{ "Event": { "published": true, "date": "2021-11-20", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-11-20", "timestamp": 1637452981, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "be4ba565-8684-4166-a202-6f40aa7e6104", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81d015db-49dd-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637397625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637397625, "uuid": "205f5716-74ce-4569-a889-f6ef6c2f046d", "comment": "Malware payload (Mirai)", "value": "3d35edd1c2f95ef51dd895e5af54d0fe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637397625, "uuid": "f3ad6c4a-74ef-4f62-8f93-b97504853544", "comment": "Malware payload (Mirai)", "value": "0037fbdbec1b91397ef40f5d635582bb5d313af7a2fcd969c079eec43289b683", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637397625, "uuid": "0bfc8bbe-77b0-45e7-9148-9303d3c5efb1", "comment": "Malware payload (Mirai)", "value": "b63d0347390d140f4367ebe935fe820ae36d46d3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637397625, "uuid": "2df967d7-e67e-4321-b84c-4c02adc63239", "comment": "Malware payload (Mirai)", "value": "ca36b3f721c7ee0810ade5013d9f36f052c4388b81ec848b0ec296cb321b870820eb02b03f82ec3de98522fc2975da67", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637397625, "uuid": "199b1862-3c03-4fed-be78-4236dcf14631", "value": "T1EAC3BF32C9782E99C1016932B4B4DE3E5713A94056132FBBA0C6C66D54E3EEDF6293F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637397625, "uuid": "7a197763-fcd7-4910-8970-80530c6cdda1", "value": "3072:eyyIE0fggggkZhyTd4YS6zcV8sfl0D+MphfG:py2ggggkbQVAfMnhO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637397625, "uuid": "cabbf585-73a0-407f-90e0-02be0658437c", "value": 120548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637397625, "uuid": "2694f4b5-7014-4be9-8b3e-5646a98e1461", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637397625, "uuid": "df024332-d2a9-47eb-b3eb-9caeda9632ad", "value": "3d35edd1c2f95ef51dd895e5af54d0fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cfd5d68-49e7-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637401858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637401858, "uuid": "83dedf85-6e00-4867-b2c6-ca8954c50474", "comment": "Malware payload (RedLineStealer)", "value": "f731311649cede47712480ba11e5225e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637401858, "uuid": "5413f64c-e544-4270-b498-0527b29b1b8e", "comment": "Malware payload (RedLineStealer)", "value": "019a477a4c907b98ed5cea90cb7ac97d85802159d14da560b9be52343f53316e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637401858, "uuid": "2960b058-5e58-42bd-a306-2556423c86fd", "comment": "Malware payload (RedLineStealer)", "value": "928526e504efbf89d9e79f6d6849e774f24712f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637401858, "uuid": "a0a9286f-2dd2-4916-b100-2a7f6e947d47", "comment": "Malware payload (RedLineStealer)", "value": "21756774a7440c8021ecfd0da71ea6d908daef86b5ae8e604ad8477d8d46c0ae54b56890fc4caf982831c72c7538abdd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637401858, "uuid": "d5eb487a-bdea-469f-8807-c063cf3bd676", "value": "T100C4121067B3C072E5A126B4793097AC1E377CF36579409B63A4263F9E202F18E76B36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637401858, "uuid": "971f8161-070b-4c81-9ed4-f3fd64434d06", "value": "afd7f49f71a4c196b8327a3d6c1e7f8d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637401858, "uuid": "de25ad0d-4f73-4efb-9bf1-9128763731d3", "value": "12288:qqBsVUG/K6zstAiDWykWBx5bkQFcxX2Hfd1Rh:qHfzstZxkSlFcoHfdfh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637401858, "uuid": "26cf8d5e-ed25-4b67-909e-ee060780850c", "value": 581120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637401858, "uuid": "12ce18d0-db6a-407e-943f-f7c1ef988cde", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637401858, "uuid": "48b2f0c7-57fe-4506-b412-80c814a3d6b7", "value": "f731311649cede47712480ba11e5225e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "513fc708-49e8-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1637402268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637402268, "uuid": "6b12a176-abd8-4f6a-9326-34f1dbd95e49", "comment": "Malware payload (Smoke Loader)", "value": "ff526792a21e22b97806ab5cfa83fbba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637402268, "uuid": "26066e5a-225a-490f-b472-659903fac5cf", "comment": "Malware payload (Smoke Loader)", "value": "01c01aae7732121882acd82c0538f17517f020fb7c6ef81e41c9c2625e4f8aa9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637402268, "uuid": "656ced1e-b7dd-4995-adf9-84cceea784e2", "comment": "Malware payload (Smoke Loader)", "value": "873e7c48048df390087bd6f333441bfc6b538d05", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637402268, "uuid": "c59fd9da-4605-4964-b2d4-5e55315d8dba", "comment": "Malware payload (Smoke