid": "7f1a50a4-c3e0-464f-b27e-39837575613d", "comment": "Malware payload (RedLineStealer)", "value": "c8687c2885d69099e0dd98a1dd00dd15", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680501, "uuid": "51c32bbd-26e9-4f7b-a12c-ece1590e21f4", "comment": "Malware payload (RedLineStealer)", "value": "ab9f636f5bb2df81e6305d6bccdd1b97e260350079983d0c3a184d0769f1a3f5", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680501, "uuid": "c305bd69-7f8c-48bc-a8be-6ad37059c2b0", "comment": "Malware payload (RedLineStealer)", "value": "250ff357e88142e458b92620df12211027ce40b9", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680501, "uuid": "f844cdb0-cc0d-47a5-801d-b6cc52f82cdd", "comment": "Malware payload (RedLineStealer)", "value": "89e986fef17570589e7976ebb1d223bc7e9d8badb27f44ac6f6a6c6a96d77ae5d78774008a9f9d2faac09b5914a6a6d1", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680501, "uuid": "fc2ea8c7-eee9-4a85-8ef9-629e6d1b7a46", "value": "T1A72523026DD89073DC702B307CF203A71A367CA1CC689A7F3794A6BA4C73955597277A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680501, "uuid": "29eb547b-190c-4f19-9f8b-254a5dbd5254", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680501, "uuid": "f548ea0d-7176-4f30-8481-f4e920ebb764", "value": "24576:DyIDtDvlYQNDDqqOowSLG77yhh1hdFPDN3DoJb4vfg3:WIDtR9NDDqqNl672hhN3DolUfg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680501, "uuid": "ca9baaf7-3160-4801-b92e-e03044deac86", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680501, "uuid": "5261394c-1797-4fbd-84f6-0d2f10d3e0a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680501, "uuid": "f1340c0b-004d-4480-bf0d-9d11c186044f", "value": "Startup669.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7473ef0-f7c6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684666836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666836, "uuid": "07feaddf-d335-4497-86fb-e5ed6279c209", "comment": "Malware payload (Amadey)", "value": "b2ef1778bcce5e4746209cedebb4856f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666836, "uuid": "8e445a61-bf91-409c-bb29-511a3b0bfb62", "comment": "Malware payload (Amadey)", "value": "abd1e65d4d37946f766e2f7861fc50c731967dad6157099b02420219124647b1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666836, "uuid": "8aa2a7b5-471c-4c61-8c3e-65559e47554e", "comment": "Malware payload (Amadey)", "value": "62685864121670b62fb1c61271dcabb1d784e4dd", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666836, "uuid": "61b64aac-ab3b-4b49-ad1d-b465a1ce6a8e", "comment": "Malware payload (Amadey)", "value": "c537811e584060593165bde23ccbfc11506c2134a9e7222aad1ae5460a9d70bdc1d21eba56db2393f5de9fbb20671d35", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666836, "uuid": "26d73643-688d-4f23-a768-9a5f59f2d326", "value": "T17C252312A5C89072CEB13370A5F757530B3ABDA48979C35B2381AC9B5C31A94B871B7F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666836, "uuid": "bebb65ca-cf75-4721-b421-533830993974", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666836, "uuid": "33b6b76a-dda6-4bc9-aee7-406a27ff80df", "value": "24576:1y+JfZMzJ3ZoIqtXXz35ZQg0ioqbexoUTlhx4mRmqf:QcfSGIqtXcnqbemUTlhrm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684666836, "uuid": "35db3975-9d6e-42cd-8e6c-b44dbd04051d", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684666836, "uuid": "dff2519d-0ab5-4b21-90ae-5862f81aca23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666836, "uuid": "1f16b014-909b-4e1a-ae07-3a77a63a095e", "value": "reporter746.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "043818cb-f7c8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684667395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667395, "uuid": "7ff5019f-665e-47ba-8225-21519d96982a", "comment": "Malware payload (RedLineStealer)", "value": "62d82212400eb3be5efc39902bb7eaf3", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667395, "uuid": "89100573-aa8f-4bf6-929e-24c760e42302", "comment": "Malware payload (RedLineStealer)", "value": "ac2ee9c41a49ef4c4fc446d01580e910b9765e36edd64d11561c6c8cd1ed00c6", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667395, "uuid": "841ba5ef-56c1-4fbf-a88c-2c779a1a2966", "comment": "Malware payload (RedLineStealer)", "value": "1092cc0f77ca727d4e1a03e56907984e383ad7f0", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667395, "uuid": "76d718d6-9383-4978-a80a-d735204bdbeb", "comment": "Malware payload (RedLineStealer)", "value": "9234c8e602af4147a23dcab33d2c1066951cb5ce87e7970d9274bee2bd58a7edc11ec174f671eef3d333e4536ac61e74", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667395, "uuid": "cd18ac6a-3708-461b-8c76-0cb95aa91965", "value": "T15025231776D86677C8E963B02CF316830736BCA1983D861A3E80DE5D6CB3948E871767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667395, "uuid": "e68621ed-33ff-41eb-adc3-ee0c8572ae27", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667395, "uuid": "dbf70cc9-253a-43f5-8cd2-0d58646920dc", "value": "24576:nym8GsvDyIfcPDqQ68/pXDrALXtVH+KpRZW34:ym8GsvDyIEPDqSDETeKpW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667395, "uuid": "ace7e04e-f8e7-4bbb-bdcb-7fb03503d011", "value": 1045504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667395, "uuid": "eb963ab1-0261-4be1-9d52-fd8820c6d648", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667395, "uuid": "cd5ed793-1c06-45a9-9333-687b742f12ee", "value": "renderer774.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "963eba0f-f7c7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684667210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667210, "uuid": "bf411166-9771-4f0d-b94f-4e1f68d12fa5", "comment": "Malware payload (Amadey)", "value": "fdcb795d2654341ef6d4123fd0268e93", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667210, "uuid": "6437e2c8-f372-4b40-8c8d-d6a552f81c1f", "comment": "Malware payload (Amadey)", "value": "ac5f285eba46162b12bdf354fb7596e0c83b048affbb16cf5a44ef4fc3a3957c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667210, "uuid": "58c16dbe-e3d2-41b5-8d5a-de2b8a1b2dfa", "comment": "Malware payload (Amadey)", "value": "2c6880d94066526d5387c2e9db01043f0ccfcba8", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667210, "uuid": "5db5592e-6ad4-4119-b803-a1beb8db402b", "comment": "Malware payload (Amadey)", "value": "2ca5da564b6c6107f62557150b33125fe512962bd57809f42ada95936e072a5300111d515f918233e3a99ea66f0ef7f2", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667210, "uuid": "ded68b0b-5802-4698-84a9-92c1d0dc9784", "value": "T157252355E3D4003BDDB13BB05CFA42930E31BC919976C39B6B89DC6A4832B58E1763A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667210, "uuid": "87ef4478-c5d5-477c-a152-3d0270f08e00", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667210, "uuid": "778de4b8-a969-4353-88f8-67e6748256c8", "value": "24576:1yAbg0TuzKKpXMFysRmmXLFq7zjzAjLHb+V2gJ:QAsWuHMnP7aQ7Ab", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667210, "uuid": "7298dac8-f6e2-4d75-8521-6b6b73cdf954", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667210, "uuid": "35ae44a0-65ee-4072-813d-9850c2963bd0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667210, "uuid": "8a9d78b0-7f1d-4d09-9e25-b7d403e6d8dc", "value": "274175.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "903bd4e8-f7c5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684666341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666341, "uuid": "aff82252-089c-4b0e-92a7-7809e866ada4", "comment": "Malware payload (Amadey)", "value": "9bb62f450cbef0c3a6a2b6575c92c6ac", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666341, "uuid": "0ac69cd0-8a42-4d68-bff5-7dafc90ea262", "comment": "Malware payload (Amadey)", "value": "aca806bae59417e92e6419ea9642e6602b54851fdd0b5c067145f2405e84db93", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666341, "uuid": "0aee3f9d-e179-4d67-9bf1-2cb7577c2f81", "comment": "Malware payload (Amadey)", "value": "3720d9cbee5741ca0ec2af32167a94478c03883b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666341, "uuid": "ac7961b3-8db5-4584-847c-a9d36e5e3b5e", "comment": "Malware payload (Amadey)", "value": "98e8a959505d7aa32e1dce08f0fcbefde0a91b3467280dd417a93a47541048e9605f12c4f3da8dc473b1c3c43fa0fd95", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666341, "uuid": "79d91dab-920c-4e05-b51f-1658736f8237", "value": "T16725230BFEE84172C8761B706CFA0583063AFD559AF0832B3749AC2F1DB2185A57577A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666341, "uuid": "40781c08-b018-480d-aa4e-981b1b92fe2c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666341, "uuid": "5d278b02-def2-4445-8401-fe9868ebff66", "value": "24576:JyU2EchE7pLnq8rSqmd/eIdSwAd1AQ8wPT80Wanz:8U+hEVnq8rSqDglAfA2PTnWa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684666341, "uuid": "7085c855-624f-46c5-936a-c1432e67ed1f", "value": 1054208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684666341, "uuid": "6b79ce19-4268-497e-8994-f7860b257609", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666341, "uuid": "fb8954b3-416b-454c-b891-0a4e95df8bdb", "value": "26324417.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89a1fad2-f7d8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684674491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684674491, "uuid": "71c34ab1-2048-4a53-b72a-8a7e8c377d4b", "comment": "Malware payload (RedLineStealer)", "value": "27c2f0da15dd57ed3f028e41a8d8e848", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684674491, "uuid": "a35d0b3e-45cc-4c5d-b47a-184a3dca9980", "comment": "Malware payload (RedLineStealer)", "value": "accb38ba3b9d6dfd9ad074145c53f8970ded5799e75f028bf57c3f3af80dc298", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684674491, "uuid": "586cf8f2-22dc-41c3-ae4f-c44cb39a74e5", "comment": "Malware payload (RedLineStealer)", "value": "cbca58d8a09b522adb9b86407bed8d639b934c2f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684674491, "uuid": "352a2551-e721-4527-a1a2-10a3eb8e449f", "comment": "Malware payload (RedLineStealer)", "value": "a2629717e88147c0ef4a2759f37c298cc898a935f12b85d9d7933c72e5294dc1ed6b073a1d4e8e1fd2b8bef4864a57ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684674491, "uuid": "b18e9b90-3598-4501-ae2a-7e0e43fbee13", "value": "T183252353AFC88436D4B513B464F70293233BBE60697CC3576B49894AA873BE9D47037A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684674491, "uuid": "00e625d9-5d56-4169-9424-73b6a012f0dc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684674491, "uuid": "daa932f7-76a4-4a8d-89f9-33cb0bbc1d7a", "value": "24576:ny/GSQlDBHEIeWQvGHcbLsjQqbGD9jz4:y/GjDBEwQkQqb+N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684674491, "uuid": "5faea9a8-445f-4f33-a2fa-7046e1163ebe", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684674491, "uuid": "b5d0450b-7c69-406d-9dbc-66e0fe2472f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684674491, "uuid": "dcb684f5-3ef9-4612-af79-fed5f51078c5", "value": "27c2f0da15dd57ed3f028e41a8d8e848.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14b043c5-f809-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684695340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695340, "uuid": "3dc71c6d-b31b-4671-bf3e-e7f9a74b3b3c", "comment": "Malware payload (RedLineStealer)", "value": "f9306dbfd0e4fe0237c6ca19b87e87e7", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695340, "uuid": "280ef2cb-c563-492d-bac9-a5bb5e9ce4e2", "comment": "Malware payload (RedLineStealer)", "value": "ad01b168d5873f3ef746043788d2f073cbd3bf6fe54dcd345d476874a5dbb700", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695340, "uuid": "03fea39e-3aa3-40df-8a35-db3ad34573b2", "comment": "Malware payload (RedLineStealer)", "value": "028783afa967483956477b21701894e8addd9470", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695340, "uuid": "96988e95-9e42-4b7b-9403-a73e67a171f7", "comment": "Malware payload (RedLineStealer)", "value": "7e8da136cbc755e38a213475b60561d6f1bbc54552163d0b0c7b35ad449472498f810ac6695d4b0fff10678bcf9809ff", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695340, "uuid": "7a6e09d5-ccd9-4068-b39d-3aa8d6109c20", "value": "T1D5E3D624279F8930D6BB4E3D6CB19CC076BCEC12A542D74A4ECCF5593A73B809B116B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695340, "uuid": "54edd66d-d8ec-4f89-8190-cb5c12578ac7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695340, "uuid": "ba0402d5-b9f2-44d4-82d9-981d2a122fe8", "value": "3072:2V+m5cNQmRSxWWAcP+DDXedh7Z58e8hk:2jwCUudh7z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684695340, "uuid": "b16f8c11-a21c-4baf-80a9-c400e123372b", "value": 148809, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684695340, "uuid": "e9085f93-d65b-4268-b8e1-da289a7299e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695340, "uuid": "7ba54d1a-c091-4f2a-986c-fd71986330a4", "value": "physics447.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea0e765e-f7d0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684671217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671217, "uuid": "8077a017-41a0-4467-8a23-fe48a11a3c55", "comment": "Malware payload (RedLineStealer)", "value": "dc3000c6361b4a42b590e93a9af66ce7", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671217, "uuid": "a1b64084-c744-470b-a195-624e1d7b96d0", "comment": "Malware payload (RedLineStealer)", "value": "ad2b4b5e0c571a36fa5810f620851a8c14ed10b15550956b7d45af6da8335ad6", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671217, "uuid": "4463b1c6-40f8-46e9-a3b8-c3dd05230333", "comment": "Malware payload (RedLineStealer)", "value": "b074eb37540cca8ff3f1a13a35dff7a15be048e0", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671217, "uuid": "eb12a3e3-ba65-4b88-9c2d-0cec3f24cbe0", "comment": "Malware payload (RedLineStealer)", "value": "3844226b8b653fc19ad08815a2f9920c5657042db15830b0d8b13100bd0dace2223eea4bfd01708b76513df3652d00fb", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671217, "uuid": "c95e9b6e-8448-4610-9f6b-f623470ef9c4", "value": "T1DA252227BBCC81B3D9795B7404F6A393077ABC511969D75B2240E94F2CB26C0AE3137A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671217, "uuid": "11337047-9df5-4c41-bd04-c4de21622e15", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671217, "uuid": "1e349451-bb5c-47da-bfd5-9f170823fc03", "value": "24576:0yurNC15YCqtqWl2xVOO4jEsZlj8uhX76zpegomXkL0:Dur8jCqWlEMOeljfle8QXc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684671217, "uuid": "26a55d4c-1d00-42da-acae-5b302aae99fa", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684671217, "uuid": "f9083702-51cc-4529-8ef2-8e150b21f4cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671217, "uuid": "65c76eaa-228b-428f-88d3-435a80dcef1e", "value": "Temp976.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bc0c380-f7f5-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684686950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686950, "uuid": "1d7d8aaf-28ee-4999-883a-ce28b282479d", "comment": "Malware payload", "value": "0339bd17da4c32ead0564e74797d4810", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686950, "uuid": "179249a0-32a4-454e-9f56-083fcc667faa", "comment": "Malware payload", "value": "ad3a4f336be787ef3c828881389e837d4c9a1273aba89ff42fae583dd04ef4d4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686950, "uuid": "c67847fb-da93-44f5-a65d-9fc857093b1e", "comment": "Malware payload", "value": "a823b5d75c997c56dec156f3f811ba7de57550d2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686950, "uuid": "0feb60c2-1946-4e2d-a3dc-60caf75454c6", "comment": "Malware payload", "value": "77af30ff7ec6bd20cb9f41e14c1d38c00ea021bd9f7a6bf5f68e07dfc738da63a16e71f7621e36c6803da1c85a49b12f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684686950, "uuid": "de7d5744-afd9-4295-a5e3-18e52fb0ff54", "value": "T194C32905E8918767C2E2177AB79A425D33332B6893CB33255938AFF41BC1B9D1E79131", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684686950, "uuid": "7483a654-029d-4f66-9baf-ae75d34ee942", "value": "3072:KdB2qwap6KVXPi4jv8x+9MDkmDhZmTQOIsXAqE:aRwap6Kt6+9MDHZmTQOICAqE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684686950, "uuid": "9473033c-6c72-46d7-af71-9374c0cce392", "value": 127529, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684686950, "uuid": "6f6cffe3-6f3f-490d-a3a1-10cc771e1bd9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684686950, "uuid": "bf52b917-29d6-41db-9bb8-e66a2f435b1a", "value": "0339bd17da4c32ead0564e74797d4810", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d17f7682-f7c8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1684667739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667739, "uuid": "915e27b0-005f-4062-874c-7c890f9fe8fa", "comment": "Malware payload (Stop)", "value": "3d47620386750c53c17514aed23fd1bb", "object_relation": "md5", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667739, "uuid": "9680861e-774a-4d48-9ea0-eb41a5185cf3", "comment": "Malware payload (Stop)", "value": "ad63e0e95a2392870f568330c3793cc3cf8422870e07c9a83dab817390c0a00d", "object_relation": "sha256", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667739, "uuid": "cd2c8cf8-03c9-49be-bfb0-4a010a4bb315", "comment": "Malware payload (Stop)", "value": "831146a6306d7bdec48f5ae0ba74e5dfafc93bed", "object_relation": "sha1", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667739, "uuid": "80c26c76-af80-4099-8706-cf95a58a4dc0", "comment": "Malware payload (Stop)", "value": "a389733a154e58aee72376b416773f7afb19077cac84c5e32e72074187a0135b5bbe8d68068284bcc911830891833873", "object_relation": "sha3-384", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667739, "uuid": "3e91adc4-5d42-402b-afa4-6681eb8b14c0", "value": "T1FF05E043A293BC69E92547728E3E96F8761DF8508F893B9732046E7B04712F2D6B7701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667739, "uuid": "9ef0b532-f115-4450-a34e-c7cb03460fc9", "value": "dc368f441a884fce22ecc585e2bd5326", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667739, "uuid": "95f793d1-b667-4570-b034-d1695ad9afbc", "value": "24576:pEvtX9RzEBYhSmoK0FtCNSMqsm4m2r20fsO8j:pEjWySmoKAQN/EO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667739, "uuid": "3795c46e-e52f-4ddf-b566-222b5b90e404", "value": 840192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667739, "uuid": "2239f80c-6272-426d-aa48-a353b63848d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667739, "uuid": "53b60e2d-bb53-4906-93dd-f8966ca231a4", "value": "345210.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f07210ab-f7d0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684671227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671227, "uuid": "bd01a123-297b-4eb4-8041-03a0db08e45a", "comment": "Malware payload (RedLineStealer)", "value": "275e05720cc71a2cdcb6583ebc0ee45a", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671227, "uuid": "52482efc-7f24-46fc-8c26-9a5a4e376d12", "comment": "Malware payload (RedLineStealer)", "value": "ad76d0d1771c7fa5c4c67abe96339a63ec82277eef721f654090e33e2c18cb92", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671227, "uuid": "e1d8afe7-db0f-4bce-8160-3f27572f49d9", "comment": "Malware payload (RedLineStealer)", "value": "c36e9aa541fc822c38e25522f3b25947a593a9ad", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671227, "uuid": "fbc59610-4a0a-4e7c-b82e-25d948e36614", "comment": "Malware payload (RedLineStealer)", "value": "19d6df6b205b1581be5570129e224f1b7e74168db6caee76a8045593576b31d6d0c25e118d07c3a9d4d80ed08a58e22d", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671227, "uuid": "dafe4f50-f323-45a3-a125-682376c2f3d5", "value": "T1CF25236BAEC8A036ED715BB118FA06971B357CE08C59812B37417D0B0EB2E85B532777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671227, "uuid": "ff101364-0cb0-48f9-b40a-f2b11d16a410", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671227, "uuid": "104b7114-ab8a-411e-9d2d-d934824c0961", "value": "24576:vyDBK3U14zdlvqdA7y8T+Jz/xN4vhb93ZMYkzr:6Jqz3qdA7yX34JZMYO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684671227, "uuid": "8f23b0cf-4a53-447d-88b3-a28f81dfe3fe", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684671227, "uuid": "70ca2bfa-5844-4545-986a-42f987eaa70b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671227, "uuid": "033b5015-1467-44af-be60-c9c19ae85969", "value": "compress253.