Loader)", "value": "35e4126c968493099f8236d2941b414085f24eeb7e19f4d88deb724fd0937d58548e7d6573c4cb6feb4d0be14478dcb7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637402268, "uuid": "e080baef-58ee-4ddf-9fcd-68401799dccc", "value": "T135F39D2137F1C072E4E77630197186AB2A3BB973A671458B2F68162E3E307D049A5F57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637402268, "uuid": "2aa72689-a9f7-4f1a-bbfa-617d8c870020", "value": "d447c88e5ba79016e49c5de135738a35", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637402268, "uuid": "6f1be0af-5f90-45fe-a648-2f14a8eba7d4", "value": "3072:O7Y4z1YII+Q9NTHp2DD7w0Lu3MbqG8es6ybHB:gWII+Q9N7pgD7BLQM2Dd9H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637402268, "uuid": "20a4fe71-c744-4dd4-a74c-20c5b6101152", "value": 163328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637402268, "uuid": "2ac31eeb-3cf0-4298-ad9d-a4362f14a095", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637402268, "uuid": "d7b8d2c5-6355-4bf5-96f6-083c19a344ea", "value": "ff526792a21e22b97806ab5cfa83fbba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9153183b-4a11-11ec-843c-42010a9c0014", "comment": "Malware payload (BazaLoader)", "timestamp": 1637419985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637419985, "uuid": "fcae336d-9328-4df2-9333-e078477f67a2", "comment": "Malware payload (BazaLoader)", "value": "b1a2dc1223c45c761f1174638933eb2e", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarBackdoor", "colour": "#1E24DF", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637419985, "uuid": "9100ef75-d6cb-4279-b675-2372b55780cf", "comment": "Malware payload (BazaLoader)", "value": "03212850d80dd26f4b6706024516f1834e7b8ae9fc31231b2a624106242c4838", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarBackdoor", "colour": "#1E24DF", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637419985, "uuid": "dd915949-0121-4d19-9882-21166dc0b7a1", "comment": "Malware payload (BazaLoader)", "value": "d92968624fba894f157b2b6a74eb60ca34ded065", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarBackdoor", "colour": "#1E24DF", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637419985, "uuid": "91a6fcac-eefe-41a8-858b-08289a46ab50", "comment": "Malware payload (BazaLoader)", "value": "0a7bbd79538b0f1942f0ec66fa38f09b7ec9e8c55c9dbd61cdc94b80161bf2a5fb880432bf1955fc64445463602b7e93", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarBackdoor", "colour": "#1E24DF", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637419985, "uuid": "e1373d0c-be40-4bad-baf5-b21face07610", "value": "T14CC4BF05F29400B9E67AD1358A37EA05E6727D5E03708AEF2760435A2F33BE09E7E711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637419985, "uuid": "05b98908-85fa-444b-917c-f04cffef8e88", "value": "1a3e40f664dd8522834526b4a62c8c92", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637419985, "uuid": "2b5abf19-4820-48a4-99ab-928d48eaeb7e", "value": "12288:+GGLok9ocest1M3tTsobLUedSujVf+BzKKU:KomttGt4jESG9+t/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637419985, "uuid": "e96d2696-57df-477b-bf8c-293b94743788", "value": 565760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637419985, "uuid": "dda15389-a2a3-4ec5-80ce-b20e1ee6f455", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637419985, "uuid": "5e349741-76c8-4c48-9662-e703dfe63f4a", "value": "b1a2dc1223c45c761f1174638933eb2e.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef1d77a0-4a28-11ec-843c-42010a9c0014", "comment": "Malware payload (Socelars)", "timestamp": 1637430021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637430021, "uuid": "91a387d8-5519-4eb6-9760-594adf819335", "comment": "Malware payload (Socelars)", "value": "75f13bcd18948ed9318396cadf3b3442", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637430021, "uuid": "ed2ff24d-5cbb-4542-9b83-c042b84c9bb5", "comment": "Malware payload (Socelars)", "value": "0466b839b04f09bff7cee333e33e8a22eed68e8d95997ad6da17ae19e1d8293b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637430021, "uuid": "2b01883e-248e-44f1-a089-f64e7db422c0", "comment": "Malware payload (Socelars)", "value": "71ba405a7404f9ffe4466ab85eceeee661739712", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637430021, "uuid": "0e091ed4-589e-408e-92a1-5008ef63256b", "comment": "Malware payload (Socelars)", "value": "970c7b8d82f46bbc5a8b8fac7cb458b5a89a9f5e7d1760ca72798de9f66bfbdbed0ac60d6af5a7e5c3b2c753a70a3f4f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637430021, "uuid": "2d8579e8-e532-48e1-8df9-f4e74ddea2a4", "value": "T17265AE11F682A036ECE300B381FF5AFE9D2CB621131854D7E3C45A695A615E37B3762B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637430021, "uuid": "16b02ec5-b5db-49e0-9415-285b835cd4ea", "value": "d69e4c13e25f0ad622344ac56118c0df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637430021, "uuid": "8d486a82-6d01-488d-9180-b56f23712ca3", "value": "24576:Kvp1T0ZhIjR+IXbtCOEqmb3tUJoNPdG/9QDRChm8XQeXjv4tUL:kpCuZ4Ou/4+c08XQeXjgKL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637430021, "uuid": "70f8450e-4e96-4953-bb28-224f41cf571a", "value": 1520640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637430021, "uuid": "53f39e3b-17ef-41bc-87dc-edc100b82fd5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637430021, "uuid": "518e4300-7403-451c-b27d-9eda79ecd715", "value": "75f13bcd18948ed9318396cadf3b3442.