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d600bf3-f7b1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684657773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684657773, "uuid": "e02e9c9a-f428-4271-94a8-cbc2dd1b454c", "comment": "Malware payload (RedLineStealer)", "value": "9046f0a295e9723d73a6c843825c9742", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684657773, "uuid": "8842b307-1d01-448a-89a5-eb7ac1d22c72", "comment": "Malware payload (RedLineStealer)", "value": "ad8b61c4e2cc2d42947ceaa5fe61926de86f980e31b0eeaa8229d6fbf7922cad", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684657773, "uuid": "3cfd3cdc-9e38-4d67-8b9a-18102961271c", "comment": "Malware payload (RedLineStealer)", "value": "b77d25500e41a7003ba429eb1002575a4f5bd34d", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684657773, "uuid": "d5a912f1-bf5d-458b-9888-b964e9a1af19", "comment": "Malware payload (RedLineStealer)", "value": "b67926fb1e602b854f6def481169d82f04821b3a96858d239cdba31714ea46f250131b8f92e9bb7114145d4b5fcb0acd", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684657773, "uuid": "698049f1-b9ec-4893-96ba-ddfdcff1f8d5", "value": "T11E2523017BE90063EDB62BB054F147A30633BCD34978A63B6715F56A4DB26906932B3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684657773, "uuid": "fa842252-05c2-40fc-be94-a2bcaa3df027", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684657773, "uuid": "4f8014d0-e29f-4c0a-9157-797bbd98327e", "value": "24576:SyXLjjysV7JqbvKMMALc55mZPaBFnYSkempE:5njH7JqeMMic5EUvu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684657773, "uuid": "eda82b64-2c47-4600-b6a3-d2cefa42edbf", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684657773, "uuid": "6743e1a0-6a0e-4f3f-9da3-7546c4afe53c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684657773, "uuid": "9b8f580e-5f9b-4de1-a4c0-40516f690d29", "value": "7463534.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b735a3ef-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684680580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680580, "uuid": "1b8d73a9-7d49-47ae-8f94-66d30d56341f", "comment": "Malware payload (Amadey)", "value": "d22841fedec1f27ba00a8e80e2c8fa24", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680580, "uuid": "3e0b24f1-d749-483d-8759-a0410c771a32", "comment": "Malware payload (Amadey)", "value": "adfec237806020d3d9a56a686c502f0122104eea5dc25e76fe00f7b576adc9fc", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680580, "uuid": "e94f6823-1038-4710-8239-b1bd1d9ac451", "comment": "Malware payload (Amadey)", "value": "ff1b0ae641acc647c12c5bb10bc60e758ff0faa7", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680580, "uuid": "9aa56cb7-d5d2-4860-8cac-6d6943923c3d", "comment": "Malware payload (Amadey)", "value": "468a0dd014485e1758541c8c99d3ebfb8c2e9a1e455a7f5a015199fbbdd45e7cd78ee5e6df2a42f7d2f5cf463d14a089", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680580, "uuid": "63f21180-5975-42f3-addf-2fcdd5fdb921", "value": "T1A7252386F6FA50B7E8F45BB05CFA03930E397C918D64867F1259A90A4DB35D06A3133B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680580, "uuid": "a9112654-af92-4f86-89fb-7dd430b35946", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680580, "uuid": "e1a81a2c-adc8-4487-9ad9-a0886f23caf4", "value": "12288:YMrhy90J2Fe4V6QkKSBbBeAB0202eDY6m+de1OmN6QbcMHr2epEw/Uvx8HhOlqND:ZyMGkK8wA026vsOQHDKPyBOMe3+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680580, "uuid": "b0bebea4-2f4d-4d9d-99d0-74cb8b7ce8d8", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680580, "uuid": "537526f3-5cdc-466a-b827-f8ab64d49f6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680580, "uuid": "eacb65bb-e0ae-453b-a7c0-1cf01fc040db", "value": "gateway166.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e372bf6a-f7c7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684667340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667340, "uuid": "2ae5b142-e084-402d-b487-be5d8cf86abe", "comment": "Malware payload (RedLineStealer)", "value": "59e0fa4921ac51744f9c7ef752d370b8", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667340, "uuid": "2c49ae34-d296-4047-867d-839c033afa81", "comment": "Malware payload (RedLineStealer)", "value": "ae595eb98cc6b81374cf4f66ac6e27be1f22f90b146c72b201e26d4ae84f6b16", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667340, "uuid": "2067ec48-5f7b-4afe-b913-84169566a158", "comment": "Malware payload (RedLineStealer)", "value": "30b0375c1c3c1bc7b6d403f773b1ba3eff3371a0", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667340, "uuid": "2e5e6ba3-e3c6-45ac-97ee-5173b1299a54", "comment": "Malware payload (RedLineStealer)", "value": "d797e69273cf4fa4fdcb2e0f886a1f1c11fe8108f6de1b2ecdb2831217b99321bc87adbfd1ac57ff03c6e4be28b56104", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667340, "uuid": "5184e263-47b1-4661-b554-421b9a36aac6", "value": "T11AE3E824279F8930D6BB493DACB19DC076BCEC12A942D34A4ECDF1593973B80DB116B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667340, "uuid": "45f1d4ba-70ce-4479-98e0-e0f9e28197c9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667340, "uuid": "75939a6c-5a76-46ea-8d38-e77f5aaa7fb2", "value": "3072:oV+m5czQmRS9Ynk5QXNhhRbG5h5Zx8e8h/:ojKtM5h5b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667340, "uuid": "197f5386-7875-49c9-9b60-bec2bf72c0e8", "value": 149103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667340, "uuid": "63f0834b-cd0a-403d-8ae8-8884d3fef198", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667340, "uuid": "d5b7dcc4-fb7e-445e-982f-670f44a3caee", "value": "interface742.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6efc70a9-f7f5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684686901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686901, "uuid": "79fd7837-6894-45fb-b87f-823cec26ac41", "comment": "Malware payload (Mirai)", "value": "16c9e88596947809e954f4da84cf8656", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686901, "uuid": "6b793a96-5598-4166-8241-ed0f5f81104b", "comment": "Malware payload (Mirai)", "value": "ae7214263ef1202117a2d4ee5aac9354d0b6a6788caafb6b1cfe6b360d1afe5d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686901, "uuid": "c8d30ede-b50b-4cfe-9f5f-bf6b65c3ba9f", "comment": "Malware payload (Mirai)", "value": "43abb720a451d46128210183e690ad3bc849595b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686901, "uuid": "ee5753a1-f653-4e8f-890f-0ecf0533b59b", "comment": "Malware payload (Mirai)", "value": "3f416e2da3fdb018e5e8154de193ba0bdeac7aa04c62bf184680510a2b356ea0c8ea8ce1e9c5d196d604387136d0ecc6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684686901, "uuid": "5966a075-3297-4865-8d7b-65ada9767d59", "value": "T17C630956F8818B22C5C5027AF92E118E332357FCE3DEB2129E146F20778696B0E7BD55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684686901, "uuid": "35a2a88c-2931-448f-9783-eef0df87fbfd", "value": "1536:dlneyKvSEkSYUde533W5B7Gpa6agzVIoi5QVh+y3ff5VYoxT:FKqEpJKGgazQVh+y3ffDBxT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684686901, "uuid": "ae3a6e24-4791-4abb-af6e-27170f8d4632", "value": 70968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684686901, "uuid": "4a080587-4e56-49aa-82ef-c061c8030b6b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684686901, "uuid": "3702f470-b570-4699-8c14-3142144d2e58", "value": "16c9e88596947809e954f4da84cf8656", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d85e6359-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684680636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680636, "uuid": "eda9fe4b-b6dc-4771-8ab3-9d4a563e4c8c", "comment": "Malware payload (RedLineStealer)", "value": "ae67fa4df99cd621607e17ecae535e15", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680636, "uuid": "406675fa-ec84-4337-8762-0a22df5f867d", "comment": "Malware payload (RedLineStealer)", "value": "ae8e1e37e42eb8d059a3b0376f9363f080fac0d3cb1cd1b943ab9228f4c5d647", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680636, "uuid": "09bc6a57-94fe-420a-bef5-294060185157", "comment": "Malware payload (RedLineStealer)", "value": "6571a23d2143755fb5763bb26d1776274acd7397", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680636, "uuid": "4c910384-b4bf-4145-93dd-c859d7a5dfbc", "comment": "Malware payload (RedLineStealer)", "value": "5f15ed205e856dfeda7575ab85841ac6d36134a30077167ca832747155aa29b9fb9ee2960aff7be23ea4b6d1ba1030a5", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680636, "uuid": "d1da7c6c-0e09-4052-a7c7-427746075990", "value": "T1C4252306BAD96276C975677008F643D30A35BCA12EB8939F3381897D1CF26C0D876B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680636, "uuid": "706fa4cb-1f96-4191-9e00-cd24abb2b613", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680636, "uuid": "f910449e-5fa2-45b3-807e-4a7b313a8c89", "value": "24576:Zy/hvtypXID932hv9rJpDo8x1ADxGjjE:M5vIemnrTDo8rkij", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680636, "uuid": "7a96ff23-2ba6-422d-85f9-f5ad18c738d4", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680636, "uuid": "eb5821e8-7f61-412d-bae3-f0fd2fab6910", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680636, "uuid": "9ad9e204-37fe-4fb0-ae6c-699a1a2ab4c1", "value": "preview668.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b82fd75-f7c6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684666656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666656, "uuid": "1dca43a0-f2d7-47f6-a803-ec74f059ac26", "comment": "Malware payload (Amadey)", "value": "8b15ca78f2ece46343248c28a408ae12", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666656, "uuid": "0834e9de-e262-4807-a97a-a6ffc18ce0a1", "comment": "Malware payload (Amadey)", "value": "af3c6399982b449edcb300b02c8a66921b00bfff63ce94af22c677856ffccede", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666656, "uuid": "363891e9-7b3d-4789-be94-67fbc325f1e6", "comment": "Malware payload (Amadey)", "value": "b959c31a04031e5082074a8fbff2a80a476ff132", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666656, "uuid": "515c548e-43cc-4732-8685-51958a92b93a", "comment": "Malware payload (Amadey)", "value": "2f50e6d9c341e8d803ef4d544156ba68b7fcdd03fbf130ae677a130c7cd9f8ce557a94d3c000ee7a7f07d6e3f7c6b7ec", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666656, "uuid": "b7ac4180-9a54-40ca-ae15-905030b1424a", "value": "T12F252327D3D84036DD7A13B41DF613475B39BCA2AD3883A32B4615A95CB24C4EA3736B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666656, "uuid": "458c2b4f-aad9-4102-bba3-99ff84d17c97", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666656, "uuid": "74819c10-6f0e-4934-8b53-a120469c2f99", "value": "24576:Oy30OWCFojBLLfUipzoIYwT16dlCOBsD7bsSFo1m6FSb7Y:d30O9yRfFpzIwTMoRD7wSF8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684666656, "uuid": "7843c197-2236-499d-943c-9d26f228ac2a", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684666656, "uuid": "a2aa169f-7ffa-4b22-b206-3627c83a7c3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666656, "uuid": "cbf463be-e648-40bc-8555-7612172f259a", "value": "listener924.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cfc5f82-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684680429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680429, "uuid": "b166e28c-bd31-46c2-8625-ca029912634c", "comment": "Malware payload (Amadey)", "value": "f50eab46fed36cab4fcc3fb75975ae85", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680429, "uuid": "2a4010cc-acfb-46f9-b62a-5659e6d1e746", "comment": "Malware payload (Amadey)", "value": "af7ea0c5eeca8aa7be3857cc5445ec49c40bd919567520ca7aea50ac9cdf6bfb", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680429, "uuid": "28dbb139-462b-4fe5-bf55-f0906e0d280e", "comment": "Malware payload (Amadey)", "value": "84ad08e3f573d5d89eeb454edefba6987a2cb65f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680429, "uuid": "cecd9dd9-57d3-4351-b298-40c673b3d6ed", "comment": "Malware payload (Amadey)", "value": "1bca79ed8f1a899530375e0b2771735467f1d1f59db7b5e70b9ebbbedd1eee3ce1cfe46c4c553107216c810b15fc19bc", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680429, "uuid": "a7c1c643-663c-4b5f-8991-465fa583c8be", "value": "T1A2252226B7E50432ECB523715CF306970232BD80DE79C35BAB91595A0EB2FE46832767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680429, "uuid": "dc9f631d-74cb-46c0-9f11-984c7fa9ec71", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680429, "uuid": "1d7ee2bb-d08e-4442-85f5-a3d2f9607e03", "value": "24576:cyx5QVB3Is7UcK/q6ElrNOxc3OOpwwv+AzDQQSV+lXdDQuxM6s:LxSVBwcK/q6ElrNuc3f6wvtYxgtdEuM6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680429, "uuid": "45bd758b-b992-4103-80b6-0ade0310e68b", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680429, "uuid": "0f860f79-e1b5-4ee5-a097-114f1951bc56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680429, "uuid": "6c59227f-fda3-4789-9d3c-321bd86f8bb1", "value": "24468551.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e770fb16-f7d0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684671212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671212, "uuid": "f18838b5-b4a7-486f-9b2c-d0380f035828", "comment": "Malware payload (Amadey)", "value": "c7fb16f5d817b703059a856341918221", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671212, "uuid": "13969e95-7816-454e-9e9c-19a001edfa64", "comment": "Malware payload (Amadey)", "value": "afacb647697ee12363961c28854ac809c93d66ad81fcaa9f3a90dd5b98ba988a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671212, "uuid": "8f076528-53b6-45a8-bd89-5e902857d6ec", "comment": "Malware payload (Amadey)", "value": "f4d5607482cccf3619c49423a830dade4d196fdb", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671212, "uuid": "7ca56776-1857-47b6-b4c2-f3601a785772", "comment": "Malware payload (Amadey)", "value": "e66d1a01f9e4d2d1efa20f13098bcd8fb6820f4e0dd856ab133a278005ead16af879bd3bd0e2903c9013e56b417f3096", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671212, "uuid": "37d45384-90a4-4515-a806-dbd593332a5e", "value": "T104252303EAD8A033EC7D277128F202530771BD604C769A7733099CAA5D62B91A5F5BB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671212, "uuid": "474604eb-a4a0-46d0-92b3-c3fe48b415df", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671212, "uuid": "b3de1b77-a9aa-4fb4-8b60-ae909535ca97", "value": "24576:Wygn8tJ6BjzqaqRH+OwawTxluVWN3+ihTqsX:lLJEaaqVXwawTTuoN3LTJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684671212, "uuid": "dbdce222-03c5-4013-a0be-58462c9c2c4a", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684671212, "uuid": "6f7880e0-974a-47ce-bd1b-1a167c6b8385", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671212, "uuid": "e2dbbc6c-69b4-40a0-b1b3-91b1f9e70793", "value": "CloudCheatsSetup534.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4e94506-f7eb-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684682804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684682804, "uuid": "60f4fa7f-b37b-450a-bd8c-9b7e4c8e59f1", "comment": "Malware payload (Mirai)", "value": "74f853d3fda6c41c03cc6e57a29b6223", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684682804, "uuid": "477e93ac-faf9-4fae-831e-b722660aaca8", "comment": "Malware payload (Mirai)", "value": "b0776dacfe52dca4d24a3e035811c2ce514e1f95450ffb57444b426d0908a8a2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684682804, "uuid": "89affabf-92b3-432b-906c-68fccc97544b", "comment": "Malware payload (Mirai)", "value": "20cc0c5a42422bd8c812fc5263d0eae31c7b6aad", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684682804, "uuid": "36033264-59a1-49cf-9187-2a21bfb6eef9", "comment": "Malware payload (Mirai)", "value": "cd413e662f1432bc410665c3cf055fdc40b273fbd83c7baad4c7be65ab8d3a88e0c2f2504303556522194c4399816579", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684682804, "uuid": "469fe04a-2c29-4cc6-bf02-fe27277d8d05", "value": "T195E38E44A78711F8C80BC4333097A63E892194A68062C6E9FBDD7B71D966FC17D4B1AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684682804, "uuid": "136cf7de-4d27-44ef-bce2-d4b85c9dd244", "value": "3072:+nn4VTYuhT3g0b35a0mbEr+687pScqnf2xquY:tVTYuhTQ0b3c0wEiD2fp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684682804, "uuid": "36906229-dc77-4d92-936d-5ae31488f84c", "value": 149456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684682804, "uuid": "f10b8e82-c3fd-4ba0-bf6a-a6ec66ebdd78", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684682804, "uuid": "8da464cd-e799-415a-b339-fe91cceb9078", "value": "74f853d3fda6c41c03cc6e57a29b6223", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5f05f4b-f7eb-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684682833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684682833, "uuid": "a4178a32-780e-4794-a1a0-b8ff238860c8", "comment": "Malware payload", "value": "ce625edb7527fca167a7d1af0ae8086c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684682833, "uuid": "ffef8681-eca5-44d4-bb06-5741adf130a8", "comment": "Malware payload", "value": "b080416825fab993b506a3c8de5df7ba9b4dee24be65208bf6c87191c61b6502", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684682833, "uuid": "92617a80-28dd-4b62-99da-a5cfedb7b776", "comment": "Malware payload", "value": "89c0e225c458ad81db56a2bf77fbd2b894de0d1f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684682833, "uuid": "1ec7a003-feec-4cee-99c5-ce2bdf331a52", "comment": "Malware payload", "value": "b0162e950df73c92f81fe96119018759415db7851e5540f9b7aeb9665adce2ddce20666d5c64e6ed7a7b8bec6b8ee4cd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684682833, "uuid": "2a70a32f-0f8e-44ee-b736-d0e7567c64d4", "value": "T157E34905DB408B17C1E2277AEBDB424933339B54A3DB33099638ABF43FC27995E26516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684682833, "uuid": "390acdc3-ff02-4309-a26a-315be9d0fad3", "value": "3072:ut8iFDKEfFN+Fa+1sW9h7nI8txVpUMbmQwfCMQiGW:s8iFDLf/+FaNQh7nI8txVp5mQwfCDiGW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684682833, "uuid": "be2193a5-975d-4cf7-a96b-5d87b7a3cea3", "value": 150049, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684682833, "uuid": "8496247d-acea-496d-8277-c4a596ea71d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684682833, "uuid": "07c53d72-28ec-4e1f-92df-eb43db5730c9", "value": "ce625edb7527fca167a7d1af0ae8086c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9bd1ce2-f7e5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684680182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680182, "uuid": "49c6d79a-1563-46e0-8804-44597a071387", "comment": "Malware payload (Amadey)", "value": "18459a1e2345144ea56c295a2b8bc447", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680182, "uuid": "747476af-5e02-4b85-a420-e1ffcef12aed", "comment": "Malware payload (Amadey)", "value": "b08511c0547ef99d31d874a99e26ea12986c05cd14e4cbb60c6c1a5aa2bb75bd", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680182, "uuid": "5ff142f7-d880-4301-ac95-6f8e19aaf092", "comment": "Malware payload (Amadey)", "value": "ef536489de7f217af1506b6e0568ba17afa13715", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680182, "uuid": "e96b3a48-de0f-458b-80c9-f31476a0c66b", "comment": "Malware payload (Amadey)", "value": "a8ec0c77da6fe8e48086912dbc18f50c7f074dbfc2db3e64c0e2bb3ab850c1fb7e2c11384ffbae13420acd873ac6e096", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680182, "uuid": "7f72fddf-a14a-4538-99a5-3215ff9e8e59", "value": "T1622523125EC88062E9F0377064FB13D70B31BD91EDBAEB631788959E59B31D0993A327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680182, "uuid": "f6fe66ef-9905-4f9a-b2b4-420b9f1235a1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680182, "uuid": "20b48fb3-5598-49e6-a7f9-ef886ae4927c", "value": "24576:wyLcviBeQdXUyPDq1ddI+Ea0pyKgu9V+Uz04Fye:3L3BeYHPDq1ddI+E5Vtz0Gy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680182, "uuid": "d34a1f1f-4f1c-467e-afd6-8f91f48494db", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680182, "uuid": "d39dc8db-fcce-4b27-ba7e-7f29240f22c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680182, "uuid": "af0bfd96-e596-43fe-ae6c-b27f85ccd9b8", "value": "stealer989.