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95fa5b0f-4a1a-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1637423858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637423858, "uuid": "a07dd47c-6a96-4da8-b49e-50666a72b907", "comment": "Malware payload (RaccoonStealer)", "value": "d9627d9cc977f9da6dcb1b3fd5598a59", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637423858, "uuid": "9a191535-5bf0-47f4-a393-1822a95c2fcd", "comment": "Malware payload (RaccoonStealer)", "value": "07741f444f37245f829e5b349f34d923f64c2af50d0e69ebf247adfb20e70979", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637423858, "uuid": "3739162a-256b-4288-95e4-a49b4eb3225c", "comment": "Malware payload (RaccoonStealer)", "value": "9b99af675927447578ea315bbcfeb96d93fecd46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637423858, "uuid": "576e27e1-427c-4da6-9e20-6a4844133588", "comment": "Malware payload (RaccoonStealer)", "value": "97031c5dbdfff5f49ce7bf6409b364b66a479c01e0e566f7ec975fdcdafc5b344e50838b10d1228e6206499ae4c35576", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637423858, "uuid": "eb6beadc-35cb-4b07-9634-a32991e9ebf1", "value": "T133A4211F21C2C294C9572776C6A7AB21BFF210D54363CBCAEB4886C44A491E57F39F98", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637423858, "uuid": "c40e8482-b390-42ef-bfd2-5dd4a003ed80", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637423858, "uuid": "1b39e2c8-c91d-4315-920f-a1bee6fe8e20", "value": "6144:taapVEZWJ9KgwE9S3IO/6yHrHlgzMVmDD/4yl1MkADgesS:tKZcT8IO3HlgoVmDDwoMbDgZS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637423858, "uuid": "012b5a78-027e-419e-98b7-6b432d8144e9", "value": 491416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637423858, "uuid": "97ea2f25-fa1f-4041-afef-12c5e1fbd902", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637423858, "uuid": "3a4bbb66-3e35-4bf8-8774-07924624769c", "value": "@chupa111_crypted.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb9b422f-49d8-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1637395655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637395655, "uuid": "6a429bdc-bc17-43fb-862e-924cff068ab4", "comment": "Malware payload (AsyncRAT)", "value": "72e5a6a37dac80d7b571c1a464a5cbcd", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637395655, "uuid": "c10703dd-d5e3-40b5-9d3b-259516c4ae36", "comment": "Malware payload (AsyncRAT)", "value": "080e59c46faa71cc92b10e5cafdb4e80fc295c8c1b935ee1fdaff8c0c9c193dd", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637395655, "uuid": "c9d8931e-b1da-4db8-9799-5e05654cd9cf", "comment": "Malware payload (AsyncRAT)", "value": "10c87514c00be951ad0f5c14d57b74568f79e529", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637395655, "uuid": "09d96cbb-061c-40c7-bb17-d4703f1d9f8a", "comment": "Malware payload (AsyncRAT)", "value": "71bb48ec301d0bbae8f13141995b85c5dcbf642d541950d56ed52ee05192e0c8364b97acde47fa12021c019c21565a80", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637395655, "uuid": "395e0985-4e11-45ce-8997-d00080d0f5af", "value": "T19F232B003BE8822BF2BE4F789DF26145867AF5A36603D54A1CC401DB5713FC69A426FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637395655, "uuid": "69a2531e-06de-4e0d-8b48-6a172c5b450d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637395655, "uuid": "813e1550-3f64-48b3-82c7-fd178d10e0b2", "value": "768:MuwHvTpY8oiWUUGyKmo2q803QtEayPI9fzjbVgX3iIo3uGWnNPNN5BDZ2x:MuwHvTpTf27Eab9f3byXS1kVNnd2x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637395655, "uuid": "fb2e74c0-c204-4382-b78d-b89db731ac1c", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637395655, "uuid": "d1b4b719-6b65-477c-8eb0-7b8445b81a21", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637395655, "uuid": "74bbf416-d58f-4dd4-ae76-524bdb08d87a", "value": "72e5a6a37dac80d7b571c1a464a5cbcd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43874a42-49d0-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1637391937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637391937, "uuid": "bb9d959a-03ce-4d36-92cf-228069fc52be", "comment": "Malware payload (Gafgyt)", "value": "a2d4f07e1eb5bb597f67297a26b8eeec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637391937, "uuid": "90354f49-a5bd-4cca-830d-e370987c42f3", "comment": "Malware payload (Gafgyt)", "value": "091a86bcd4ff6b609ccdbb1a63dbcd96626ab0d335241f82278c3efafc915ed7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637391937, "uuid": "1f834ef8-9dc2-4f70-a489-ee1cf7f353c4", "comment": "Malware payload (Gafgyt)", "value": "8b545b3bac90b8543c38e6a0dd6762c9c6d55244", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637391937, "uuid": "db5310c5-8ab2-4ba8-8ddd-078ca06cc17e", "comment": "Malware payload (Gafgyt)", "value": "bb151d8c79c8c98e345e201deb4117a44e034e6d77b7fdfb94570e23b449c939b9b5a17494edf889795284ccc1b16018", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637391937, "uuid": "3b41bb91-2108-4317-a3f2-775c55c57b7a", "value": "T104C3842E7E12BFBEE668863107F35F70879521D227A19382F26CD6181E7128D1C5FB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637391937, "uuid": "2a43bc72-84ff-4948-b43d-7fa9037cf45f", "value": "1536:M7je1TMGq+f+AQ2rK7zeXeReXe8V2rK7Ie+u60GAzQj1l72HBe/EdWfRZrmW+IFj:Ted0W0MZQHLd6RZrmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637391937, "uuid": "168f0437-dc9e-42ed-aada-3ea8ffcf8535", "value": 125962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637391937, "uuid": "2c9bdd8b-36e9-432d-ab4a-5d7e16764f79", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637391937, "uuid": "1304c39f-734e-4f0a-82fc-8e4123a82e9f", "value": "a2d4f07e1eb5bb597f67297a26b8eeec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ded04e25-49c8-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637388762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637388762, "uuid": "04e6db6e-0b82-4f94-a03d-c8ce26bf5634", "comment": "Malware payload", "value": "38dda8ad59ab25385d7b7475c5c8f2df", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637388762, "uuid": "6da649d4-33ae-48c9-a487-7441ccf97b90", "comment": "Malware payload", "value": "09530b67fb85086fdadfc9b5199060bcb81518bf35c5d6278ba1880c84d183d5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637388762, "uuid": "ef51f0ca-3af7-4774-abb6-b2c6c9a9a9c7", "comment": "Malware payload", "value": "1cff8ee0b84304930670b2f60df70d466ca299ef", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637388762, "uuid": "8433be4a-ed3a-4087-9a9e-93364ab018bf", "comment": "Malware payload", "value": "5a6afb9e81de2485235d73dd3f2967cee7085ceb28830a9a070d2ff2ef5b5a8eb163e5a4b634191338b87e9c2c80c342", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637388762, "uuid": "ed833ba3-8e3f-4d83-8980-a50dba23b0ea", "value": "T1B6447D5175839032E5BE183065389AA7096C79710BF4CEEFD7D4183A4E742C2973AFBA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637388762, "uuid": "1ea5a536-2ab4-4673-87de-fdd45564603d", "value": "3072:+ArvqQL8/Gu7B4gPwcX1/5cjcpv4QC2mCj7RQBFmeOpk2+HedcGbgqSfzJMRuAgu:+AriSO7B4gYcl/qjc5dQD8JCedcsqAh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637388762, "uuid": "feaff912-f6c3-4dd5-8b75-7619d834a10d", "value": 278524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637388762, "uuid": "665cb1ca-0d3d-4ee7-857d-4be899203acb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637388762, "uuid": "8b761e7a-9b77-4c8c-91fc-309c4e838b2e", "value": "emotet_exe_e5_09530b67fb85086fdadfc9b5199060bcb81518bf35c5d6278ba1880c84d183d5_2021-11-20__061237.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "420deade-4a1f-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637425865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637425865, "uuid": "cbb7d61b-561a-49c1-b54f-3ae6799873df", "comment": "Malware payload (Heodo)", "value": "f6cfd1855ac4d61666f10e9c3601418b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637425865, "uuid": "97f2a0a0-f9bc-4385-abeb-c39b4d98539d", "comment": "Malware payload (Heodo)", "value": "0d20b337979060e2b6a97b9a5fc12dde9ef8da4f892eaf84773cef7443cfd3ca", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637425865, "uuid": "e691c160-d7cf-4e18-bd2c-b5813c5ad2ec", "comment": "Malware payload (Heodo)", "value": "dfe2b1546be742c47ab872a4edeb254e5f2589e3", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637425865, "uuid": "b0639ff1-072b-4187-b425-beec26bab776", "comment": "Malware payload (Heodo)", "value": "060bd7b85abf44c862a27752b413034e9788a20937f9c3b7c28f3f1e36c028baa304d1a44a22e1beb74d238955ecc0cd", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637425865, "uuid": "89b7793c-6660-4b5b-b0ab-8db9aa500b51", "value": "T1D744CF01B280A072D9FF193A45F5C66A49AC7A500F90DDCF63984DBE5F725C2B6309EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637425865, "uuid": "fb6d83e8-13de-4073-9642-6e4c929e3e5c", "value": "822ae775303d14fd9c529b33f0deaf77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637425865, "uuid": "c762c8d4-5572-4a43-af0d-cc0dd5e33c32", "value": "6144:9ks3h7Usv9KgNXyyPSkDTQhJh1WTB5uCa:9kMgwWyqkDT0WTfpa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637425865, "uuid": "734b2d77-3488-4de6-8896-873e9419644d", "value": 258560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637425865, "uuid": "f622855d-b51d-4bf5-b70c-0099f5114e01", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637425865, "uuid": "e1b52710-4bae-4bb2-b540-b76c5e0fca9a", "value": "f6cfd1855ac4d61666f10e9c3601418b.