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "debf2684-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684680646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680646, "uuid": "7e83c604-38c9-4d2e-8651-01d891c91851", "comment": "Malware payload (RedLineStealer)", "value": "b343a078865184af87e9c40faefa3ed6", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680646, "uuid": "26fe7b26-5d2f-436d-b1e7-614f05f1b8c2", "comment": "Malware payload (RedLineStealer)", "value": "b0de802de5d3fa0f7bb2e91d05c18b206f6184c187732cc3b1d75210e91fb1da", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680646, "uuid": "0d484b98-cb5d-461a-9c76-0be4c8a5cd10", "comment": "Malware payload (RedLineStealer)", "value": "794727ad9d7cc364e4eafe6efe5523c394aed375", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680646, "uuid": "32bf6452-240d-4091-ab2d-05d1e3d77d39", "comment": "Malware payload (RedLineStealer)", "value": "0b53a08fda8bf12d3e9dd1f3332ff6ac0913ff0b51c73fe63886222ace5f577e4448c69d70b925ce8d97403f1d71717d", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680646, "uuid": "304d2eb4-514e-4929-9dd6-3d124d3788a0", "value": "T1CB252346EBC45062E9B41B7298F903C31936BDE26C2893AF2B5D6C1E4C736D47872727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680646, "uuid": "607f11ed-f1a7-4704-8f35-d51de97a0d50", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680646, "uuid": "82fe89a3-6cd8-42b6-98d9-5a4fb7912e1a", "value": "24576:myoYyNA1rPIYCHhjW7YJB0yqc5eghJWTdm8+zR:1o5GrwPhjW8ac5ehT9M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680646, "uuid": "ca94d168-eb13-4ce8-b3c4-cbc5b42e09ea", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680646, "uuid": "a84217fb-e701-4e00-b58d-a6840406bdb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680646, "uuid": "a9bc4c47-304b-483a-9ff7-33a321a2b40c", "value": "readme983.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2258ba3-f7d0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684671203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671203, "uuid": "5c8f2a2d-ffe7-4391-b79b-e71eb4a1d170", "comment": "Malware payload (RedLineStealer)", "value": "76d22f98a96ec0f505b726cce2afa9fa", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671203, "uuid": "50213eef-71b1-4894-9d21-be2d3ccea2dc", "comment": "Malware payload (RedLineStealer)", "value": "b14bbf5f33707d4dc001a8c90e93a181941e8446caa9eced09e2f05cc233f520", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671203, "uuid": "a12959c7-9aa3-4167-8054-8fd538a81b07", "comment": "Malware payload (RedLineStealer)", "value": "2e59e737af43f02f496fe1f3c6f78090c555e2f6", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671203, "uuid": "cdf8545c-aae7-4708-a18b-7e040bf74f2b", "comment": "Malware payload (RedLineStealer)", "value": "f063df9c375481afaec7360f1134474520efc38f64811e9c53719d83c1480fd34546bb808acecaf67c81de142d004d13", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671203, "uuid": "930e1f12-5852-47ae-8cf5-de0807da9511", "value": "T183E3D624279F8A30D6BB497D6CB19DC076BCEC126952D74A4ECCF0593A73B80DB126B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671203, "uuid": "1cb188fc-775c-4663-b038-716084a7dc44", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671203, "uuid": "c23b6429-4ef4-4a97-bf4d-2832a22dc1b8", "value": "3072:YV+m5crQmRSR38AQtQJ8uptt0phbZV8e8h1:YjCZE+phbf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684671203, "uuid": "12c514a1-5950-4f58-897d-a90b1e92ce84", "value": 148563, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684671203, "uuid": "51a27eba-d638-4517-a076-8111e1947303", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671203, "uuid": "07f00332-968d-47b1-847e-26d8db01e90d", "value": "3535634980.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60acc065-f7f4-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684686448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686448, "uuid": "8f670fe7-90fd-423a-8e76-129290ef9c3d", "comment": "Malware payload", "value": "7c100f11a0dc6de538cb93afffead67a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686448, "uuid": "3214d9d7-e3f9-489b-b2ae-5e5cc6e9a31d", "comment": "Malware payload", "value": "b15ebe94681a4c95a0064c7d9b2b9300392f1edd3f23d21859603f633c5d3a4d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686448, "uuid": "1c631654-03bf-444f-bbc5-97605ca5c714", "comment": "Malware payload", "value": "0ffb9bc7d076353a49d8ae6d754037350e73bd2c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686448, "uuid": "bed1638f-b698-4827-9a6e-d874080dc1ec", "comment": "Malware payload", "value": "698d4c01db5ecb2f8c80f3433c2e8083ab524f07e42b9a38709df624099750e89f0340270e6d9cf6b10676e90a659ab2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684686448, "uuid": "1fde0c68-adb6-4d63-8f0e-f845083e5e2e", "value": "T1B9435B02B31C0A07C0A31A70253F6BD197BEE9D022E4F684756F8B9A9671E375585FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684686448, "uuid": "e72d4ce5-d965-40f5-aa06-e4a1e706e4cb", "value": "768:iDAJ1LlBL/tQCRu7RPh7mgGs/ZuRHTCESGj0rlb9Sm9lF6jENq+VuOFRztUUSMwI:mAj+CMlGXzn7YBxSuFJNq+I2zzQxnagE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684686448, "uuid": "a26aefda-3bbe-49fa-8cfd-fd7f9743192a", "value": 55856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684686448, "uuid": "707c6e22-d3ad-4a77-9993-a203fb8a84e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684686448, "uuid": "ba14b039-dadd-459f-90a4-74b0ac40a8dd", "value": "7c100f11a0dc6de538cb93afffead67a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "016ce39a-f807-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684694449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694449, "uuid": "1fe62bdb-fbb8-4d48-91a2-7c6781df1c50", "comment": "Malware payload", "value": "a8f0f6faa68d6f0052f56c202de2c581", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694449, "uuid": "35560202-3720-4fa3-9276-fe7119635e10", "comment": "Malware payload", "value": "b1669034d6e7750ae084b2dc2a1fff6af897504a9b993c2a8becbc666ec023f6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694449, "uuid": "df8841b3-3766-44d6-ab0a-9c7ae5e6faf0", "comment": "Malware payload", "value": "557decc89a93a96e6731780425397ac0ba90f62f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694449, "uuid": "24fd1426-0dd6-42b6-923b-8e5312bc06fe", "comment": "Malware payload", "value": "58ebb9498f4bc235cddc3117ad1e8cc4b2077166b0e40238b5a677193b98d5e4642d9278ef93e30422ee4eb2e66ed975", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694449, "uuid": "3f92c6db-3644-4494-97ea-0b81d626e65e", "value": "T104533B02F30C0947C1635DF0363F6BD2D7AEAAD122E4F685752E9B8591B2E325586ECC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694449, "uuid": "9680ea81-cdf9-4122-b00a-dfacba4c34bc", "value": "768:AesXqoRFmmpHoOX+a2MpSVUFxC9sUzixL2SWtwc9pFhitHHV3UQ9oAMUwxI7:LoldXDLphFx8sY4CSQw4VilHV3U3Uwx8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684694449, "uuid": "91158883-8011-45a8-b787-03c5c09b47b6", "value": 61352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684694449, "uuid": "a6902ca3-2090-4fea-a3b5-7a770fbf7014", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694449, "uuid": "21a75f9e-acde-4539-9589-8ef5ca41e313", "value": "a8f0f6faa68d6f0052f56c202de2c581", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38a6f94e-f7e5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684679938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684679938, "uuid": "304300a3-b73d-494e-8ce5-4856ddd1a306", "comment": "Malware payload (Amadey)", "value": "db0286db8a9113a250b937c57a05d7c8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684679938, "uuid": "25a688d9-cc08-49c1-902d-f6e370bd1ca7", "comment": "Malware payload (Amadey)", "value": "b1a9208f00e3797cbbed05a848210b53b385cf8eb30a6e7016e9da34f6f17624", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684679938, "uuid": "e2cda839-c790-45a4-ab96-3af118bd3fd5", "comment": "Malware payload (Amadey)", "value": "bbe8a40d1925d025e5b239160b4958f2b6848562", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684679938, "uuid": "9e77a3d5-0eb8-4a97-b4f5-bf5963c8fd6c", "comment": "Malware payload (Amadey)", "value": "d3266ef7f3a78499d03ced96314def11dd33a4929b1cee60fdd7d2175c57dd1846bb155d5f31449b340ce6bda26508b8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684679938, "uuid": "7dc5a37b-499e-4001-87f6-a90ff72d0b1b", "value": "T12F25234E9BD991B3D8F42BB014F603831F377DF15EA453E72292605B98B31A9E13136A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684679938, "uuid": "8c1fd5ac-be12-4f77-a178-13f43296d0f1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684679938, "uuid": "46e03daf-b897-4b4a-ac18-eb1d5846234b", "value": "24576:nyJzhhb3M80BOEQIr4lRetKt5g/oky6+qY4TIkPuDpY:yJzjb3z0LkRetU3Mhwp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684679938, "uuid": "8d8767a0-7d61-4c28-85a2-2b97737086da", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684679938, "uuid": "bcc3f088-9102-4d63-ba7d-3b557c39c892", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684679938, "uuid": "948cce87-cebb-4a87-887c-8f163de60e59", "value": "4743916.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6172329-f7ed-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684683585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683585, "uuid": "e0a7e263-80f6-4577-b092-508b2b686332", "comment": "Malware payload", "value": "2a38057f25938584d8fc0df684b6e1b9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683585, "uuid": "cd499b1a-c092-4b67-8ced-98bde2ac775e", "comment": "Malware payload", "value": "b1b6d8ae4b798ee7125c8851fd2cbdf0011f28397cdced5b6dc6ed771bae8951", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683585, "uuid": "3c478dd1-cee6-43d7-b35e-70243cb69c96", "comment": "Malware payload", "value": "20face96eb7b40c3af1d8859c20892a1eb39266c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683585, "uuid": "7537970d-7bdb-4ca7-8c39-b6894f978c39", "comment": "Malware payload", "value": "d2e7eaf96f697d7cb30022604598459e1589d0aa0523474c1bbad45f91d05429b47e736d3b487d234845c5081ed6f8c9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684683585, "uuid": "da0dc78c-2aad-42e5-adfc-e53e62a88972", "value": "T134144F0CEA2ADB6EFB7841FF72E3A5106B2433D57A5D824A807CFD430970947A42B675", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684683585, "uuid": "0756da5a-6d64-4f33-acfd-f93b28c26db6", "value": "3072:iCJgNhy90TW/oQrYcoba4KfJGis4vt6j54fcj02A+JyDgQuJ:NgNhy90TW/IQbPvt6j54fMAeugQuJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684683585, "uuid": "c2c89ff8-7681-490e-9bd3-7df5185dddfa", "value": 194696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684683585, "uuid": "7ddd9a9c-9dd2-40a5-b778-74ea38ea1f4b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684683585, "uuid": "861ef37d-5835-4095-b6c4-0ed61018caee", "value": "2a38057f25938584d8fc0df684b6e1b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11c5c240-f7c8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684667418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667418, "uuid": "549ef807-020d-4155-a664-7a64c057dcd0", "comment": "Malware payload (Amadey)", "value": "767c14ecf770304495eefa5ebbb46378", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667418, "uuid": "5fe8fe66-8d76-4ad0-ab22-ee0ba0847041", "comment": "Malware payload (Amadey)", "value": "b24adc6b9ce07c2e25a33e9884396ac6db0fd4b1065cb081d2f74d2452c51d63", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667418, "uuid": "696607b1-06aa-4804-8fbb-888cb53e653a", "comment": "Malware payload (Amadey)", "value": "e8cb2283ca445e129fb396599b29c4a0403cbd95", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667418, "uuid": "b2c063e5-f21e-42a2-b1c0-16c35a45b222", "comment": "Malware payload (Amadey)", "value": "2b418d8281ce49ae1ee37ecb0ce2d0670fc105163af31a9f0cf987c8200fb3794da9cd64fb2ca11b14f51bf3e515ecd9", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667418, "uuid": "d127ab5a-e7ee-4aad-b3a7-848a26cb0aca", "value": "T19D2523037AE95272EDF9673448F74AC72A367CA1ADB9C25E2346B45E6C312C0D432367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667418, "uuid": "5a49817e-0089-48e4-92e9-14f2105f5c96", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667418, "uuid": "eecb1c19-e0d0-46da-a55d-0d334a51990a", "value": "24576:Ry37/8eVOq67hp+XROBOv4A5vsilJd6LDW:E37/dYq4MoI4A5FKf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667418, "uuid": "45498373-dffd-4436-8588-d54bde2d712f", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667418, "uuid": "6aa75666-476e-4a05-a812-c98d2a7deb9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667418, "uuid": "a635f827-d735-4198-b288-41196e81f54a", "value": "utility579.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "527575ea-f7e5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684679982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684679982, "uuid": "23b9372e-d274-4c6a-b3a1-bc8d714fc9ff", "comment": "Malware payload (RedLineStealer)", "value": "463447ff3e7ed28b40c5785f118741bb", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684679982, "uuid": "8571dce2-4552-4ed2-bc3a-f7dff43b200f", "comment": "Malware payload (RedLineStealer)", "value": "b27643ecd6d085cf7453d4e5a92aac8a47bec27f6509581d015263289a7aff87", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684679982, "uuid": "d62fa3d5-3ada-41d1-afde-8148463938ca", "comment": "Malware payload (RedLineStealer)", "value": "68c04165af14b83d37ed9036aa36ef7b4027eadc", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684679982, "uuid": "f9cdba87-0f81-4dd5-ac81-5243ef39b65f", "comment": "Malware payload (RedLineStealer)", "value": "dadcbb4f572cdc58374b8e2654ad9582da555e5e8d4e6ba77483f92968b1a1c21100f0e5c2d338ccb95e83aaf02e9d03", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684679982, "uuid": "377f7d61-a6b9-424d-bd85-848b60b749a1", "value": "T16D25235BB6D84432E9A4173058FA02C30F36FCA11EB8631B2B955D5B4D722D47632BBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684679982, "uuid": "2e7c8305-1ad8-4dc0-97f0-738b1205b1c3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684679982, "uuid": "2ebbc7f1-4773-45eb-8488-05c06a37bd7c", "value": "24576:ZyrjdY+kaROSB06WObIqA8tqkvUEgLZR3:My+kCjB0wbIqh+EgV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684679982, "uuid": "fea0f67a-43d7-4a88-8743-3cae44311ea1", "value": 1056256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684679982, "uuid": "1aa02619-8a5a-488d-8669-f69a04b800c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684679982, "uuid": "398b834e-5022-49bc-b72e-476cdb514c1e", "value": "achievements604.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d73e6d1-f7b1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684657720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684657720, "uuid": "fb54f620-83ae-4806-8b56-6d777b07bbee", "comment": "Malware payload (RedLineStealer)", "value": "d36700ee562705125b3fd6247d435865", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684657720, "uuid": "fa4cdade-c051-4410-bdba-1c2aee3b1edb", "comment": "Malware payload (RedLineStealer)", "value": "b294efba1beb51dc68bfa0607873dc32e4f2a650182a752a56ba9b05d8ec7b34", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684657720, "uuid": "1000669c-4cc5-4c09-8a08-f5a18d57cd68", "comment": "Malware payload (RedLineStealer)", "value": "504d731da848891312845c284fe75ecb208544ce", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684657720, "uuid": "b20a498e-45ca-4f85-8388-07c2055a668d", "comment": "Malware payload (RedLineStealer)", "value": "d6d4e50d77fc00f33c5d477f55ef679793ca28bf528d27ab361132fcec61b7158d0427d9ef929e67181e2f177d004628", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684657720, "uuid": "ad707b70-5dee-4409-8760-b69011ef274a", "value": "T19B252253FAD84037E8F12BF549FB02931A357CA54DB1439A1789DC8E5CB2648A93237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684657720, "uuid": "00d22a77-3e8e-415f-a274-881371a917fd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684657720, "uuid": "626f2c03-f05c-4349-ba73-159aa7eebfb8", "value": "24576:+y66d0ciJvMtiEy1cg/h981j6AGjDa9/+QqhxcHq0m:NhdZiJvuiTcg/HTjSGF+HH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684657720, "uuid": "c2073c25-493a-410e-a361-f1881bd72613", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684657720, "uuid": "373161ce-f42a-41e5-bb61-64b2cf154978", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684657720, "uuid": "3ee711c7-cd70-42ea-a5fc-f91496326d3d", "value": "353512.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91f31416-f7c7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684667203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667203, "uuid": "872da777-cf4d-4523-a4ce-9982e0b6a029", "comment": "Malware payload (RedLineStealer)", "value": "8638e455584eadd49c42d55b6e1f6170", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667203, "uuid": "226a5752-14d7-4c45-8cd4-abc4ed7a3195", "comment": "Malware payload (RedLineStealer)", "value": "b30ca2040fe75644ea64a3c946b7508937a9a95ea5f740f22cc9b6c5186b5167", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667203, "uuid": "0a24eba5-8105-483f-a955-4a648e53fe40", "comment": "Malware payload (RedLineStealer)", "value": "c4cc5fae0bf933ff4b42aaedcd3cd2d3aa51abef", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667203, "uuid": "945f9028-8152-4aa1-8f5c-86305c97c9dc", "comment": "Malware payload (RedLineStealer)", "value": "f301bdaa2aa33e77258e24384f7daa66df114ec620947c9cd271350c55959c4ceff09085e4c402e63e3a34aedcf6cf84", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667203, "uuid": "3511815b-3900-4e57-8b7a-2cc1ea9af50a", "value": "T12C252313A9D89075C9F6537458F706C31A35FCE08C78871E3B85AD974C32898AAB673B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667203, "uuid": "e1310cb7-6cd7-42ec-bec7-f4bb2f8d9a25", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667203, "uuid": "d293de35-9ea1-4bf8-8098-b1c48b968599", "value": "24576:vyD+QLZrIea54sqcDkKSYzYCrIUheYbD4+0Y02Y:6vJIe4Zqc4jyeI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667203, "uuid": "ed6ea453-d505-46a9-87c6-70c52cb6dee6", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667203, "uuid": "b865ebac-9d55-45d0-a6e1-aada0874596b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667203, "uuid": "0b38e9c0-7eab-4195-9f94-2bfe3d69e327", "value": "245245254526.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9739f643-f7c7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684667212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667212, "uuid": "0c7728ae-bb17-4522-a6ba-73554ec3cc57", "comment": "Malware payload (RedLineStealer)", "value": "55dcfa9bfd61cf19a51365a1dde4ae45", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667212, "uuid": "ea089b42-6250-40c5-9fbb-1f5b319ec4c2", "comment": "Malware payload (RedLineStealer)", "value": "b337038400c2477600c44b787224b12d02f105f9b6f38bf43cc4fc3b67c57bda", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667212, "uuid": "79f74d89-cb98-4faa-86e5-dd791ad4fa56", "comment": "Malware payload (RedLineStealer)", "value": "77e022b452241b7763d5019036a573f40bac021e", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667212, "uuid": "26298662-bdfb-4357-8e08-45e5dac87cb0", "comment": "Malware payload (RedLineStealer)", "value": "f28d0ccc9fbe44a7ac886a335398ecf30f17f04f72aa129b893ab435bd90c5638d2077598137ea82549ddb9bb65fe6d3", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667212, "uuid": "d6bb134c-9561-4f42-a286-8a36e9ece616", "value": "T1FD252303F3E48072D9B597B47CFA024B2672FDF06DA983292A45091E1873B93957277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667212, "uuid": "3f656593-6349-41be-b43d-a30343f54101", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667212, "uuid": "e1af36a8-a626-4bc3-82d6-194890cc4b52", "value": "24576:HyCstGOWnXvE75J09jJ3NK4Mke0mjqOlYRnmLwiDdnl:SCskOgfqL09F3NjOUnmLJB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667212, "uuid": "239afc6f-b45a-490b-98f2-8db3c93f71ba", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667212, "uuid": "244d4f59-3dc1-4e35-a7e7-70cad8e6815e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667212, "uuid": "d8cde70e-b49f-4ea4-852d-8f6b13e3ccb9", "value": "32332137.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3b9960a-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684680574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680574, "uuid": "edb1df72-c69c-48ba-883c-0ee58c66dfd1", "comment": "Malware payload (RedLineStealer)", "value": "a2c40b9b8de91a80afe451666d42064f", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680574, "uuid": "7e63485a-7639-4616-ab76-0991aad960fb", "comment": "Malware payload (RedLineStealer)", "value": "b353ac82c0de547e671660603aee54f5a20b62b4023563c998851a1d89afaa53", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680574, "uuid": "23d5fe86-552c-4797-8db4-a6fe4d0ad4b4", "comment": "Malware payload (RedLineStealer)", "value": "559a03301b6f53f573671ba0b1ebaa46b8ba751f", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680574, "uuid": "e4152a57-fe4c-4986-b983-674b489abdbd", "comment": "Malware payload (RedLineStealer)", "value": "7b8f02c8ce6f0e92be4694ec8449483b3734bc9e058e446dbe4ef05ab97fab5b4cb67f8509128ea7b4f87230b74dfbf3", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680574, "uuid": "25086b6a-c35a-4f06-8433-69321b12cad7", "value": "T1CC252366AAC40477F8A1537045F692E70736BCE14CB8534A1F9599EF0CB2AC4DA3273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680574, "uuid": "cac4e421-9d03-461b-908d-34511f4caec7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680574, "uuid": "baa7e45f-2df9-48d1-b08f-93c2f1b5cdec", "value": "24576:TyhRnEwhJbwqx8mDD/NaHs3yaGAKLUs0qLPE8StTJs2FE:mvh2qGsDmsiay30qLfATJr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680574, "uuid": "bf2b2404-d329-4708-80df-aafb9d01d4db", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680574, "uuid": "5d388870-5a7e-4a78-91d1-62af9c58966d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680574, "uuid": "ddb3944c-6369-4722-9d0e-bea85be27b73", "value": "filter516.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c6c0bd4-f7b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684658497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658497, "uuid": "b2454dc7-9f89-4be5-9f36-670c1e9700d6", "comment": "Malware payload (Amadey)", "value": "5c638032a0aaa957c4d64aae28f991f5", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658497, "uuid": "1e88ae9c-8403-4b09-9dfc-005fc2f6512a", "comment": "Malware payload (Amadey)", "value": "b35507a6cb5dd56560c5ab39d45a844ab3cce4ad8e08da54b90b5d74b03680c6", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658497, "uuid": "bc704f06-6c4d-422e-a649-03a80f26c734", "comment": "Malware payload (Amadey)", "value": "8c199ef20907c0e9ee76f7791345b54005ba29bd", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658497, "uuid": "84de1d2a-e13e-47e4-9947-785cbe58f06d", "comment": "Malware payload (Amadey)", "value": "059c060c5b0be3c95dd7c6dafd9fe88c6a196146915da885157dc5b07f68e34a53c0a3d5bd830a40b52d10008d0c9c39", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658497, "uuid": "c125e79e-51dd-41a7-a565-7499353364ee", "value": "T163252363ABF85832DAB11770A5F903D30D32BDA15A2A933B63459C9B4DB2550F83172F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658497, "uuid": "f9d40df0-655d-4803-a459-701d8e31d166", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658497, "uuid": "e6a83b7a-ecab-4f16-a8c2-699ad9dad743", "value": "12288:5MrRy90ytzuF8LtJmbulFcQKr2h4uSMcVCl/i4NebH62m6Re3mm5vXJptIlB0ejv:EywFwe1QPzlNeOYml3uB0iWh+CL5vW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684658497, "uuid": "c631019b-f00e-46fb-bc3a-b8ef5be6d6ea", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684658497, "uuid": "46ff7a59-7b09-426d-a5b4-6e95032a4b4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658497, "uuid": "a2aa9fc0-59ab-4df6-a1a4-3e8b5338918f", "value": "wallet361.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "629e60df-f773-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684631046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684631046, "uuid": "62128cb8-eb5d-418b-8180-eb9ca3202b4d", "comment": "Malware payload (RedLineStealer)", "value": "6ca0cd72acd293137a7aa149a046591a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684631046, "uuid": "5b433558-02fc-4574-a08f-206f3d22718d", "comment": "Malware payload (RedLineStealer)", "value": "b3755eb8f78e65b8bf54279583995deaa3b7dc55f192b2ec80df204471f64080", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684631046, "uuid": "d6dcdd6d-72fb-402e-a16a-2124e4d2ebb9", "comment": "Malware payload (RedLineStealer)", "value": "8714ebb20b3174507498a51a86d3f1da4a9e700e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684631046, "uuid": "e60d2436-b943-45f0-a629-8215e71ce0b4", "comment": "Malware payload (RedLineStealer)", "value": "c8976c790eb85ff9a11dc8c30a872dd52a3b913494ae4429e1a6d9bf8dc5440761166008f345b12e3917137e1bd4402e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684631046, "uuid": "ef27f527-1db5-42cf-b900-552d7f2a5936", "value": "T1C3949EC392A3BC6BE92546728E3EC6F8761DB5524F046BD722586B3B04711F2D6B7302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684631046, "uuid": "509e3924-840f-4f99-a046-9790cfb4a8e6", "value": "1f33507fc49ff617ecb248bee3af9a74", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684631046, "uuid": "4db0055a-b9fa-48d6-97ca-a8d232ad17c7", "value": "6144:2uEZPdqXIQvqXx5CTB2wrEMrSCCAiLcI8AI2UFw1QAz67v7cTP:2Pda/qh5QB9EiBC5cI85dZk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684631046, "uuid": "d5628eed-84c3-46fc-8117-181ed21706dd", "value": 448000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684631046, "uuid": "1db6556f-8e41-45b9-b2fe-1ee3c4bf507d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684631046, "uuid": "13f1e7a4-cb10-46f9-a261-527e7e898838", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dd9794f-f7b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684658392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658392, "uuid": "827e1538-5744-403b-b583-86c2a9cab7bd", "comment": "Malware payload (Amadey)", "value": "77cbdd643c3c3a7be284847e5c5a612b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658392, "uuid": "3e3a72f2-f7a6-4626-b14b-035c3ff1c5ce", "comment": "Malware payload (Amadey)", "value": "b4f80998af25a0ea6049a7e197bc8d7aaebf3fda0b9ed4947b7cdbc19ef922e8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658392, "uuid": "78c78231-00a0-453d-8bdf-18161d5366ac", "comment": "Malware payload (Amadey)", "value": "10340b3cfb5d1fb90c6faa248b96952c6b616888", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658392, "uuid": "d67f6ff8-4184-4e5d-a20d-2d1dc16be370", "comment": "Malware payload (Amadey)", "value": "d432b54ee856132414d047e2f6d413179013308a6e7af460f7f08b52446ae6c38f6205c24d7ea9c7289e9eeb8319f144", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658392, "uuid": "c436ad39-c7b2-4925-8e8d-34fc489ff37d", "value": "T10C2523165EDD6065D5751B3129F322931B7DBEA04C34D3672B9BAE0A4EB3A806C3037B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658392, "uuid": "69a4556e-25af-409a-8170-54e74b81db91", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658392, "uuid": "8f274f72-9eb2-47eb-9f77-a3cd19eab9c5", "value": "24576:yywRjxPlYlqhEnLhWcZS2YqpUG6OHwKsJpRcwiB:ZwhxdYlqhoRYqGubsPqwi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684658392, "uuid": "776d7a14-17a2-456d-ad71-66dd8b165ccf", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684658392, "uuid": "bd2ec858-889d-49a2-961e-faafd7513be1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658392, "uuid": "9de14ebd-f91a-444d-a187-c91766dfc723", "value": "4743520.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa6ac786-f7c8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1684667808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667808, "uuid": "3c778f98-4c82-4c28-9b15-aeebd29d7a70", "comment": "Malware payload (Stop)", "value": "8c3428b1143ac705a5c5ff0c1033ad29", "object_relation": "md5", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667808, "uuid": "b97156ca-a67f-48f7-91d2-e796fd7c4c12", "comment": "Malware payload (Stop)", "value": "b5521194d6d62bb2f3d7ef73ac45bd751e7a1072f794e486884d51aedb852cb5", "object_relation": "sha256", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667808, "uuid": "2922759a-8f93-4674-af17-40104c87136b", "comment": "Malware payload (Stop)", "value": "deaa9bc33caff58faf504dc4b9d353a54a9106c0", "object_relation": "sha1", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667808, "uuid": "7f295386-dee2-4289-a33c-e8c279847b02", "comment": "Malware payload (Stop)", "value": "e1ea82ffd17115ef41b5267d73322ae8ecac268d5420b682a34ae67edefb5298cde6d44cb7ae070ab92667a03fe3157a", "object_relation": "sha3-384", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667808, "uuid": "34b2d583-98a8-41cf-a7f5-6479671338e6", "value": "T13B05F182A1D3E86ED52A42718D39C6B4661EB8715F152BD733487F7B18702E2CAFB341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667808, "uuid": "062ce9e9-2990-402d-8a48-5173ea9a70a6", "value": "dc368f441a884fce22ecc585e2bd5326", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667808, "uuid": "175c81f7-728c-47d0-b440-693d3cb04c6a", "value": "12288:R/K8YKM2bsAR6iEvrsstkXxh3l5JWyhGGcsScUEQrnG4ftOjhFJQ8N:R/3UWAiCshb3l3yGcFrrnG4ft4X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667808, "uuid": "606f17f2-6c04-4e77-8de0-88c3e79a6276", "value": 813568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667808, "uuid": "6d531624-ebf0-4d89-bc25-565a1602e790", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667808, "uuid": "7ca21bc4-c598-4d24-bf51-1d2359e51623", "value": "networking785.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33ee1358-f7f2-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684685514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684685514, "uuid": "e0dc6c43-215a-4c27-8a4d-9a503e1acbb5", "comment": "Malware payload", "value": "7b678af44cd5c593d18593d5b86fdfe6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684685514, "uuid": "f6f8ab7f-32bb-4908-8862-3d983133a0cc", "comment": "Malware payload", "value": "b5a7da2d60fd2eed4456db365f30901d82953b001a2b21db1322491d7944924e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684685514, "uuid": "0fd7c56c-8b51-4591-a244-191e17af4534", "comment": "Malware payload", "value": "ceb94f331d9fef03ff7abe33358d95111df0669f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684685514, "uuid": "e2fae52e-3cc4-4847-9e1c-43f9f6f45dd3", "comment": "Malware payload", "value": "e8919fc3410289a6c232612b3815af8139225bf32a08d35ac1e428d31865179417a61b0ba3823224198e89aa914c6e62", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684685514, "uuid": "6e6fd9e9-9b8b-46a0-a351-844d765085bd", "value": "T1CA533C9AF801CD7DF45BD77B4457090AB630B7D142831B3623ABBAA7BC721991D23E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684685514, "uuid": "0f4494c6-b031-4fc2-9a03-a80643bd9790", "value": "1536:wdcd7Nc7rnEfodym81QnPiAA4wfd1f7gpEuo+GY6q:wdcdBEr6odydsAbfzw1GY6q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684685514, "uuid": "b6fea76d-92e9-42df-941e-3a20effa5425", "value": 62356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684685514, "uuid": "dc45fd8d-a05f-4e28-bfa0-983b7505617c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684685514, "uuid": "41ae30ca-a6b2-4502-88e0-31ff022879dd", "value": "7b678af44cd5c593d18593d5b86fdfe6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29067190-f7b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684658437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658437, "uuid": "d375269e-12cc-4f59-9afa-ffd61badc24b", "comment": "Malware payload (RedLineStealer)", "value": "b6e142313ab38f8ac9ce925b3030c75d", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658437, "uuid": "bfa34e5d-ad82-4e24-b958-5f6c11fc5a57", "comment": "Malware payload (RedLineStealer)", "value": "b6326f9af4313c49a707248fdfb5f55bcedde4c57766051a118e74d3f61c6249", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658437, "uuid": "b7273ddc-f6fe-4ae8-beec-ade100f9a3d4", "comment": "Malware payload (RedLineStealer)", "value": "42d7f8ccde29f6fa5e232de06eb86c3141af39d1", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658437, "uuid": "2432e629-4073-4f57-b6aa-dfd213184bcc", "comment": "Malware payload (RedLineStealer)", "value": "37eb98e160ddb0f70027a7c140a6439851a2412f0231896eaca11f83a6b501f1189d738362c901065922700a59f1191d", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658437, "uuid": "6707b1f9-9942-420b-8868-d7b41c216de4", "value": "T13B252346DFE80563E4B513704CFA12970B367CE10EB8931B7B95FE5A05B7288A6307A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658437, "uuid": "8b55b27d-7d3d-4984-87f0-61e74838ea8b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658437, "uuid": "10fdbd2a-c2cb-468f-aa53-62e904b117f9", "value": "24576:jyRqpDt+NIf7H/NOb+9FoSxQB2pjTXNNdn6qod:2RqyNOg+RTXNN8qo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684658437, "uuid": "67982156-96f3-4616-8f25-913f8af2fa7b", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684658437, "uuid": "422415ec-728e-4865-9792-8971b017ac3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658437, "uuid": "a1806ffe-8f15-4829-8a15-2e39e27c0a03", "value": "finder266.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b3682b2-f802-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684692344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684692344, "uuid": "10d1070f-3d9c-4f4f-9d2f-d6bf113bbbef", "comment": "Malware payload (Mirai)", "value": "cd97a56841373e1312f6bd6471d3e02f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684692344, "uuid": "b474c1e0-b21e-4f44-bcdf-e21b322043cb", "comment": "Malware payload (Mirai)", "value": "b664da7685301399b4295e8078198efb0b38f55438c96b8c28b11359d6de42a9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684692344, "uuid": "fd449496-45df-43f4-ad2f-18a487acad2c", "comment": "Malware payload (Mirai)", "value": "175df75a0ea9978d87e7c878f9ec88b2e9aa4964", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684692344, "uuid": "20f86d97-b396-4c7b-a195-97b44bfc4bda", "comment": "Malware payload (Mirai)", "value": "ca9adc3d93376c2bc69114e317357bef82bb93ce7eb0f7aa10e5d42a76423659a1c3d1ef455502fe09d608bbcdd5c9a3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684692344, "uuid": "aa76a110-b283-471e-8a49-0fd9c2aef9e5", "value": "T1CD73D70AFB514EFBDC6FDD3706AD1B0135CC558622A93B3A3174D928B64B50B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684692344, "uuid": "b31842ba-0c4c-4de7-b333-a5c27e261029", "value": "1536:VroY4zp+qB6xV4yWoWNsTwz+o7ZWt81gP8gbz1A:VroP++yzGsTdeYbz1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684692344, "uuid": "4b48d2af-22c6-4dc8-85b8-d786041d4082", "value": 80704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684692344, "uuid": "11b6841b-88b6-48ca-a0e9-349c9be0a43c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684692344, "uuid": "8918eb67-8aa0-4b80-995f-d420534182d3", "value": "cd97a56841373e1312f6bd6471d3e02f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1d9828f-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684680598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680598, "uuid": "480b2abb-bf69-4ece-adc3-740029eef2e8", "comment": "Malware payload (RedLineStealer)", "value": "11b2f00ab7225801d236144afaf19146", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680598, "uuid": "1231c281-43b1-4301-9c60-755a7ed3b8f4", "comment": "Malware payload (RedLineStealer)", "value": "b6a1fda213a3f6df2d7642e37c96327a56b96cbe6203a78313d31d93dd449384", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680598, "uuid": "505a45cb-28bb-462c-b1a2-d3314368e3bc", "comment": "Malware payload (RedLineStealer)", "value": "c3585c2c8adc930d74a33cf05c5ed380801c3eda", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680598, "uuid": "ebe81f5b-11d4-404c-a84b-fb96fd02b27a", "comment": "Malware payload (RedLineStealer)", "value": "6f4c2be31108cd8e379d4a24cb78075f2673706b631d8afc6dd026ee6ec42334532ac22c5e72c84a64e6f4bb7625110b", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680598, "uuid": "e011ac8a-526b-4818-8a89-12070394936c", "value": "T14D252313ABDD9172EC79233094B316930F74FDA09939465B3345AE6B09B3AD0E8B5336", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680598, "uuid": "10a654d1-2e60-41c4-ba81-cea25d996d66", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680598, "uuid": "261fb65e-a646-4ce3-85dd-c2324fb85456", "value": "24576:My9BKbyxGqUROqeRTqQTqChVfnABLS4q7:79BwyxGq9RTqQTqGVvd4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680598, "uuid": "6671dfed-78d7-44f2-b945-128ce7a0fc52", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680598, "uuid": "b0e984b8-28a9-44ad-8bc5-39bf62ff2ff2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680598, "uuid": "19b3a6ba-66ad-46d8-b71d-12e92ceaded7", "value": "launcher443.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85090a04-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684680496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680496, "uuid": "9fc61808-ba69-4332-82bc-bf946801ba2d", "comment": "Malware payload (RedLineStealer)", "value": "2aabd310db25cb143404caa6a59deda3", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680496, "uuid": "d8d07ace-5b31-4677-a1a8-2d2d022cb137", "comment": "Malware payload (RedLineStealer)", "value": "b6ba4eae40ae0681e8a0020243baa264e9d5c9c3e77c2e6c142def249b912716", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680496, "uuid": "d0e8173f-5d52-4378-9d69-836ab3096513", "comment": "Malware payload (RedLineStealer)", "value": "d2716dffff7f452ec8caa93203a7bfe9d4120bb8", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680496, "uuid": "5e535cb1-a72a-42cc-9b71-b7937247d876", "comment": "Malware payload (RedLineStealer)", "value": "f64afb91dedba38240be5f86098843f9218d22c2bb9a362977c6e669d6745fdd9a8f352813e128c3b96e6e5b255e429d", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680496, "uuid": "beb1bef0-3b34-4249-a4f3-17069b31d778", "value": "T12DE3D624279F8930D6BB4E3D6CB19CC076BCEC12A542D74A4ECCF5593A73B809B116B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680496, "uuid": "ba5f6e2f-a962-4839-bf80-267713607f84", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680496, "uuid": "36b00abf-8aae-41b7-a8c7-4d1744199b15", "value": "3072:2V+m5cNQmRSxWWAcP+DDXedh7Z58e8hk:2jwCUudh7z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680496, "uuid": "bc0b636c-8196-458f-b3a5-0dc095c28fad", "value": 148733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680496, "uuid": "6f3b37ad-7694-4a1e-9738-ba763c31f9d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680496, "uuid": "f70cfd24-3d30-44cb-bce7-260c847dc27e", "value": "Setup575.