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e77aad7e-4a4e-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637446329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637446329, "uuid": "20592e42-52cd-4368-b37d-6732ce3ca549", "comment": "Malware payload", "value": "d0cc2d9d58432cf09c6aac7856f75b93", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637446329, "uuid": "f81d5288-84a3-49c0-b48f-a0fbfda67823", "comment": "Malware payload", "value": "10cc2de88fbbbc389b48ba140b79bfdbce43173ab2ea5f7ed79b48314802646a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637446329, "uuid": "84daf530-9b8a-4d00-9a66-8c779b336b1c", "comment": "Malware payload", "value": "8b77f5e6656230001989cc3d828aa43ce445aaac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637446329, "uuid": "90aa6bdd-1386-4d9c-9bd0-a5b4736fb3d1", "comment": "Malware payload", "value": "8c09f73c146a602a19c87fbc836e350d156df0992e37a4b8a41e97f6c752ca083bda7a3762d6a18c84848422d66b3eb1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637446329, "uuid": "b2fb3ba2-2b52-411c-bab5-42923c766299", "value": "T144C5D03FB2EA6D7EC47A06394572929858376E70641A8CDA07FC250DCF27460BE3B715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637446329, "uuid": "2577fbcb-5a25-440e-9c28-c76cfec1e45d", "value": "5a594319a0d69dbc452e748bcf05892e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637446329, "uuid": "0fed0b0a-adb7-4320-8f28-f8bf0a9cb292", "value": "49152:+qe3f6atzD7+H98AHaCfu60WmHCL+WuTmuKwEt:vSiwD7E9vButWmHCK5NKXt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637446329, "uuid": "ac1f9803-6316-4651-b572-3636ae6650cc", "value": 2705872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637446329, "uuid": "584d9dd1-7270-4510-a9c4-fd55d94d4b72", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637446329, "uuid": "f871f8c0-0db5-416d-bf61-cb21fac3a0b1", "value": "Nitro Generator - Linkvertise Downloader_X7-KHW1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7393110d-49e7-11ec-843c-42010a9c0014", "comment": "Malware payload (BazaLoader)", "timestamp": 1637401896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637401896, "uuid": "00246c9f-d22d-4df7-be4f-c234e19b2f21", "comment": "Malware payload (BazaLoader)", "value": "24189fcf3cb44ec17807a860cb8dfbdb", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637401896, "uuid": "5d6a6eca-5374-43ab-8818-81adf049f34d", "comment": "Malware payload (BazaLoader)", "value": "14cc39c7804ff5f599fc801d763a7973f5a99a0d510327a86b1b3f0f25a8fe49", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637401896, "uuid": "34027214-3caf-4a4d-aa88-174eea77b53f", "comment": "Malware payload (BazaLoader)", "value": "893d4210a07c8f2ea4ac1f9d4f04fc9082d3edc7", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637401896, "uuid": "be253f83-60cb-4fa4-9d1f-0db5831a9c2a", "comment": "Malware payload (BazaLoader)", "value": "da6492e93495f56afc0230b7d55a03984d1315acc7f1654934a72d873838bed627e7a40f92f4bf5050831b0edaf3f374", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637401896, "uuid": "0e7b8737-eb22-407c-9304-27bbc59b5931", "value": "T162C4BF05F29400B9E67AD1358A37EA05E6727D5E03708AEF2760435A2F33BE09E7E711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637401896, "uuid": "28cb5202-d993-48b2-86c6-2113f6972ba2", "value": "1a3e40f664dd8522834526b4a62c8c92", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637401896, "uuid": "4c2e0518-1d48-47f2-bdae-837b35c83bb8", "value": "12288:+GGLok9ocest1M3tTsotLUedSujVf+BzKKU:KomttGt4FESG9+t/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637401896, "uuid": "0ced7850-1a59-457b-b3f9-53d30dcfe52a", "value": 565760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637401896, "uuid": "d382330b-2300-493b-9333-57d5d5add90f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637401896, "uuid": "b5fdf29e-85b8-44d8-b8b5-66e9cc9f9a4b", "value": "24189fcf3cb44ec17807a860cb8dfbdb.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfc0f4f4-49e3-11ec-843c-42010a9c0014", "comment": "Malware payload (TrickBot)", "timestamp": 1637400306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637400306, "uuid": "e1edfe7f-b161-42c7-94f2-8ed252552500", "comment": "Malware payload (TrickBot)", "value": "2a91d3d15c44db62a11d91cff29ee295", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637400306, "uuid": "5968c5ad-5d40-4f56-bd2d-3494b7c64234", "comment": "Malware payload (TrickBot)", "value": "1532dcc03936ecb3d6836b6598cdc72b9e34eaa797497420d52530448714b766", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637400306, "uuid": "17202907-f7b8-449d-b832-d472535c6e09", "comment": "Malware payload (TrickBot)", "value": "848513cc98a0effde42ad227c615bbd472788381", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637400306, "uuid": "a5b90e6e-0ccf-4c25-9d08-841de5a129c0", "comment": "Malware payload (TrickBot)", "value": "174e91e754a95bd63b3540901ad2300f84986307296dd16f93a551f57dc13d1ae66f8ba7cce02925b1be667c69997059", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637400306, "uuid": "a11f8722-f4e1-44c0-9ba9-486ad3fb175e", "value": "T13294BFAEB588112CF9E56BFACE2F5FEFB1D1AB122702B449113E5FC2572527F1801906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637400306, "uuid": "a38cfab0-f7c3-488d-87c0-a7eb8f08f999", "value": "12288:Zg6sAoGRtiZwyrKT29plU9S7hZ2otIs095GRlelPI7jd8VkOs9FsGe:uCdyL9rPTE5GRlV7jd8Fs9KGe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637400306, "uuid": "1ee18f6d-fc5e-4958-84da-fb7ba07e2566", "value": 447488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637400306, "uuid": "9070602a-fe41-43b3-b447-964553fab249", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637400306, "uuid": "ae1b1535-613f-4e99-8fe4-ad2b3611c92b", "value": "2a91d3d15c44db62a11d91cff29ee295.