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e92f048a-f7c5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684666491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666491, "uuid": "f1fffb2f-596b-45bb-b783-335557952363", "comment": "Malware payload (RedLineStealer)", "value": "758e82ad4afb061397b09ddb6202eb8b", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666491, "uuid": "e41fa4e9-7e19-405a-bd17-520b95933616", "comment": "Malware payload (RedLineStealer)", "value": "b6d6ec5102d7a9f1498beb8bf43144f74e4cd776723121e16cf7ced4fb457ef0", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666491, "uuid": "13d29979-de18-4b62-9721-5bcd19652edc", "comment": "Malware payload (RedLineStealer)", "value": "99db1e50dd49fa860d511299d3274a9511a7902f", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666491, "uuid": "9c1a4528-3377-4d57-87c3-7b83f81c7cd9", "comment": "Malware payload (RedLineStealer)", "value": "0fc31b0892c8c54fcf4b4878674b1fd6f926ebe195196db3cd98f4069c85b2080019f3b53724f45faa4cea264aa5bca2", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666491, "uuid": "dbc19008-3b2f-49f4-9d16-e551424f3658", "value": "T156252357B6D85132E8733770A9FB06C31732BDB04E74132A16A5A99E1C737A62071B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666491, "uuid": "938a90f0-9b5b-45a8-b293-fbdebf6942c1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666491, "uuid": "d3fdcaca-c634-4785-9ead-468b81310677", "value": "24576:6yvjJgWXMWrqtjNXb+gHbIhmScX8qdF0q2PeYYJzKlg:BSC7q/b+mbIh7svn2mzp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684666491, "uuid": "fce30845-d6f0-429e-ae56-aed7d03e5654", "value": 1054208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684666491, "uuid": "3a160f3b-fa92-4be4-b999-56c30d181821", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666491, "uuid": "d2bcc112-73e7-4842-8d17-a84109a25fe3", "value": "connector210.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d883b96-f808-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684694898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694898, "uuid": "acc1da6b-15e3-4deb-9f14-d636c2a82a81", "comment": "Malware payload", "value": "5347959f35ed3984a06a217632283ab4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694898, "uuid": "1f7d4cf4-0270-4cd5-beb7-ca8cd78a4017", "comment": "Malware payload", "value": "b76df04d828ee43b46225007da80b59587cf4f7346b7e7b0cd979f30107efaa2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694898, "uuid": "83a5dd55-4455-4048-babd-b7c6f49797a6", "comment": "Malware payload", "value": "a2d1e052c2169a9889471b30b5d7a8b44448f570", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694898, "uuid": "b2e5ce90-be5f-4d41-8eb4-8b7452d94bcd", "comment": "Malware payload", "value": "8ed68b3dba935cfb613d04435c38560f2fdeb12f98c4e9cdc8a5c2e25c6f97fc71a0c33b4dff4697e3d349038e778e3a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694898, "uuid": "48307588-674c-4463-8585-30f71e531117", "value": "T1A2252306BBDC90B2E8B1673458F202830E3AFDE25A74D16B27959D760C73AD28971737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694898, "uuid": "e9dbd343-68d5-4b97-a2a5-899cbbd18750", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694898, "uuid": "d6d7aee4-d113-468c-a3bf-807fe5c2eb06", "value": "24576:ey+eQdUxOHgmBqGfPODGRMEvD4ubum05TmpY:t+ehOHgmBqGfPOuMEvMuK15T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684694898, "uuid": "890681fd-6024-47bd-a1ff-5ef9d698cbdf", "value": 1046528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684694898, "uuid": "144dc2f7-bb6e-4e9d-814c-70bece294076", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694898, "uuid": "dc2ce780-a35d-4ba3-b123-66e8b4afbf40", "value": "monitor249.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a28f7c3e-f822-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684706315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684706315, "uuid": "989570ec-759c-43de-96a7-c74fe0ac7030", "comment": "Malware payload", "value": "b0a8698dddc23867bdcb7421218223c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684706315, "uuid": "c612e585-817c-4345-af5a-6a90ceac7dea", "comment": "Malware payload", "value": "b794cfb04e7c132342c4c1d8fd2acc454e131e80526414b5d6b0bb24a149642c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684706315, "uuid": "7a103c8e-64eb-43cc-a5f9-5be5f204e984", "comment": "Malware payload", "value": "47acce3a54458a0d0bd62971da6adb2d7f34e35c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684706315, "uuid": "57f1330a-fd16-42a8-a5ef-89f97c1a1155", "comment": "Malware payload", "value": "a9cf35863241925c4340a6bd9c129cacafc9d609baa590d4ff373de3bb178a41005d7efde501210f86d4bea403fd57b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684706315, "uuid": "f7595676-18b2-4fb7-a577-9ca26da84880", "value": "T1A8547D03A2D1BC65E6664B728D2EC6F8761EF5504F9977DB3A186A2B04701F2C6B3F01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684706315, "uuid": "47160e24-c104-4d4f-ba0d-82079860959a", "value": "f4492804ef800c5af0eb5787c534d586", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684706315, "uuid": "93beba95-8979-4b19-a1d6-147af4983e98", "value": "6144:yMph3Zm3wJHBshkNi7Puo0jQGLkg7SsaKxlPj:v3ZkwJhshsi7mo0jQG4WVaKj7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684706315, "uuid": "09653b4c-409a-4141-8bb4-1012440c1cc0", "value": 304128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684706315, "uuid": "e5005e1c-167e-4015-90f7-b7612ea84885", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684706315, "uuid": "3eb314fe-3d98-434b-a86c-be653659c46c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fea5ec2e-f7c8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Vidar)", "timestamp": 1684667815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667815, "uuid": "92d09494-a343-4158-b2cd-cf0ef05573a5", "comment": "Malware payload (Vidar)", "value": "6adb9139dad4f645580123d20c5b44ab", "object_relation": "md5", "Tag": [ { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667815, "uuid": "c9f10f8b-ab27-42ed-9e20-566efbfaca0e", "comment": "Malware payload (Vidar)", "value": "b7ec42faae4bbaedc15483e17176375dd38e15af6bbab3fa5cd8aaf94bd57102", "object_relation": "sha256", "Tag": [ { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667815, "uuid": "1172dac6-aac5-4eb6-8b02-23a0df6b1d08", "comment": "Malware payload (Vidar)", "value": "3ca0a773d8ca87c1db116558602989979b4843ab", "object_relation": "sha1", "Tag": [ { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667815, "uuid": "883afc5f-ad99-4177-ad63-f7efd246f898", "comment": "Malware payload (Vidar)", "value": "affa12cff498069282c290835019006c5f8a05479396364b59cb5aa8509e1b31ce342ce58e42a3dc4da8359294040e81", "object_relation": "sha3-384", "Tag": [ { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667815, "uuid": "24305816-745a-4714-a6c5-5df390301ca7", "value": "T1E805D003A280BCA6F926063E9E1ECBFC765EF9514F0D6B9B62586A2B14701F3C573711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667815, "uuid": "c518e03f-bf28-4d41-a0eb-5a95556b0389", "value": "f682da34b918ddb61703d12aa2522a66", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667815, "uuid": "1425dbe6-5b05-4e77-ac2f-9fc74585152d", "value": "12288:zAJnkwm0hsI9I/ReRaMLMFvSCizQi6qcE4WCoAGavzfgvxfnjc:WW0OIipKaMLMVxic3nbWIzfgvVnj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667815, "uuid": "5f6d2668-c0b7-4134-82db-e7788392de4e", "value": 841216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667815, "uuid": "4a330717-5504-4281-9107-fabc0d9c06a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667815, "uuid": "780e8730-c73e-4b4b-9761-0da31e340a75", "value": "preview873.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "633dbaf9-f7a9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684654240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684654240, "uuid": "406edd8b-cd74-4981-8759-6779e45da35e", "comment": "Malware payload (RedLineStealer)", "value": "a27767fbe311ac709241eb2ef2354168", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684654240, "uuid": "898b7588-c1f6-42d2-8d78-87530eec6b46", "comment": "Malware payload (RedLineStealer)", "value": "b85b62332203bada71a59ca3e684d8220765661e3a2e6f20869991479eb43f1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684654240, "uuid": "da244ec2-d65e-4009-930c-820847364cd4", "comment": "Malware payload (RedLineStealer)", "value": "8952907fe1b1fe1645d16c06ecce7439a41d4aec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684654240, "uuid": "a822885c-c605-44fd-b46b-c42ca5e8ec49", "comment": "Malware payload (RedLineStealer)", "value": "a7cf55155bfdf6746143f88be3f2e034972e71a56fd3413a92d6670ec7dc6be30a5264693e633ab2caf6a0d36555eb6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684654240, "uuid": "f45e50e1-53f7-468f-8d1b-f00a7ad46ac7", "value": "T1DB252356EADD8077CCB22335A8F302C72631BDA1CA74A22B27556C679833654E47733B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684654240, "uuid": "b92e449c-dc54-4b11-abcf-a4fb7919213c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684654240, "uuid": "63462448-6d08-4d10-89cc-cd86301b4230", "value": "24576:iyxWazrefs2n34HF++qgDl8bWaZv9PC9y8kEGTZl0/KJV:JhSsgIHF++q6l8bZZFPC9Es", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684654240, "uuid": "37e83b7c-a22e-4849-958e-3d36fdec1045", "value": 1046016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684654240, "uuid": "49812ca2-cf2a-4283-87c4-30a5642a6964", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684654240, "uuid": "dd3248da-01fd-40b3-9705-03c752a3e719", "value": "a27767fbe311ac709241eb2ef2354168.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9aa32c0e-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684680532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680532, "uuid": "8fb49d9c-4045-417d-8632-8e7d72ee6cb9", "comment": "Malware payload (Amadey)", "value": "9701873a8f654263162fb94176590326", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680532, "uuid": "9df8514e-ee1a-445f-82fe-9cea4a634f0a", "comment": "Malware payload (Amadey)", "value": "b863ebcacce43258a5ff0b45aa6a4f739ee54e61ce588f54847f1681ad6fe756", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680532, "uuid": "81d688bb-9184-4cfc-9c76-d764d51f1c3e", "comment": "Malware payload (Amadey)", "value": "9f7db9d32cdcb2cf8294f899b4fdfe153ca24a9f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680532, "uuid": "f6c1c3c0-3ae3-4ecb-beca-2061e6b73ce0", "comment": "Malware payload (Amadey)", "value": "66e10aaef0c4c05a7a4cb871c6c0c0649eb5f50f8c52ac3f51ad96eb22e5a654de90da7ac4d429d6c29afae97492af65", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680532, "uuid": "4e0d4479-2ecb-47e8-af99-085aa2a4552d", "value": "T18F252343EDD88032EC753BB065F306D70B35BEA18CA4839B37A9A9560D73A91A075737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680532, "uuid": "b621c46a-2b0e-4f80-978b-bc84571d325f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680532, "uuid": "2862a3b6-dc93-4649-a510-84cf086cb6f9", "value": "24576:eyirCN+5ts1ZSDnqc2lErKI49x2jCJD4dIKNzuuTLjytqt:tg1t6sDnqcsErKIldtNyuTLOt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680532, "uuid": "709042aa-ef92-4980-8c34-1ecd3ad251af", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680532, "uuid": "2f7932f7-8909-4ea1-8c82-bc3ac2ac1d13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680532, "uuid": "0d6b8e5e-dba8-4f28-92b9-16812aaa8ca4", "value": "compress608.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cec30078-f805-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684693934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684693934, "uuid": "c169cf76-36ac-4f99-b3cf-4017c4690f5b", "comment": "Malware payload (Mirai)", "value": "f0f966d1960ad255ddd89ef6db3d0d8f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684693934, "uuid": "84d47287-a800-4809-bf68-a68a8a94517e", "comment": "Malware payload (Mirai)", "value": "b9026c869ce0665c58cf1371f21ec53ed80a1a21b53b591a543b46314eac751f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684693934, "uuid": "93cac04b-3a22-4642-88c7-1ecbc5a91de2", "comment": "Malware payload (Mirai)", "value": "86a0cdcea791dc11cac28cdc4c6ca76a99a52405", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684693934, "uuid": "9d705943-19a7-4d15-80ac-3ce388fbc467", "comment": "Malware payload (Mirai)", "value": "367fd28a4635864d74599873a6e970efb3c3b0c579f31237409384490cdbf6481571bf9cf4f7e4c219851e676e0d426c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684693934, "uuid": "3b19bdf5-33cb-4f1d-a7c2-08f16865db09", "value": "T192C2D761FD829637C1D01336BA9EAF983B2163E4D3CF731399601720BACA95F1D22E55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684693934, "uuid": "24f0eba7-0a39-4741-827b-37d1e1bbbff8", "value": "768:jej6wLr9GuXpUG5idLNy6YacF46+uUdXoz:jRWXyG5iDYLzzUd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684693934, "uuid": "d962177d-a341-4f53-a36f-e57211c312d1", "value": 26404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684693934, "uuid": "8aabfdd5-7d1c-4e70-bf2a-aed89c7aa33f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684693934, "uuid": "2926458e-926d-4135-9d22-012a6233aa28", "value": "f0f966d1960ad255ddd89ef6db3d0d8f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d8e1ff2-f7b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684658418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658418, "uuid": "a3f931ca-afb6-48f2-b657-9c07249efb47", "comment": "Malware payload (Amadey)", "value": "2517b916840f1450d8626e3e94aa96b1", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658418, "uuid": "7232b7f9-7efe-448d-a58e-19c37172878b", "comment": "Malware payload (Amadey)", "value": "b90946c24eab013eb95050a5fb4a01705af0b52899765ced50811ee6eb52bd3d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658418, "uuid": "1fd334de-85e1-4c5b-9701-afa4b5658e54", "comment": "Malware payload (Amadey)", "value": "f66953485e25eea6193395b191113e041c575738", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658418, "uuid": "415eae10-d83c-400f-8eda-540659800b63", "comment": "Malware payload (Amadey)", "value": "62c5f16e9eeaeff8fc03cdf3bf0acf1e92874c8761f0e9d8462365ab1b902ee613c42d3182c9d8728cf6e447d89cd7f1", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658418, "uuid": "ca925ed2-f466-4398-a00e-2c4c9bf97ca4", "value": "T1DD252305E9C850B2D8762B7068F613870F36BCF4CDB5C2973A405F664D72A44A93A3BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658418, "uuid": "2099f9b2-635d-4aa9-9c8f-c4f42d1af66d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658418, "uuid": "062db442-d198-449e-9275-01ce92ac450a", "value": "24576:Gy267PrAHz3Fq0iOSKEJNal7JFW+DlGWfEkwaxuEyyPP:VTzrAHz3FqDOS9JNyZ5BTgEJP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684658418, "uuid": "5956a349-885c-4c3a-bc95-c53aafc31c88", "value": 1046528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684658418, "uuid": "c7a825a1-a35d-4c07-87c9-e018ea87fb5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658418, "uuid": "082ba19a-7e34-4bdf-9295-523daa2abb63", "value": "changer438.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf5ce9b2-f7c6-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684666877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666877, "uuid": "0163b5f1-6a28-4be9-a9e0-f262011d5fd9", "comment": "Malware payload", "value": "04c33181f0e2cdf3ed155b97c140bd61", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666877, "uuid": "e622d7fb-05f7-463c-b91d-471f06d4404d", "comment": "Malware payload", "value": "b91a3792dad6245590534e93dc14d337380f9523a73757360e7eaa0204ebf93a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666877, "uuid": "d4a6cec9-9ad9-494c-9419-a31bbcb17551", "comment": "Malware payload", "value": "08e8eb7abcff7d749995d66d8cbef325c5610a00", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666877, "uuid": "1731a95e-2eea-4f85-9a49-1c1c0c46199f", "comment": "Malware payload", "value": "96cc8b9eee1135c6db39ceb170a1bdaabe262c53b529d694cc72f0d8873cd8c23dbcf8cb030425e4bfdbe00ab2ba10bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666877, "uuid": "fc0b2951-b2d6-4f2f-80f7-99559ce60a51", "value": "T14DD2E7C0BD81DA1BC5C0077BFA0E42DD3B2A7798E2DD72069E16AF55378B93B0A67051", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666877, "uuid": "352da990-3a40-4473-addb-44a55c815717", "value": "384:/9BIqFXGJz1H4PnHfjgOkvsLfAV260QolxAfyAtxBgX7yAIVOMpTFx4es:/93FXGJz1HeHkOZL4w60Q6CgX7gxct", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684666877, "uuid": "235867ce-3430-4852-aec7-98059a646ff2", "value": 31052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684666877, "uuid": "d84f279d-2565-4bed-b434-c07e128ce441", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666877, "uuid": "e0f73c55-d691-4bc6-b228-5cf17d9e141c", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f15953b-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684680459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680459, "uuid": "8a36897e-3bbe-4b2f-8229-e1a8ac065c55", "comment": "Malware payload (Amadey)", "value": "3f3aee95dff096406358afd2aeb3f121", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680459, "uuid": "ae53981b-9a4c-4677-ab30-f790f5ec8b9c", "comment": "Malware payload (Amadey)", "value": "b91b54b8179ffb1873f52dac255eb1e48d4dab3f3986d2d3e61ec87e61319a08", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680459, "uuid": "15c9ff08-62fe-4d4d-b269-fc96c092d3e8", "comment": "Malware payload (Amadey)", "value": "a1367452e78510fb3038d2971f1eaa2cf394a92a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680459, "uuid": "855fc27c-104b-49ed-9074-0f91e0ca8a34", "comment": "Malware payload (Amadey)", "value": "e5e61f95fa9318e195d44088f574e4aa111f0ef29b4ab824777e46de04688ff98f845579a02e99a22a9179305f8a5ad5", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680459, "uuid": "32b1c85d-4d94-4e1b-8d59-764f7e832299", "value": "T1B72523179BD84067D96123B44CF743930B3A7CF5986CA26A258BBCAE8C726D8D53035F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680459, "uuid": "5078ea32-9a68-4010-9423-d0458ae8e436", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680459, "uuid": "6b8b259c-544f-4288-bcab-7ed3903ca053", "value": "24576:my7QywyhNVfqdaTvMIG3a6EP43eB5zmq3aHyTqA935Af:1cVy1fNGtp0mmTrB6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680459, "uuid": "4aeca907-7936-4db5-aea8-bb10ff014936", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680459, "uuid": "daf56795-7496-475f-b541-e7c8446154e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680459, "uuid": "6ec8180c-afcd-47c5-82c5-704972dd8edc", "value": "35352464.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb3d0605-f7a4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (BlackMatter)", "timestamp": 1684652348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684652348, "uuid": "ba28f892-8c9e-43dc-ba99-c6efdc023607", "comment": "Malware payload (BlackMatter)", "value": "a96ac42f9ccc7d11663f2741d5dfe930", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684652348, "uuid": "ee7abd7d-1122-4887-b0ef-b5c93ab3de01", "comment": "Malware payload (BlackMatter)", "value": "b923f1d2ece074dabe58bb6a603ed5d49e8d62044a1293a37e8afbcac029dded", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684652348, "uuid": "b6e681e7-4e28-434c-b1f6-399e81cb2f11", "comment": "Malware payload (BlackMatter)", "value": "3ff257bcb32b3862d4eb08c73949e1aa930a2384", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684652348, "uuid": "7ce8040b-6b75-4497-9bba-a2ae72d3fbb1", "comment": "Malware payload (BlackMatter)", "value": "70b06481640337fa4d47786825314085b6a481f3debe7dd9fdcc93a74a4cb8b6c7c610ceabebfe5bee551a96a74c7daf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684652348, "uuid": "d3fa5e3e-9af5-4889-9711-0a4a68dbaba1", "value": "T15DE37E21F212D073C83718F13736B571F39E4E6C19A96817EAE80F99BCA48132F45997", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684652348, "uuid": "267494c7-2d9e-4121-8355-e89dffa4a1f6", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684652348, "uuid": "60e20409-244a-48cc-80e0-0b0eea8c2c2e", "value": "3072:q6glyuxE4GsUPnliByocWepqzYq7G9HkRgeXCDy8MD5:q6gDBGpvEByocWe4Y7pkRgeS28MD5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684652348, "uuid": "1e7881b5-37da-4a4f-9676-de15295e4bb4", "value": 150016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684652348, "uuid": "1e554b37-6174-4948-acdd-fa7a40013e68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684652348, "uuid": "458181af-5ea5-49e6-91bc-38fc7a83f247", "value": "a96ac42f9ccc7d11663f2741d5dfe930", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1bee4c2-f7c4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684666022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666022, "uuid": "dfb62864-15e5-44cf-837a-90682a210ca5", "comment": "Malware payload (Mirai)", "value": "ed27dfce0a677f172a5c02bc5ea805ef", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666022, "uuid": "61fcf7fe-ec10-4b6b-a9dc-d9d4860a57ec", "comment": "Malware payload (Mirai)", "value": "b9412dec31c531ec3970b6b8e5adbbc8b598ced866b3584c45474ecbe972bd19", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666022, "uuid": "f562ae8a-b974-46ae-b761-ffb562ad7d33", "comment": "Malware payload (Mirai)", "value": "137f54a6a2b4654f5b62e17c79bc43bc62cb4599", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684666022, "uuid": "9c204674-5a31-4c48-b7bd-514cc178aa98", "comment": "Malware payload (Mirai)", "value": "9e3ea2ac43ba00de9f75cbecbcd993b36613bdbd1ce44a2daf8216d5348cb8054664e8e5c75f783aa7f728df192b1be5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666022, "uuid": "e0ae1991-2c80-454e-a964-9b4b975f36ea", "value": "T1835302B3B4D9D043C0A98634936E0E66195F3E505CFB23F77A0A286A75D1FCB093562B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666022, "uuid": "418298b9-8df2-4b66-b2cc-473659ba61d3", "value": "1536:SErHTZxnfZmNoduCydaUiB1A/dfF0A1ryvnJyn/v:SyHTZpRICyFOA1d0JJmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684666022, "uuid": "9dece75d-04ec-4a46-b96d-1434b33256ff", "value": 63220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684666022, "uuid": "edb6bf25-70a8-46b0-a881-4865642b9a7e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684666022, "uuid": "a8cd68ef-acc5-4651-b607-b62aea205f4a", "value": "ed27dfce0a677f172a5c02bc5ea805ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9532a07-f7e5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (TeamBot)", "timestamp": 1684680235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680235, "uuid": "0bbaa670-b8d1-4994-b74c-31d2ca9ef711", "comment": "Malware payload (TeamBot)", "value": "2e060b9030eaf71ca1af96b170222bb4", "object_relation": "md5", "Tag": [ { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680235, "uuid": "2ef2fe19-9fbc-4d37-a431-5ee2c949fdd8", "comment": "Malware payload (TeamBot)", "value": "ba4328f11bc28e80a9aadecf03a5fe1d02f5a517e42cd66936c7febc44908ad6", "object_relation": "sha256", "Tag": [ { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680235, "uuid": "b6e87b31-032a-4fa5-bcf3-be76df834171", "comment": "Malware payload (TeamBot)", "value": "22173e8844dfc0465aee5da51e2c9e68b6ccc149", "object_relation": "sha1", "Tag": [ { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680235, "uuid": "2a3fc8c6-0f6f-42c5-accd-2896d7920ca0", "comment": "Malware payload (TeamBot)", "value": "2bd6a3cb159aa464250eca149bc63801bed06785fc10cd39642c39e60cab0218cdc13cbf5a9b177ddc14c302b0d8b07a", "object_relation": "sha3-384", "Tag": [ { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680235, "uuid": "3b0fc56b-d2b8-4abe-9485-a452bc4802a9", "value": "T12A548D127292FF71E66686318C29C2F866EEF8654F156BDB23146F6B18711F3CA72301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680235, "uuid": "9bb1419f-651a-4e87-9af5-954eacf3da59", "value": "40be65705a95a43e6733e98c1ce5e92b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680235, "uuid": "8d58a317-a19b-457c-9614-1ef3c36bc66b", "value": "3072:hYdbpr/fmOiqPCURgpu9Aoxi0IwR91vwpLO9awuQzrYjjYffsj4mTo0yo:obpb3iqP7yVowGMO9awvzkjoaBT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680235, "uuid": "aaa8559d-0be3-4736-b0dc-df72deaac337", "value": 295424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680235, "uuid": "8fcbfeda-2219-4ddd-9a47-0776987cfe02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680235, "uuid": "b0ba9d52-a25a-4f3e-bf9a-ceaf279f6fcd", "value": "discord_token134.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9d9e666-f7d0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684671243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671243, "uuid": "24495fc0-bcb6-4b5b-a33c-df1d4a0f5ce0", "comment": "Malware payload (RedLineStealer)", "value": "7f3660df981454051e3e7687eef74350", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671243, "uuid": "2c19a7b0-0585-4836-9f04-a1362bcb3233", "comment": "Malware payload (RedLineStealer)", "value": "ba8f85b0493164f5cfd7b6ee6e7638eb96b2dcd4a34e7d92f1cf1670ca9f5784", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671243, "uuid": "ef4a2410-a8b6-432a-a83c-6fb59c761256", "comment": "Malware payload (RedLineStealer)", "value": "0619076912243fc95145559c0a1558f92bc93042", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671243, "uuid": "31aadc81-589a-46bc-a32f-4e17dbc49c0a", "comment": "Malware payload (RedLineStealer)", "value": "5c173a12704883cc45a32825dfd431a7afcbc3446e88a3caeab33a5e46952affe723230bb2ecdd609ecb0f1c02da7b01", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671243, "uuid": "16e98620-4864-4dcf-8f3b-6e7db131c0d1", "value": "T1F1252343BBD850B3E8B52B3098F906831B39BDB1DAA5536B3F48997D5C73284A931713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671243, "uuid": "18f52856-9632-4f54-a1f1-fa6ae834827f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671243, "uuid": "7e72c9b0-701d-4eac-922b-69322520d044", "value": "24576:0yrpJuYdRjrGECHz/jq/h4N9/P8hddjxZpjKWs+5fKttWI2:D/uYH3CHz/jq/h4N9chPjxZoWs+5fKtB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684671243, "uuid": "a3475051-898d-4d9d-9139-2e5662e0a5c9", "value": 1047552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684671243, "uuid": "daec69fc-ba01-408d-9554-35a06662afae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671243, "uuid": "30dba2f1-e7cf-45cb-b2fb-763544f4e9ef", "value": "parser321.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ceae9e4-f7b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684658444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658444, "uuid": "e7744960-de74-4f85-a13c-72ab9d234ff4", "comment": "Malware payload (Amadey)", "value": "0196316b17e4e83bac21e56bb173368b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658444, "uuid": "498fcfb7-5650-4e6d-a2a0-23524315f191", "comment": "Malware payload (Amadey)", "value": "bac22db6cde94e732af40afa17ed3cd996ae2868f51158ca825bdfda1665c6da", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658444, "uuid": "a1f24b2b-161f-4834-b8b0-a50080e665b8", "comment": "Malware payload (Amadey)", "value": "f9ead17d84a5add2f310e9322fa3af7530386f96", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658444, "uuid": "4f6ef0d1-c9b6-4ef9-99b2-5104f0243b14", "comment": "Malware payload (Amadey)", "value": "2d05ad190e448b45bb4abfe74ee405c9c1752de6eb0b09b166dd0c4618ca9b3bc65ee881e089dcfe609f722f08eb663b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658444, "uuid": "04fc2611-055e-4b19-815e-a34722373716", "value": "T1CA252306BBEC5072D8F62B705CFB02830A31BCC25975536F3A499D5F1EB2664987272B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658444, "uuid": "e928d52f-936f-49a1-bc27-88348b9980ad", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658444, "uuid": "7abf5ccb-5c16-4c43-aae8-266e05750b20", "value": "24576:yyInjoKTjFDYlGUgoA/Dcf5FnrspEL5fmJqCK:ZInjoqjxYlGUgXwXnrsWLhmJn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684658444, "uuid": "12196057-8632-4c95-ae2d-0119e05db8ae", "value": 1056768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684658444, "uuid": "8d845de4-523b-4bc1-9481-f7df21794086", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658444, "uuid": "dd5a7b69-8617-4c83-8fb0-4c284c8d6bf9", "value": "gateway329.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6362daa0-f808-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1684695042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695042, "uuid": "81dbe5d4-0ff9-4ea5-af2a-fd27060d2286", "comment": "Malware payload (Stop)", "value": "ca387b4f498885886b80abac38d27ea3", "object_relation": "md5", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695042, "uuid": "df05b9af-1acd-49e2-b7a6-7413e1248e0a", "comment": "Malware payload (Stop)", "value": "baf117dd1b47c81a3990e68b5e307787234a3e1d2065ccdc741c77fd0d506187", "object_relation": "sha256", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695042, "uuid": "5b7ff6e2-42a6-49b0-bbda-67541fef5756", "comment": "Malware payload (Stop)", "value": "74ec4b1b771ddf1e2460f070af51e9d183803dd4", "object_relation": "sha1", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684695042, "uuid": "1c927f87-c0e8-4aa8-b8d9-5cbe866fbdf3", "comment": "Malware payload (Stop)", "value": "3289988bb366c11f8f2e73287c83243341fcf1e1b004227b52df36c26f0127b81fb274baabd179a9f6915801c5d82ffa", "object_relation": "sha3-384", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695042, "uuid": "37758b60-4ae2-4b7d-921f-dc8c34a46906", "value": "T16E05F10362D2BC61EA5647728D1DD2F4761EF9608F992BE72B4C6E2B01711F6E632F01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695042, "uuid": "4ff72f62-90dc-4b37-b69f-497cd537e3de", "value": "ad1da3007d39bc21ababd35f90247ee4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695042, "uuid": "4a79a61d-f155-4ff3-a766-e7af2ab1f1db", "value": "12288:yUgV7bgHOPN/TQl0D7CnL513I++7falOxcU18cCpsyfOyZ:yXvqE7QCD0VdcfalOxdHCpsyNZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684695042, "uuid": "d96ac284-1807-40a0-9e7b-be854ebd3b2a", "value": 823296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684695042, "uuid": "f289e927-4d0d-405f-a4c4-445226bdf74b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684695042, "uuid": "7e864187-b2ad-4ddd-97e5-b0d56b455564", "value": "245245254319.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f45e2211-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684680683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680683, "uuid": "ab494fe8-676e-467a-bc01-61f9a0f66574", "comment": "Malware payload (RedLineStealer)", "value": "f8ff15263064e87d9c535d30b4dc32a8", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680683, "uuid": "f9a999f1-092d-498a-ba19-36d083481419", "comment": "Malware payload (RedLineStealer)", "value": "bb010c9f24086fa2a427a2a9bf126334855475fb1614fd1be981fab29177ee8f", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680683, "uuid": "26a36f97-b002-4e8b-89ff-53401089c81f", "comment": "Malware payload (RedLineStealer)", "value": "b1f6642755dda5133c3870b5a5038bea78084c5d", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680683, "uuid": "d2cacec6-d4d1-4b7c-8af7-45a315bb0ce3", "comment": "Malware payload (RedLineStealer)", "value": "ddef2f6cc90893e25e1f6167d7aec9484cf78ae6c510bcb4841db1674616c6a5f6cf643a51afa1c2ed23d6c4cc1888a3", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680683, "uuid": "fb538fa0-153f-4fcd-a235-9537035344e4", "value": "T1D325235265D84466FDA013B0A8F502C30B37BE518D7893AF2F54A90B8DB3597E932B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680683, "uuid": "e03ab750-df2b-48ee-a416-2710c7e75366", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680683, "uuid": "d1a51803-81f9-4bec-9c0f-ac7a0bfddaa6", "value": "24576:HyuMdajx57kA1qDT9suNOHly5xU4SfwTgK4lPdB:SuFnAA1qDhscOFy5xWAg/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680683, "uuid": "755f3a55-3d3f-4140-ab0d-0727016da817", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680683, "uuid": "a391f0c1-b566-48b0-a58d-87d183125a3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680683, "uuid": "39a54de9-0d02-4a46-95e5-3eae10ec1eeb", "value": "translator287.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ff8509a-f770-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684629861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684629861, "uuid": "a881cb59-c3a2-4643-ad3d-b2e735f0fb36", "comment": "Malware payload (Amadey)", "value": "8a1f9b1d4f7e98909bd64e3e2953ce4a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684629861, "uuid": "cfb38b83-2741-4029-b17d-0d5cd94515b2", "comment": "Malware payload (Amadey)", "value": "bcba28957ff82281421e76d6680fb30bc7fd13e16cc8e7d48b52909c4c07d694", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684629861, "uuid": "6ea07dd9-9691-4746-9175-22bcc6d626ed", "comment": "Malware payload (Amadey)", "value": "77a22658605593e6c636edfed5148c1f349c4c05", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684629861, "uuid": "aa7abc3a-c792-40dc-8c2a-789be4361435", "comment": "Malware payload (Amadey)", "value": "2c56d6adabf0fc4949774379beec17bdfac1006aabd83f66bed5f8cc846ea45596f301cf222c9a1258acefc9d1f129e3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684629861, "uuid": "aa720461-3fc6-47b1-ac82-acc039ffb8ad", "value": "T1A2252217A2D98435D8F82B701CF253D30B35BC969C38415B3B45699B9DB22C8AAB2737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684629861, "uuid": "6b803c31-2d1e-492b-a422-e1c7f14b1166", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684629861, "uuid": "47cca0ac-c944-4c8b-9e78-4345a023e165", "value": "24576:+yJoxIaycstpEI5bOqrZuFvFHwZj42qXtGnVcIuCus5yr:NJa9yltpV5bOqrZuFvgqXtGnaIruQy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684629861, "uuid": "c0c210b7-9fdf-4752-bcb9-4a6ec6ebb1af", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684629861, "uuid": "e2e8b877-d743-415e-ad88-2047719b3a2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684629861, "uuid": "f738727a-4572-4da9-b049-842577a2ef52", "value": "8a1f9b1d4f7e98909bd64e3e2953ce4a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ceb2ffd-f812-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684699353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684699353, "uuid": "357d93e6-a398-4957-8486-14a8dc5bcde5", "comment": "Malware payload", "value": "c56f106025e1853958f0745516c0b88f", "object_relation": "md5", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684699353, "uuid": "dd0d7595-e4b2-4989-9829-f02413520a74", "comment": "Malware payload", "value": "bcd9b7d4ca83e96704e00e378728db06291e8e2b50d68db22efd1f8974d1ca91", "object_relation": "sha256", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684699353, "uuid": "ca87a04d-78f9-4fac-ab43-d7ba1afd3402", "comment": "Malware payload", "value": "f3506be345eafb653e2c2c18410b8c4f5d1a2c26", "object_relation": "sha1", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684699353, "uuid": "6f0fe094-4be5-4bd5-9dac-8530d28e2498", "comment": "Malware payload", "value": "66d59bef251e957c89aab21e19ba62b0d3b2211b144074112797d3738113279d3790d6692b081de3e1182feb5d6cdd95", "object_relation": "sha3-384", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684699353, "uuid": "1b7c9356-1836-4584-acc0-14ed8929c755", "value": "T1B1F4A6C223E7BD0204171372739576F6957ACEA5D9C998CCF5463C68F0ECE06BA982C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684699353, "uuid": "1d9b1342-bf10-49c3-b4ce-4b473c04cb59", "value": "24576:93vle/E45Mk2h1K3G9EhRe4jEER9Fwf8TxzM34LM9gkIy9ByxZO9TLd8wDNGOi5t:plZ45Mk2h1aG9EhRe4jEy9Fwf8TxzM3s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684699353, "uuid": "d85c8f60-e0a8-40f4-9b5b-35ddaac20df9", "value": 790759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684699353, "uuid": "245f5f79-1d37-4159-ad28-80a183e3f0ef", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684699353, "uuid": "fc88a61a-49f8-4002-a506-3281641dda6e", "value": "Inv(05-19)Copy#19-48-01.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23cbe5ac-f7b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684658429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658429, "uuid": "e2f2410b-303e-4190-920c-4c96a8ae2743", "comment": "Malware payload (Amadey)", "value": "9c05b095e789e9f1d48c30b3cbfe720b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658429, "uuid": "12c8756e-6149-4859-b48a-0df7b99bc723", "comment": "Malware payload (Amadey)", "value": "bd8a44a560703a6ebb79c6893d178e3dc07f1326c5115cd3cfc57ce887c00258", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658429, "uuid": "426c5abf-88b3-40dd-a6c3-072658c87664", "comment": "Malware payload (Amadey)", "value": "5d1fc6644343f8156b3908c4e61dfeecf75bb3c1", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658429, "uuid": "e7609433-277a-448d-9aca-37c1a612d07f", "comment": "Malware payload (Amadey)", "value": "18fffe5a8dbace957b48fda36f31180d4e41103af5a7f28219e76a2bda8da278e2eb179d3d46eb530e8eb227f1009862", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658429, "uuid": "be40cac7-8d1f-4b35-badd-f75736a4f1ee", "value": "T157252319D6DC4066D4B517B42CF21B9307397E91E67881A3131AAD6B2CB3AC8F53237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658429, "uuid": "a329e7d8-8b12-4d42-b7d9-b25fb1320981", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658429, "uuid": "7f7ab20f-cf88-43d0-b0b1-34e6f411f62a", "value": "12288:jMrby90tmgY+qayvLWQDHExMvVuQ5lkL16AY5TyWmCpfUT9L67HVqqF/sQmAJQGZ:wy6JqNEUcQ5lzy9LOVqqWUJcjT27", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684658429, "uuid": "bc0b787b-ac58-4edf-a401-7251efdb3e67", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684658429, "uuid": "4348b05f-78bd-42c9-9297-9773c20a93d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658429, "uuid": "8ff8ff6d-d1c8-46b5-be93-df61ccd01196", "value": "cumloader861.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e06dda14-f7eb-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684682797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684682797, "uuid": "09316d32-e8f3-413c-8ccb-9e3593bb9c84", "comment": "Malware payload", "value": "c5ac81dd2cb97e5a922c449aa91f4a9e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684682797, "uuid": "eb52a418-3db6-4f2c-9fbf-22a9a67ac26b", "comment": "Malware payload", "value": "bdab4f9711ec1d5aa571560026b86ee052b4d012be87be82c77157dc4434d3c1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684682797, "uuid": "3432ee7d-5dee-49b7-b747-22ad2f8da38f", "comment": "Malware payload", "value": "3c283dfec35e451a8a3a3151cb5d05d3a9314240", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684682797, "uuid": "c9ce5a7d-aba4-4fdd-8f04-9fcd9d6936b5", "comment": "Malware payload", "value": "4bdee4a732b03aff64757b48c0f5b7eb500edcbb7c648b4267dc23d3722cfa801be7411285f1d32334dea82f0554b38d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684682797, "uuid": "1df25ad9-372c-4657-861a-5250ed291f89", "value": "T1FCE3C778EC09B159C9D50135AC17E5C86E44082D3AAA81D3AD5736B27EF0E833A7DEC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684682797, "uuid": "7b64536e-2a05-4835-b4bd-d9a46aeb3c9d", "value": "3072:X+PaZHd/7nxj05/fg/Xhi/eXVjy2WloO0P9st+FvN2oPgu1r+uYvXJ:X+Pgz05/fg/Xhi/eXVjy2WloO0P9st+a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684682797, "uuid": "f4fd22a3-e679-448d-ae42-f93840e9d357", "value": 148864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684682797, "uuid": "b380c686-98dc-475d-bb4c-d563e6315da6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684682797, "uuid": "449b56f2-f47d-4726-9d7f-57b36622eb9c", "value": "c5ac81dd2cb97e5a922c449aa91f4a9e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a9c4eaa-f7b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684658413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658413, "uuid": "9cc237e0-db84-4034-8479-aff2c6ca2a65", "comment": "Malware payload (Amadey)", "value": "483a466456543c4114c5ce92760b45a6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658413, "uuid": "c227c56a-eae2-4495-84b4-9b6981291539", "comment": "Malware payload (Amadey)", "value": "bdeec6c9fd1f44719de0329df0dca91f208593ac3aee2144e76b831f8dcdc0b1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658413, "uuid": "ece550c9-d023-4053-9ce9-7af6c65d414b", "comment": "Malware payload (Amadey)", "value": "7a15f247742822c4ae8a4b65f505f23a8c0dd4d4", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658413, "uuid": "0082e8e8-fa9e-48b7-8fd7-905470795c03", "comment": "Malware payload (Amadey)", "value": "6e4c67789def92d5c9b33eb28492e3b598ca1ad9653e6ff3312ec68eeaf1b446838a91523710bbc7abad2ccfe5e03e35", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658413, "uuid": "15681824-36da-480d-8cbf-131eb9a099df", "value": "T18C252343AED8A476E8B0273008FA57E30F74FD904DB4862B1349AE675D726C0B2717A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658413, "uuid": "50e0654a-49d3-4937-8a94-7cba6f153afe", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658413, "uuid": "35dabfb8-90ea-4a62-830a-e565db8b93a6", "value": "24576:iyi++Y0r8QqEFnOIctdQPX8e8TwF3ITQE22:Ji+SRqUneEPsJTwFYkE2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684658413, "uuid": "2c4f32b4-890c-42b4-a124-c9ea4e35097f", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684658413, "uuid": "386b9f22-8bea-405b-8bd4-c377c0dd4343", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658413, "uuid": "17e7ade7-5f8b-46d1-af30-3de6f386ccbe", "value": "Unlock802.