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6b78177-49e4-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637400747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637400747, "uuid": "a52f0f3f-3053-429b-ba99-052707fdc4c8", "comment": "Malware payload (AgentTesla)", "value": "c97883df277f558b976981aa6caeeb42", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637400747, "uuid": "77967385-177e-4230-a580-6c7861bd03ac", "comment": "Malware payload (AgentTesla)", "value": "158e7073c350d2bd919ab3c5462761be63c197bdb33dad32489f9577b8494640", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637400747, "uuid": "853f8e73-f45c-4ad3-afa9-29b4124d5b7e", "comment": "Malware payload (AgentTesla)", "value": "90cdbe3f2607f04b0671c1208b46cae7ad4434fa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637400747, "uuid": "4ac803bb-d1dc-4a89-a089-c73ad98a7321", "comment": "Malware payload (AgentTesla)", "value": "28f55a79d4df53148b4e0ace05fbce9d73a461dc38cb9c0d1368243990718fbc5b554e2d3d82dc7fee6cfa9004905fa6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637400747, "uuid": "7f71cd87-fa42-4b98-b55e-8a84ae1b0e18", "value": "T19AC4124036989B85EA3D97F50AA1C05013B47E3E69A9D36EACC361CE2536F005F56FB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637400747, "uuid": "1c6a300a-9b29-4438-acaa-1b5fb9c51df5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637400747, "uuid": "0b1922e9-2e11-4d9b-ad3a-7ccd96705aa7", "value": "12288:joRhtD00oysI6zyM70WEfg5CB3603Pd0SrJhfsJjsUtLbWW:whC0oysI6zBQWEf+CPd0SHkBLbl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637400747, "uuid": "760e48a7-75ef-4847-b073-d6baa59393a2", "value": 586752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637400747, "uuid": "863400a7-f6c1-4d89-baa1-4aec757358f5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637400747, "uuid": "73a4f6ef-37e4-4ac2-8cdb-458c3ccdb886", "value": "c97883df277f558b976981aa6caeeb42", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "931ec952-49af-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1637377897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637377897, "uuid": "c55f88f8-cee4-4622-8aca-7e11e0ee6030", "comment": "Malware payload (Gafgyt)", "value": "cb811e5427214576577de7ce958eda39", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637377897, "uuid": "ef648504-9743-49d1-9e06-5f635cee33c3", "comment": "Malware payload (Gafgyt)", "value": "15c227af91a411940a93003796f047799f211fba6355649d08acdf683e06e965", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637377897, "uuid": "b7cff643-66ab-4355-b271-3705c55f2723", "comment": "Malware payload (Gafgyt)", "value": "a6cdecbf20a1777179a75f470b3df34e35fd890f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637377897, "uuid": "3acef66c-d9b6-418c-b640-10f5e62c042f", "comment": "Malware payload (Gafgyt)", "value": "484acc430497c2f86ddf4fd5bfe9ce3c5e75f198c2a17c026873aa7759852eaf31a12263d346a885fc98e569dca5431f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637377897, "uuid": "3f8a9e1b-354c-4924-9c63-0ab96e2d4f3c", "value": "T197932A92FD01EF66F00A8A3A45C707256630FF660B932E7173577A669A723C47427F0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637377897, "uuid": "1b7e2993-1a7a-407d-9bc4-7025ba7a80d8", "value": "1536:Po8Onpb8xSFMYY68GbfIhiPoQOU3Cu8tkbqw7GWswxcGIHUIN:Po8spQoY6aiQQ3bbqw7GTwy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637377897, "uuid": "13b0f21a-3542-4092-b374-15a22f5435c0", "value": 89377, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637377897, "uuid": "cc2a30f5-ca47-4ef4-a252-344d12fa1942", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637377897, "uuid": "1ff31ff4-76fd-4d7f-9292-33e97827e688", "value": "cb811e5427214576577de7ce958eda39", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c57ded3-4a35-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1637435465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637435465, "uuid": "092ae970-5a64-49a6-b999-a447e8fa3753", "comment": "Malware payload (ArkeiStealer)", "value": "3d86a1d42a087aceae129c9a59363dbf", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637435465, "uuid": "d97071fd-1210-4e7d-9b11-738d6e1bc0b0", "comment": "Malware payload (ArkeiStealer)", "value": "167470da35d8686aaf59f5c499a648d85041755a227c366a5d3ed11aed38ef8c", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637435465, "uuid": "00b50636-f9a1-4111-bada-b5c71fec5ff5", "comment": "Malware payload (ArkeiStealer)", "value": "fd4dee859b208d3672b44f47ce52ed7e0a8f17f3", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637435465, "uuid": "76195602-20d0-4a3f-80cc-ce95010df3e3", "comment": "Malware payload (ArkeiStealer)", "value": "11c6b0e53eb69f9573c6b45850ab0f0820090fdf4de911893bf51a0f0e8ac93eaf3f71dfc87b6641a27027eef0f36572", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637435465, "uuid": "33ebbbd0-d3ae-4224-ab0f-7c86f8d27e0d", "value": "T19B749E10A7E1C035F5B216F859B593A8B93F7AB16B3890CF52D526EE4634AE0EC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637435465, "uuid": "28f82194-53c8-4f53-a4dd-55aa61c0a6a8", "value": "bdaee7bf3d7f5fcbbe5fa5d59a50c909", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637435465, "uuid": "e4a0ba93-e029-4e92-84b2-c2b82a774c9a", "value": "6144:9HmUJweRz/YRf1csVrWVZPtBGUgNKY9owy7yWlrpnP:9Hmkz/ausVrWtB3K5Y7yWlVP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637435465, "uuid": "be729b2d-4c31-493a-a444-c35f3003f8dd", "value": 343040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637435465, "uuid": "d37a14dc-d9b6-4522-9be2-c35a060f454e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637435465, "uuid": "f901b2fa-5e1c-42c7-b03c-6e12d4e7335e", "value": "3d86a1d42a087aceae129c9a59363dbf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09f0c9c1-4a3b-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637437797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637437797, "uuid": "11d1d7df-e852-4f18-bb0c-c824405c8116", "comment": "Malware payload", "value": "3ed3fb296a477156bc51aba43d825fc0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637437797, "uuid": "9d82d6d4-d4ce-43b6-a2f2-75131253b08c", "comment": "Malware payload", "value": "1898f2cae1e3824cb0f7fd5368171a33aba179e63501e480b4da9ea05ebf0423", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637437797, "uuid": "74b84356-eecd-4fee-bf87-78cc9b83dfd5", "comment": "Malware payload", "value": "9caa5c658b1a88fee149893d3a00b34a8bb8a1a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637437797, "uuid": "cb254dac-474e-46ed-81e3-2183a9f26135", "comment": "Malware payload", "value": "93d91e5fef120fc82a95c8f134846339ec411bad7c65d0ff1bb0832c8fb2dfd10acd8b019c3a834b78f4edd1834cba76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637437797, "uuid": "4a0aefe7-2953-42c0-80b4-fa77a8d40427", "value": "T1382429D727B941A2F9113CF0229A82B586470C3EA2D22F14DED83F56667F27DB115A3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637437797, "uuid": "49dd8aba-4afb-4375-9e17-fd749a5c2192", "value": "3072:EJv/3Ppzq+M4Lh5VWK5qlYRV+hvuFiweXXbGgL90v5mq33Z3:8hzEA5GlYMWFBeXvx0c+3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637437797, "uuid": "f6c1c448-09c5-4590-80c5-04d00c46a9f4", "value": 225280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637437797, "uuid": "5f5bcd6c-1e22-4b11-885e-3c9e2056761a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637437797, "uuid": "fe36ed8e-be2b-469a-a1bd-5913369379eb", "value": "PolyRansom.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8eb1fd02-4a29-11ec-843c-42010a9c0014", "comment": "Malware payload (QuasarRAT)", "timestamp": 1637430288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637430288, "uuid": "14ec8ef8-a1fb-4526-bac4-78f0bf40b240", "comment": "Malware payload (QuasarRAT)", "value": "2e20173d0a334b83cf5d92d3cf527ab7", "object_relation": "md5", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637430288, "uuid": "14d38c32-4cb0-4088-9d95-b6d86154ce8b", "comment": "Malware payload (QuasarRAT)", "value": "189dfc7eca70dc08e242e9079d35198826b189f27e919aaf13c4482a763ae1a3", "object_relation": "sha256", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637430288, "uuid": "139c3d48-fa13-4ccc-8088-8809b874cd32", "comment": "Malware payload (QuasarRAT)", "value": "fa7516ae0eb174227cf740250e589c421a3ddb13", "object_relation": "sha1", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637430288, "uuid": "e229e9f6-5f0a-402a-ab79-6ba1550db782", "comment": "Malware payload (QuasarRAT)", "value": "162eb0878e7c5032b336e9aeba64c6173e12102a621e052f4b9de9cf23cb61ad797b8c44158580fbf569e9e0982aa7b0", "object_relation": "sha3-384", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637430288, "uuid": "425eadfc-9f61-4f83-9ddc-c0302618fc2b", "value": "T15A04BF617A44C80AD56902350CE2C6EA7B33FC465EB6C7573154F3BEAE77B90C80265B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637430288, "uuid": "e296ca71-6e0f-424e-b6bd-b99c70acd730", "value": "3072:BrxEtjPOtioVjDGUU1qfDlaGGx+cL2QnAJbuAJbD4DiOpEkOHfehcZHQIawhluju:9xEtjPOtioVjDGUU1qfDlavx+W2QnA3/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637430288, "uuid": "692d46ae-88f7-496e-a1ca-c602589bc6b0", "value": 176640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637430288, "uuid": "4211efe3-ea1e-4aef-b00b-3f47c5aa9d8d", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637430288, "uuid": "fae3923d-e521-41b0-8af1-36c292387ea9", "value": "swift.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6546efcc-49d9-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1637395859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637395859, "uuid": "7767d16f-9f37-4781-ae63-d6c2b857bab6", "comment": "Malware payload (AsyncRAT)", "value": "8f4c111508e2aa72a9955a003f8f8c47", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637395859, "uuid": "6b1545ff-4079-4cc3-a1a5-0d52d5349694", "comment": "Malware payload (AsyncRAT)", "value": "19477e8e55a35fc84d0132a0d01e4d387f101274bb73c29a34cd0857401eaec9", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637395859, "uuid": "a25ae513-b48d-4fac-8e05-02f184c64d55", "comment": "Malware payload (AsyncRAT)", "value": "398e31d508496e86319c62cb2008617164952661", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637395859, "uuid": "49dbd263-6821-4628-bc7b-03d964058122", "comment": "Malware payload (AsyncRAT)", "value": "443dc0065bae2e44470b4855b94933d6d3d719b8def7365c8ac382a5c493bb09bde795270b628482b2e134acea5da184", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637395859, "uuid": "1850deaa-a23b-4b87-a503-ffa315c1301b", "value": "T1FA017D0FA2B705860BB6F482E1B22D5D4C511566FAE4C16CB66D83ED0B24CE16C890AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637395859, "uuid": "2547b6a6-5ace-4b72-b5a6-5283d860cc44", "value": "12:LVf2Rp+NTcvCTUW6rXOlNwvp0fMW2Bmizdme2e3Rb2bh7eIbaZKwtBllkl6NKsan:LVfUpmYW6jyap0fMWx8HtJMWZrzlYJsa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637395859, "uuid": "4efd77fc-cb0b-4eda-80b2-a7716f1864df", "value": 659, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637395859, "uuid": "b117f62a-ee14-49af-a737-138ba540ceff", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637395859, "uuid": "2c3252ff-03a4-439a-9520-1b424ab8c9fa", "value": "WrVudnPI.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93ac5999-4a15-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637421707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637421707, "uuid": "f6a10694-fd45-42e5-858a-79df2126b16a", "comment": "Malware payload", "value": "e8f62b71d429c0f6dfde158e746828b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637421707, "uuid": "23a971ea-ba2d-4c3d-bfa3-311d6711d8bc", "comment": "Malware payload", "value": "19833e0887e0a19bb45a6acc390322e9aa09b9783620bcf479cda77a3b8c2533", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637421707, "uuid": "24e14c2e-9370-44f1-890c-7576eba97698", "comment": "Malware payload", "value": "72139b8ac088838a74d02ae2f7ae16e77b6bf9d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637421707, "uuid": "6474216f-165e-4bae-a5b3-f15cd3d9a413", "comment": "Malware payload", "value": "3bdefe8b84c05d4d07d025c854cd7750d269b7a972dc4458cb3e333c52d3d55127fa1db7bdf9eb5997d58a8ca9039763", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637421707, "uuid": "8dde3519-c7c8-4f03-8d94-5a5ce4d6805c", "value": "T1FB04FC77344525E2F93D5BF16BC6AAB659DE6E7F1CC0099422DC32F9A0B6220819C13F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637421707, "uuid": "44659390-85aa-4549-9a8e-732e5927ee13", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637421707, "uuid": "fdc1aa46-002a-41d2-923e-cfdfe161367c", "value": "768:1M0hKD8QjgCv/fHfCwsF6sJK3HTsw2peYemNrMi/Z0pp7ppVG0qTZRwYj7tfhibL:nK7bv//g6Asa6mNgOSVsZH7aTaGdB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637421707, "uuid": "6efb99e4-4b68-4cca-bb5d-271caaa93c13", "value": 187392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637421707, "uuid": "f15e2690-9d38-484b-bdcc-98c5b74f82fc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637421707, "uuid": "0a64fc1b-b8c5-4810-9630-c3fc0c89caec", "value": "e8f62b71d429c0f6dfde158e746828b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "644d34b3-49f3-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637407025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637407025, "uuid": "af79fe5c-ff37-46e5-b3ae-f87fb3715550", "comment": "Malware payload (Formbook)", "value": "902c93a42ab9f3f1fbe967eeb1c33831", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637407025, "uuid": "46efc847-3ce5-4f1d-bd25-3a4a03f11f87", "comment": "Malware payload (Formbook)", "value": "1aac9a73533b5745a863e565e556ecc624619b3cecb917c9e8aee7b141976bb2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637407025, "uuid": "4b6ff7c1-e6f3-44bf-9dc1-8a190a4fd39b", "comment": "Malware payload (Formbook)", "value": "09d28ed373405e7ef3c62547bd5e4754ee497e01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637407025, "uuid": "fcef7cba-bc79-40ab-be9c-c061306f5230", "comment": "Malware payload (Formbook)", "value": "057f92df8a21becebabcc5ae0f5a911080b92badec5a1ae9ffb6cc0c8a48f6e45f3c6f6eec770720828e960b2e49baa4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637407025, "uuid": "3fb393c4-4091-4031-ac46-d117dd45f540", "value": "T1D2A4DF8C3260B2EFC89BCD769DA45C60AA607877470BD343A09716DDAA4DAD7CF045E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637407025, "uuid": "acccf8e7-a6ab-4388-ba72-34cb8385b062", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637407025, "uuid": "cdfcb553-a261-4bd4-aee6-a8e7abe066d8", "value": "12288:28ENXh660FkSmAP4flYnvo9YGZGmwobrccm6vBYk:jENkzECnw9YKGm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637407025, "uuid": "186d336d-6e61-4553-9ce5-85178e26d797", "value": 480768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637407025, "uuid": "756c6255-e2cc-4