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9762905d-f7d0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684671078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671078, "uuid": "7555d716-73dc-4403-a49e-1af39a6cb8ca", "comment": "Malware payload (Amadey)", "value": "8cf34b2b9cf559114f93ef157cf9673b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671078, "uuid": "888bbb71-730b-480b-8d7c-e5d218d5f47d", "comment": "Malware payload (Amadey)", "value": "be3b97bfcf8c69e1f2b0e8eee8cf0ae346701c47ecd2097179617675760e075d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671078, "uuid": "80046d7f-fb72-4a53-953f-7a268778a350", "comment": "Malware payload (Amadey)", "value": "5ac956906260d92072e5b0f2da61ffdff8e56096", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671078, "uuid": "e8eaf05c-2b61-434e-8d50-4cd5c1355c57", "comment": "Malware payload (Amadey)", "value": "ea571916507f5cfde558f85fa9827c5ba0d5500ae16caa1bf94b97aba153b02fbda6b3248e30c9a45a41ad7d4b03bf09", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671078, "uuid": "1fc9c433-c245-4383-9672-98d9f9495a34", "value": "T1082523076ADC4033DDF467B158FB53E31B37BCB29C389366668A594A28721D0E4317AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671078, "uuid": "4ebdf8fe-bbca-4047-9bd9-5774bbe45c41", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671078, "uuid": "edf3f5e2-aeca-4bcf-87ce-51df567b9bff", "value": "24576:ryU/yVGgqwqW+aqHIoOvMfsJtmEjPKOvNduksLTVOOdByF5:ec4GrwqPlIoOv8cgWHvjulLTVE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684671078, "uuid": "b693577f-ed3f-4d2c-82e8-516bba656a01", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684671078, "uuid": "8e9e7fed-eed5-4129-a6ef-f9f3c9ac70e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671078, "uuid": "a3050a92-5e26-49ef-af76-71bd9084612c", "value": "physics292.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccf5603a-f807-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684694790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694790, "uuid": "cd80e455-cee9-45ef-b290-85fde0339965", "comment": "Malware payload", "value": "0906c79093f020d93750c2edeec91ad7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694790, "uuid": "b6d949fc-2e35-4ae8-8320-a24bef50cfe9", "comment": "Malware payload", "value": "be5474f1d1a848b5e29d956850bd3ed29faa68f175c69a4ad630f3550ff9d73d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694790, "uuid": "9cfb7097-f8fd-4614-90ee-1e7fadb0e126", "comment": "Malware payload", "value": "a47ded78a4759770bd9f6eb4756583c855519699", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684694790, "uuid": "b1455fef-a612-453a-8a9b-fcbc00883921", "comment": "Malware payload", "value": "ac53133077ebd2db89ab7e999b6caa202ca84dab9dff5abd24eebbf396009017aa2514529847b17fec64c9310216fc5a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694790, "uuid": "0b0ffed4-911e-434e-a72f-bea962207f7c", "value": "T1A9252223EFE985B3E9B6277005F602C30B35FD719C24030A1F999E1E6C72258A5B6767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694790, "uuid": "db2525d3-8c62-42ac-a120-006f25dc11ea", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694790, "uuid": "4e1d8f4e-9f40-435a-9469-acbbb634d948", "value": "24576:vyYB78Ptpn0q7IaB4fydSU2f7Q0fB0BVao4dUCYGPZBOU:64APtpn0qSgJcQ06BYd+GPZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684694790, "uuid": "1fc02b12-674f-44db-9f88-f1718620c836", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684694790, "uuid": "77b00ff9-d094-4169-ae99-60dbc6c4ffaa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684694790, "uuid": "6109d1c5-4e6d-463b-afcd-ca5737c789d8", "value": "compress944.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0b68bfc-f7a8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684653940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684653940, "uuid": "09571808-2b40-443c-a214-bd8d50b6a91c", "comment": "Malware payload (RedLineStealer)", "value": "4965328f786ba9a1189418d36d04de30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684653940, "uuid": "164406cc-ba61-4d1c-afe8-ccc525632c23", "comment": "Malware payload (RedLineStealer)", "value": "be975adf4bcddc4dfc6c6e92483834ca57dc18bb66384e6ed5fe477957cc7090", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684653940, "uuid": "6892a908-647d-4ea5-b220-6789bf23d57b", "comment": "Malware payload (RedLineStealer)", "value": "40835eb35017ba77cd3f49675d22a8ee54998a9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684653940, "uuid": "a2992be4-dd17-4a62-bbf0-168fe0e11c9d", "comment": "Malware payload (RedLineStealer)", "value": "f344282141349e4e6b64fcea64f52f5e84b05f5d98344eb4a3df12297dc660efa1eb1953b8cf2e41167b08256da26ce7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684653940, "uuid": "16c951ba-4c73-47c4-bb02-d9af6fbdd1d0", "value": "T13E25231AB2E81432DCA1AB7004F902E307397CF1E97C976BB751FC260C73A55A9353A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684653940, "uuid": "ae498532-97f4-4112-bc32-3f985e90352c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684653940, "uuid": "3d380f16-8699-4dd4-9637-3dde1be4b6e0", "value": "24576:RyhrE+U7xAsg0Og1DQNc87zpvh6R6Qxj7vLehrDEgsTcUPagLF/U:EhgpisD9AcydaL2DE1TdPj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684653940, "uuid": "de76457a-e08c-40fb-8213-1ab00642db09", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684653940, "uuid": "c0817aad-e223-4068-a5bf-6811dcb5d2d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684653940, "uuid": "6dfe298d-50c0-4538-9c29-dac2e359e030", "value": "4965328f786ba9a1189418d36d04de30.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79525b44-f79d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (NanoCore)", "timestamp": 1684649123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684649123, "uuid": "49bc22bb-0faf-42da-9e39-ffbcb2c39e4d", "comment": "Malware payload (NanoCore)", "value": "f9437bb6b1df76dffd9a25f7025e204b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684649123, "uuid": "5e8aede3-e49f-4c46-97ca-8b0ae85e223b", "comment": "Malware payload (NanoCore)", "value": "beb82c2358273e88f370f291d53587fdd41511b5666af70d9c98ef4e68357504", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684649123, "uuid": "b711a6b1-bae6-4a8e-99ce-74ea8933a5ac", "comment": "Malware payload (NanoCore)", "value": "56c900dd4f399552d59e540bce0f7d6587faf344", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684649123, "uuid": "bf976395-b94f-4c35-9f26-a1af7601a769", "comment": "Malware payload (NanoCore)", "value": "625c6683627f2e2bd9e95a53a1c95a905d2c67440339aae33b7fcecfc6c0bdac2352ebe7c06e96d66753fb5febd61db1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684649123, "uuid": "4f202906-612d-4f26-8b90-b66d7569cb9a", "value": "T16605CF64F3B68452D40BCD730A1CF9B012727C8B7DD195A466EA3F97BBBBB40294424B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684649123, "uuid": "98d39f30-748d-4752-887c-03d21c986377", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684649123, "uuid": "cdc05cd2-efd4-42e7-ba99-210f28f1e598", "value": "12288:vBA270xPmaWNO7D+fRXBQlyN6Ss6WH6aeyDjww7LH2OjKh6WX:vn0xuaEO3+f8zSs6WHJDjwyT2l6M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684649123, "uuid": "ce9769a3-95ec-4bf1-8e1b-64859bb3008a", "value": 850944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684649123, "uuid": "b04ae4c9-688b-4fee-8348-fce7431df431", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684649123, "uuid": "14f35c53-a5e3-419e-9e1e-83853a7114b2", "value": "f9437bb6b1df76dffd9a25f7025e204b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c08b7d34-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684680596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680596, "uuid": "355a16a0-c139-4694-887c-7e3a1dc7fba9", "comment": "Malware payload (Amadey)", "value": "6448c7a6c676170d74089c79bf8362de", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680596, "uuid": "ab02bba5-4d43-44a6-ae49-ad3fcbbf23dd", "comment": "Malware payload (Amadey)", "value": "bebb41ee8ba72c21ef69740de6d06a7d32d06d2a51d9f34a454cd7973817b806", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680596, "uuid": "d0829eeb-996d-4377-915e-eed4034e64bb", "comment": "Malware payload (Amadey)", "value": "cec01cd2e2447b167655572e8c3ea7e397ee63bd", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680596, "uuid": "6edc442d-8c67-4ce1-90a8-41a0cfee4eb7", "comment": "Malware payload (Amadey)", "value": "4be19ba9f8f1368b98902a2b62a4268081cf464f228bed99abbf73ae0c8dd009c0705bc0acb39d938904dd794093340f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680596, "uuid": "ff2aad33-cafe-4477-8a25-a91c39ee0ea6", "value": "T18C252312A6D95462DCB9273448FA13C30932BCB45E70D2163E4AA9FD0D73AD4AD32B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680596, "uuid": "2ffcd073-7d4b-4859-bb14-da67473202ab", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680596, "uuid": "a9d9db20-7fff-43fa-8ec4-a0361d831471", "value": "24576:nyYs9AQAUvc9ij/P8qzavOcuhH5jQjz9nMadavZ:yYsmQAUv4i78qzKuhGjzRMada", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680596, "uuid": "bb5203fa-23aa-44bf-8afc-06dce68e8595", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680596, "uuid": "43a88f2c-c992-4dad-b665-3e62857f5556", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680596, "uuid": "ed27ee7f-2a33-41bb-b898-fa07c5ad730d", "value": "launcher155.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbf641a4-f7b1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684657932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684657932, "uuid": "442fcea5-8c6c-4a7d-a4f3-28c2af6a2cf0", "comment": "Malware payload (RedLineStealer)", "value": "88675ccc441ddc6afadc5048a2982f36", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684657932, "uuid": "2c8755c3-aeed-46a0-8139-aaade81c60a6", "comment": "Malware payload (RedLineStealer)", "value": "bf2bb2f189e3f9c53128cf5f2740e67e3b0c22225fd65420ba6c8c7e18071f9c", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684657932, "uuid": "55fc8969-9725-41ce-9bfc-bfd61f7a61c5", "comment": "Malware payload (RedLineStealer)", "value": "b532f4b7a16cefb3813efc675a0cdec378a47d53", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684657932, "uuid": "b6cf5c3f-524e-458f-a0ca-ff85d094e44f", "comment": "Malware payload (RedLineStealer)", "value": "e81476c5826ab7d13a1d67dc03633dd63153f54e0b36482c58b13a99004ed0027b55e111d39bc8a1fa338b94685f2171", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684657932, "uuid": "18b9b359-38e0-404a-9c2c-44a0660faf01", "value": "T1A425230267DC5471E8BA637064F743C71B363CE2AA7A92271646A89F1CF11B8E930777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684657932, "uuid": "9593a689-86fa-4584-b1db-9f4742ff78f0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684657932, "uuid": "099bb04b-e1f0-4f40-9e60-de32371191f4", "value": "24576:tyn/i2NiIDQnXxVY/w/Sp1Emg4KXnyCyLPM0xY99FQ:In/i2NzxPcX4KiCSMB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684657932, "uuid": "69b18fa4-a6e5-4c10-98a9-2c641a2044e5", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684657932, "uuid": "5988f84c-6834-4780-93c6-66d4baf47058", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684657932, "uuid": "145ca166-fac2-4df7-a459-c1ba0b21dccf", "value": "helper.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f369a65a-f771-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684630430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684630430, "uuid": "589297b1-e4a7-438b-a23a-d3040d45ce7c", "comment": "Malware payload", "value": "bebccbfef549ba69a82ebcd6b3657f97", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684630430, "uuid": "33b156f8-2bb6-46d6-b8ef-4030f7bee9ec", "comment": "Malware payload", "value": "bf335690d41413ec399fa0a84a2d3364fc1f6a3b2c23605696cc2a42596c49b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684630430, "uuid": "18c2423f-09dc-4106-a871-eeae031bc678", "comment": "Malware payload", "value": "190af0ed584da203769e2e5ea13f6fb4b675764e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684630430, "uuid": "40f0d2bd-5f4c-40db-b038-99fe91379ff5", "comment": "Malware payload", "value": "e2ace20895e11b3ab65065b5f1f3f0f3b9fe3f3ff4a2c97c241f7ab3bfafc99e9c9a3bf072e6c57f2c63d94608dba100", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684630430, "uuid": "b09d0143-de9e-46a7-bcb3-a437a4b64882", "value": "T1222523269BE590B3FDB93BF050F642D30A39FC905DB8876A734E99560D329801A72773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684630430, "uuid": "87f8eba9-d8f8-4fb8-81f6-57395a26bac2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684630430, "uuid": "9c8d1601-dad9-4082-aa9d-3ddf661b1fc1", "value": "24576:+yTBMECRaFT+anKqHjEj8R82mcrY3tFhvs:NXCRahBnKqHYj8LYdFhU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684630430, "uuid": "85094ed4-f76f-4023-8272-9c730239dcac", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684630430, "uuid": "40b204f1-c2f4-48e9-ac35-3d41f5380416", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684630430, "uuid": "6cf0ee83-8982-412b-be10-2124611787ff", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab453fb5-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684680560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680560, "uuid": "b3613b4f-653e-4532-a659-e45f1023224f", "comment": "Malware payload (Amadey)", "value": "9a7eb03688dd4a2486b4a8212f65bb3e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680560, "uuid": "e00c5621-88a6-4f64-9989-78d097711a80", "comment": "Malware payload (Amadey)", "value": "bf6cad91338f9144cd3126fd9434193348f8f1474f835a0aa47565d02cc3a6cf", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680560, "uuid": "8a6e1d04-7142-4279-9f2a-2672ce6c5a06", "comment": "Malware payload (Amadey)", "value": "f6cc42d20ab6aa1c21ca5b39b8369557b5bca9e7", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680560, "uuid": "db114c68-a180-417d-b84b-4ee4ae523375", "comment": "Malware payload (Amadey)", "value": "caf5892fb48ca41bc52e3f87bba551cdbbc701d5b52ee3d416b4203ac7772cfa3bdf50b093973cd1b12a121fb937a2ee", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680560, "uuid": "6aefe6ef-c319-40a2-bba6-2aa553777b72", "value": "T1DA2523179BC88033D5F52B3428F205E31A3ABEA0CEB1C7591312585E6D737D09976BB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680560, "uuid": "46ef7134-5d91-446d-a138-a1fd94ad1866", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680560, "uuid": "721bed9e-0151-4fe6-908e-d61572f0608b", "value": "24576:xy4gk+YQFNSOM5q4D6yfrS2832eI/m/M62pzwY0d4:k4gk+3NVeqU68rdqmCM62iX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680560, "uuid": "8a420fb7-559c-466e-ac4a-ce0e7f07de52", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680560, "uuid": "3d7000b6-fa68-4854-8aff-3a5c96e23a8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680560, "uuid": "a673c5bf-6cb4-46bd-9a24-25e940123811", "value": "editor215.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f634e80d-f7e5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1684680256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680256, "uuid": "7fbd21af-6566-459a-b252-6706bd871efb", "comment": "Malware payload (Smoke Loader)", "value": "7b37b721bf9b5cfd1e0b16722f016213", "object_relation": "md5", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680256, "uuid": "f5c2452d-7be0-4ea9-947a-4574b9658a02", "comment": "Malware payload (Smoke Loader)", "value": "bfafe275de347a8f6f8d243dfd34005b3ee677aaa06d319b86dbeecb7dca1acf", "object_relation": "sha256", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680256, "uuid": "75d14b1d-01ff-4078-a31a-402c2d6f3c4d", "comment": "Malware payload (Smoke Loader)", "value": "a42cedc795c9d82912f8d7943e439ec67ea7b246", "object_relation": "sha1", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680256, "uuid": "59779ab5-8f3f-402f-81e4-190850842380", "comment": "Malware payload (Smoke Loader)", "value": "aab5450aecb19caba38d5f44bbf74dda211afa35bb99f4f17e802bb19b4684f69a7ba7964dc8fd925a4636056e946908", "object_relation": "sha3-384", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680256, "uuid": "a3ee9769-7a13-4c67-b946-029d1be02bc6", "value": "T16B548D126293FF71E56686754D29C2F866EEB8614F1927DB33543F6B18322E3CA72301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680256, "uuid": "54439ad3-1041-41d9-ae7e-97ffbd5b1841", "value": "40be65705a95a43e6733e98c1ce5e92b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680256, "uuid": "370b5f38-3301-4209-bd9c-91e050c5f321", "value": "3072:NRhpsJPjmOYsJg7R+k/8KafSiD3YAkNoBKUBIYYffDyBTo0yB:tpshLYsJ0jkltjtQ/UKLDST", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680256, "uuid": "58ab7e2e-6bd8-46cb-9532-795569c35a14", "value": 294912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680256, "uuid": "6ee707bd-bae3-4e7c-b665-2e8d13109ad2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680256, "uuid": "6b57535e-d50f-4d0e-9118-36d5ea5b2035", "value": "islauncher661.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c58b811f-f7b1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684657841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684657841, "uuid": "eb333b40-a45d-4d60-9dcd-01ca73366bbe", "comment": "Malware payload (Amadey)", "value": "29a70df3ed502670057654cb99efeb74", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684657841, "uuid": "f894592b-1526-4dcf-a3e3-7ed93da40d5d", "comment": "Malware payload (Amadey)", "value": "bfda82caa5317832ab573b247c90f812993ed3d68237c72fc6cbd39cdb26b92c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684657841, "uuid": "5d8e5e5d-5bdf-48f3-9edf-2b84505fbfd7", "comment": "Malware payload (Amadey)", "value": "2bbc93bc2aaeaedff79a83d78b28d0949b45a1d5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684657841, "uuid": "0c392aae-949a-41a5-9d85-b5d41de5bea6", "comment": "Malware payload (Amadey)", "value": "710d43ae2ced478fcefa8ec0ccb01fa57d1b89556d80287b5d2da88c53832e2d81e7add5b816b78a42d6a2f0c835d412", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684657841, "uuid": "8eb44553-a6d8-4372-8eb6-f97f2de4cb0f", "value": "T17B252316B7ED4072D4B21B7098F612C70732FDB05EB4067627816C6A5E73681AE7237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684657841, "uuid": "ecd03fa5-7072-4f4c-a7a7-4e50af0d198b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684657841, "uuid": "869875fc-e1e1-4cdd-b55a-84c237aa0898", "value": "24576:5ySIpRFO55HYwyq1Rr/YuwoRFYuBoKtJxTyjO9Pm+V:stRFO/HYwyqvr/FRWuBj4ORm+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684657841, "uuid": "a416149f-535b-475d-9567-2c3540f8b2d6", "value": 1046016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684657841, "uuid": "0daca5bb-efb7-4f7b-9b4f-911bd445a741", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684657841, "uuid": "27bbbf31-d034-493e-8b73-696c664b004c", "value": "bitcoin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7594b427-f7ff-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684691207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684691207, "uuid": "412e9168-24e2-41d9-a38d-2805ac3da753", "comment": "Malware payload (RedLineStealer)", "value": "8ada93b7f36a4bd3821389e3a19c395f", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684691207, "uuid": "5259e2fe-1cfb-4798-b8a8-fdad4617e6eb", "comment": "Malware payload (RedLineStealer)", "value": "c057c95c7def40dac4e36ef1694997acbee8ec7caa12820793a873f3d7e9d2e0", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684691207, "uuid": "df6cf2f6-a635-49a9-8323-089f6a58f0cc", "comment": "Malware payload (RedLineStealer)", "value": "41a01ae977cc6492e96fcd26f5f9f47bd55250e2", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684691207, "uuid": "5205ac28-cdb1-4d3d-84a9-da599713058b", "comment": "Malware payload (RedLineStealer)", "value": "9bc2c182a3da9db6a822f0dce9627a74a12f56c7e7e6cf5b6ca0c29e5e565ee36a0c5e7bd5b9724de5cba2151eb76db3", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684691207, "uuid": "81d9ecf2-3b73-4e98-8fc2-a7998670d61f", "value": "T197252303A2EC1073CDEB277018F712971735BCD1D474932766466AAB4CB26D9AA32727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684691207, "uuid": "44046dec-0313-4999-8ca8-c36565b92252", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684691207, "uuid": "ff4eeb44-51e0-4f9a-ae70-a6bf5bdd55fe", "value": "24576:hy3S2EyToLDlFgcHeLQPqCX7qrMu54EJeOMpK8x8Yx:UxqB+LiqCX7qrMu54EeKy8Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684691207, "uuid": "acf6cdba-4416-49b0-9c40-36d9d274561e", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684691207, "uuid": "959cfdbb-28ae-4955-a1f7-cfa18d178a79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684691207, "uuid": "f24c476e-3410-46a6-81ee-7e15ee607609", "value": "client491.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0580cca-f7f4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1684686555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686555, "uuid": "0776f867-5bb3-4301-bd57-30262c246bf1", "comment": "Malware payload (Gafgyt)", "value": "2e9110ebd9b8de0eb5123a4dfbe2afa3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686555, "uuid": "96cff8b4-258c-466a-b945-57582c885270", "comment": "Malware payload (Gafgyt)", "value": "c0628027ac3a6e540caff4196d5eed71c87a4a598d6e50176ef26f62e5db4866", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686555, "uuid": "462377bf-86d3-40bc-99ca-f05b0ae87fb5", "comment": "Malware payload (Gafgyt)", "value": "c957309f931cdabb0beef1a42dcb56b0666d15cf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684686555, "uuid": "639bf0d0-9d1f-4d91-ae01-39a02031a232", "comment": "Malware payload (Gafgyt)", "value": "3063ffeddc54eee2ecd56edbe5b6795197bf30d43f06420d9bf4b28b2ca16aa64525f2d8c47eb7d5905fd5482107864a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684686555, "uuid": "b6588c3c-8912-421a-9cdc-51ce77c61051", "value": "T1F5833A46AB81D6B3D14305B212A79F660033F93B1A5ADE99F35A7CB48F185C4B222F1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684686555, "uuid": "71024582-e7d2-470f-8be5-812ff4d6bafd", "value": "1536:vIfS69AGjVOIUEhUS+1U1QxU7z3KjRcMo1B6Af88dCNlmTUOT9Fqg7mLI2VOYjX0:vIj9AGjV9UgUS+1UuU72jRlozBf8mgO5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684686555, "uuid": "c2471d9d-acc6-4ccc-a328-657dfc49a057", "value": 84905, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684686555, "uuid": "00008860-c8d5-4940-8537-63cea780dd96", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684686555, "uuid": "b2f34b96-3c38-4110-b633-ea3a0ca8f303", "value": "2e9110ebd9b8de0eb5123a4dfbe2afa3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7ea56b9-f7c7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684667240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667240, "uuid": "fd68694c-6355-4c61-aa8e-1c5f1f04b8fd", "comment": "Malware payload (RedLineStealer)", "value": "9c0dc12a499641cf5d7d06ccc05ecc25", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667240, "uuid": "132c29e5-4a03-438c-a94e-40a5f10dc6f4", "comment": "Malware payload (RedLineStealer)", "value": "c08b0a4663ff1dcc554a3a0a312f1d522dd0d61d7ef1973183b41d4ab5f1465b", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667240, "uuid": "4ce0ab4d-7e5c-48ad-9628-1fc7cd67b173", "comment": "Malware payload (RedLineStealer)", "value": "27424177324c5b30fdc1e168f78c2823503db3fb", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667240, "uuid": "1f5dd8d3-5807-417a-955a-f8acb393ca79", "comment": "Malware payload (RedLineStealer)", "value": "b38f793a094a57f9e1dc28099fd7327a2c65858d55ffd09f72505e429f9aea4298d4b2bdc3da60d821daca667f38cb08", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667240, "uuid": "1338bc14-d576-42e3-9fd8-3f51dc3b3cc3", "value": "T187252316FBC59063E4B42BB0B8F9168B1F367DC58978C35F121AC95E19B2981A13373B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667240, "uuid": "c8508b80-6ab1-4343-897f-3c99dd10d25a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667240, "uuid": "e9890de8-9e27-4c3a-87ce-ebffa7a9858a", "value": "24576:7y3MZs4EPmeQkkfun7+p/T9enMJuypow41kzV:u3MZs4Wkfun7YYnRyaFQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667240, "uuid": "842763ad-ec28-4ff3-bd73-46796dbcd55a", "value": 1057280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667240, "uuid": "3ea40aca-ae24-4e02-9ddf-0f7d7eeb5277", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667240, "uuid": "e40d8669-c1c8-486e-9332-9575f4c8a5e1", "value": "AdminCrack601.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8f52032-f7c7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684667322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667322, "uuid": "0f24738c-ec38-4389-80c3-c1a481ad816e", "comment": "Malware payload (RedLineStealer)", "value": "4fbdc4e794eea0e635901fc15c4af0a4", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667322, "uuid": "97677428-a0cb-4e5b-92aa-27e611ffdbe3", "comment": "Malware payload (RedLineStealer)", "value": "c0a82b3b5e46bf583d9f3df24ac67f9101213e1d83ac4d95d673307d81cb225e", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667322, "uuid": "0fc91a62-f678-47d9-9d32-1613ea8c04c7", "comment": "Malware payload (RedLineStealer)", "value": "96c5132e5ce84f6eb2f60ba29ec86ad759a734e4", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667322, "uuid": "83d4c75a-e0e8-4484-9726-f917580d6e60", "comment": "Malware payload (RedLineStealer)", "value": "d6490572fa8359ff252923a4a579c9b0a2dfb6ed7b88519a7afe2e65237f674e43f46d906113bcdf120639cb8b717b1c", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667322, "uuid": "1e0acf25-ee65-48fe-b075-4f205eae194a", "value": "T1F1252203EEDC1462E8B227B16CF657831A76BEE24D74820B6385DA0F1D329516D3277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667322, "uuid": "b2e61dbe-45aa-4525-8d23-c232e3245427", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667322, "uuid": "9086e0fb-2b99-47b1-98fa-3ea8d4712ffb", "value": "24576:8y60iz0qGrV6WqqR9v6yWDYEVDrJB2JBtWk7Fno2E5JdvUxwHZ:raoqGrQWqe9SDlrJBjeo2E5JdB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667322, "uuid": "136a712b-ac07-4b76-ac24-885013f0c45f", "value": 1046528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667322, "uuid": "2f952467-a51f-41e7-9335-56e741e2ac59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667322, "uuid": "221224b5-1e82-4e14-88be-9c9e1429d2d9", "value": "formatter909.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc3c641c-f7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684680615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680615, "uuid": "6ee4a8d5-22e4-4580-8aea-0bf2ebb4bee2", "comment": "Malware payload (RedLineStealer)", "value": "4e0b76d53bc4630563d5ce1792f49d56", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680615, "uuid": "fc59e14f-11c3-4eb2-be63-b73699183a42", "comment": "Malware payload (RedLineStealer)", "value": "c0b46805c890b964f5dfcc5faeaff20aece1534e8d44b673d55d62db124d7b6d", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680615, "uuid": "9b70ccee-43b5-43ae-9c5d-a2c0a96fb97c", "comment": "Malware payload (RedLineStealer)", "value": "df253cf537599f66f8c11fefa91648e0439a0b49", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684680615, "uuid": "1d382d35-184a-4313-8bd7-8240213b280a", "comment": "Malware payload (RedLineStealer)", "value": "10487f008fdf7fd2e31396f11fdc12ed31835ddfbea83d585828b3d7f5044e9839fcdcf3a2b57be56ba96aebc721cab0", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680615, "uuid": "60bc90d0-5442-4f35-85d2-64b9e1cbbdb3", "value": "T11C2523075ED89077DDB15B72A8F203D30B3AFCE1987C46261B5A9D5BA8B2A409D71333", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680615, "uuid": "e12738da-8bf7-48ce-95bc-b1bc48590653", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680615, "uuid": "d954a2ba-f0aa-4904-a7b5-b59542b01af6", "value": "24576:nygAaKjMMOEq873iqJNfGHnpf15bgppZmr3:ygeD3q8biqJNfGHpfvkpZmr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684680615, "uuid": "53d31f00-a86c-40de-b28b-896a5fc13357", "value": 1054208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684680615, "uuid": "7968b482-fafc-48ea-851f-ed2d2e15b290", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684680615, "uuid": "b992f424-fdbc-4e7e-a762-6e1d10de2237", "value": "notifier586.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28651b6d-f7b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684658436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658436, "uuid": "bbd78c63-2603-4b84-b7d3-276d94df1e7d", "comment": "Malware payload (RedLineStealer)", "value": "4f6c8d196050595d526d89e9a0f12d08", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658436, "uuid": "6b0d8dd9-15fa-4c46-a1be-9675185d20c0", "comment": "Malware payload (RedLineStealer)", "value": "c0fc00b483a64675bf5ba5979df5a461157c6de588dbb569899c18fbe9902800", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658436, "uuid": "3cf778d2-6d07-445e-84b6-e38812a86dd9", "comment": "Malware payload (RedLineStealer)", "value": "c0a13bc013f3bea592b32730f37f2ff3f66a9db4", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658436, "uuid": "bc613cf2-5bbd-4e96-a4b9-4e39ff96a0b4", "comment": "Malware payload (RedLineStealer)", "value": "4776f6f92548be1143d71a9a21ccd59d3ea42f50e14b88308259ad71ebaadb86658fcf69288fa5dbb635ec4c72ea0001", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658436, "uuid": "da5dff50-4f13-446b-803a-c97b9a05f674", "value": "T1CCE3D624379F8930E6BB4D3D6CB09CC076BCAC126552D74A4ECDF1593A73B809B216B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658436, "uuid": "f970406c-b767-4961-9770-1ecad17d56f9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658436, "uuid": "bb6e264c-92c2-45ff-9772-b81c8ce1dc99", "value": "1536:o2BGlTP+mZP61sEYDmRSNIgcscLDuRwH77+u8oxQKHbuxGBNM740wuei/Qv+R+Fn:6V+m5cvQmRSN90+82iTi74h9ZF8e8hU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684658436, "uuid": "5ba381b2-0baf-4c6d-8c60-efd584076061", "value": 148543, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684658436, "uuid": "f0591e44-bc9f-49e5-bd1a-72fc3e84db25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658436, "uuid": "fb8b5bba-97dd-4568-953e-294a3f698b99", "value": "extracted415.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1b62d49-f7c8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1684667793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667793, "uuid": "24491934-91a5-4504-920d-c9512ab8f561", "comment": "Malware payload (Stop)", "value": "bf47203439833388bf8d77e2471ff29c", "object_relation": "md5", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667793, "uuid": "22a71485-3643-4ad2-b6bb-71cf3d9e5e75", "comment": "Malware payload (Stop)", "value": "c14b06a3a76dc9d5673c5e98d318d5906c407869bec5ae0a66c0b8635fd61531", "object_relation": "sha256", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667793, "uuid": "67980d2e-53b2-492c-8043-d55ae2826892", "comment": "Malware payload (Stop)", "value": "7eebef40274dc65a9b325deb73919405c024381d", "object_relation": "sha1", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684667793, "uuid": "d79bcf25-073f-4bf3-9d3f-32dfe58f077f", "comment": "Malware payload (Stop)", "value": "2f364652fc20b0c877adfad22ef70832c56d065e544b8e28e4c88595090c965466af712a6bd0f70e99fd1cb78c028c20", "object_relation": "sha3-384", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667793, "uuid": "3c85a181-6e3e-4e3a-a822-8e670b6731e6", "value": "T10405D0035591BF62E5254F729E1EC3F8BAEEF9518F492BDB62146E2B04702B2C673311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667793, "uuid": "8de52506-a0dc-4994-bb96-256a04fc9703", "value": "c3945e210b1009128598ead2a7524d0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667793, "uuid": "dfaee47b-05f0-4d80-9358-ff38b9531ee2", "value": "24576:XbS/8H+Y951XcKh1rJC040GPq22555VEqzU:Xbl++51XNm0GPq205", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684667793, "uuid": "92ec78df-510d-4a03-86da-b697970a97f1", "value": 842752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684667793, "uuid": "695354bf-0d7b-440a-b6ad-9d4eb25d5ff8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684667793, "uuid": "b43b9c9b-5ef9-43f2-a5f7-8f1cb338042a", "value": "gateway323.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c5df1b1-f7ef-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684684186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684684186, "uuid": "ec332f6a-8729-4d49-8e3d-0a5031e74bcd", "comment": "Malware payload (Mirai)", "value": "98c45b5fd2c1f707261f3bf1d1daf399", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684684186, "uuid": "84806eaa-c02f-4efd-9f4b-9851bf0272a6", "comment": "Malware payload (Mirai)", "value": "c15b5d358baa3175ebddee7f8e8e0c5b5fca462123f682402f7961272ed7bea9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684684186, "uuid": "80f44a42-474d-459c-98a0-779fe582ba35", "comment": "Malware payload (Mirai)", "value": "684dd633b04eeed20d38b579da5a65af9776079d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684684186, "uuid": "81454cf4-2ee9-462c-b7b3-0f29c07cd61e", "comment": "Malware payload (Mirai)", "value": "68266a500338d45ed1045448c7a92baa82cac7b6bf12697b4994e5a74743001d0abd7e40173ae0b151a2468b1080fcab", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684684186, "uuid": "f7535f57-8c8d-45f6-ad40-9cc8b04650bc", "value": "T14F03F751BC829A77C2E1137AB6AE4A8D332163E8D2CF7217DD214B607AD651F0D23F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684684186, "uuid": "f81dba59-91e4-49e6-834c-b2e000d1b2aa", "value": "768:sga4CbfsG5f0OtnlUlYOJFFARwAsb9LHWhCv+b0G7rDUXoTWA/NYwW:svbUG5fPlUlDf4Sycv+PUMjW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684684186, "uuid": "0c5cbefa-ab8b-4b50-8b04-64c5b8ad490b", "value": 40756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684684186, "uuid": "73265637-77f1-438b-99af-faa8088f2128", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684684186, "uuid": "fa077c16-7d23-449c-ae3d-1220a3348846", "value": "98c45b5fd2c1f707261f3bf1d1daf399", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf90a12c-f7ec-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684683198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683198, "uuid": "4b25e9a1-78bd-4256-873b-3828c4d5b6f9", "comment": "Malware payload", "value": "30deb21c51f2b7ae278384bc51a10895", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683198, "uuid": "501648d0-fdf4-4acb-bd7a-e7640f49b2ec", "comment": "Malware payload", "value": "c17dc4f259e12f2e4edd684a5d13666f74f27b6ec1dafa923ddf6af39015d7fa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683198, "uuid": "9d21b93c-2cb8-474d-a87a-1637af266d00", "comment": "Malware payload", "value": "51398d68c51e629012314ffef0250bf5244b9d5d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684683198, "uuid": "8cb462a7-4f05-418b-9397-44a9cf9a8784", "comment": "Malware payload", "value": "994f5c8b8929408b1040f88465c4b74c16ccb073de64441088bb15dd4316146f54cad1150d22f4166d91cb1e802317b6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684683198, "uuid": "efc222bb-6a3a-42c0-a9e2-6784424d6b56", "value": "T1F5E34905D7408B57C1E2277AFADB424933339B54A3DB33099A38ABF43FC27995E26116", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684683198, "uuid": "5b91895d-2d62-45df-b1fc-4c70d593cf88", "value": "3072:it8iFDKEfFN+Fa+1sW9h7rz0JH/WbUMbmQwfCMQiGW:g8iFDLf/+FaNQh7rz0JH/Wb5mQwfCDi9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684683198, "uuid": "2b891bef-149d-4d33-a18b-ebad8193fe89", "value": 150077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684683198, "uuid": "bf3f427e-56a1-403c-8131-c07b88847240", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684683198, "uuid": "e0eedbb6-12bd-4ae3-97d2-ff4d117f0410", "value": "30deb21c51f2b7ae278384bc51a10895", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f1375db-f7b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684658474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658474, "uuid": "1fd404f6-1c0c-4048-bf1c-41fd8e9b0e94", "comment": "Malware payload (Amadey)", "value": "328d0461acf3280600fb8f1782f4549a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658474, "uuid": "4c20acd4-0073-4b36-a2c6-1c9df2d49ff4", "comment": "Malware payload (Amadey)", "value": "c19e491541da0b7823cb0ef74de6fb5a18e1c08e2db84df3aaf0d5f4c941e5ad", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658474, "uuid": "e1d70b6a-5779-499c-b963-3fb8221a6136", "comment": "Malware payload (Amadey)", "value": "4338281b382288407da3f48bc840818e9c1189e1", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684658474, "uuid": "466333d2-41e3-4be3-8939-5d885fceb341", "comment": "Malware payload (Amadey)", "value": "7fab6f1f67f1380b73554cedab3a424f5aa5c5c27fbc575b6e66597f9715fc71ec7622247868e147efa13e8630759edd", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658474, "uuid": "f01f5dca-859e-4845-9555-30b67837c49f", "value": "T173252343B6ED9132E8B327F4E5F203E327767CA55DB4822A2185B49F18733959932327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658474, "uuid": "56f2c312-21fc-45c0-b8af-0524b576191e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658474, "uuid": "27e38100-5ba5-48cf-a916-985e3db83ea5", "value": "24576:Byqge7V/3mO+0A9BQD/rmbwwkkteweIeDPmSTFRSxdDls:0Xe7Z+BAmbJkkIFPmSTFkxZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684658474, "uuid": "5af3c3b7-feb0-4436-b159-3059feb3ff17", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684658474, "uuid": "bc255d3e-e42e-460d-9a7e-b5b08450243b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684658474, "uuid": "955440d3-9ff6-454a-9d7f-82b5ac5c36ae", "value": "reader213.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a320b43d-f7d0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684671098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671098, "uuid": "c1181d62-60e8-4e53-bec4-3c6993c3533c", "comment": "Malware payload (RedLineStealer)", "value": "649ef138651f165911c094dbeede6795", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671098, "uuid": "bfcd1b63-c220-4d96-bef7-c70ad4386a01", "comment": "Malware payload (RedLineStealer)", "value": "c1e390f51c4c9be88692504d0ce5e22fda5dcf16cbd66c8ba70728054c7e97d1", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671098, "uuid": "d764b911-1a54-4517-844f-41405b7dcf57", "comment": "Malware payload (RedLineStealer)", "value": "4262becad57d1619bba749ff08bd045af97233c3", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684671098, "uuid": "2e2a65cd-6214-46f4-880e-f6c9db7375cc", "comment": "Malware payload (RedLineStealer)", "value": "28a11bd52393210ca9340d00faa271081b95b73e04806f72b663702411c0aaa40400848f71697036fd18116d0cdecc72", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671098, "uuid": "1d2699f2-d00c-467f-9ff8-3c6a6c18c65e", "value": "T14325234AD6D64072C5F31B7028FB13971F36BE66CA65C72A1305AD190CB27D49A3A32F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684671098, "uuid": "f8a2c3ad-d769-4947-8afd-d9403160e080", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphas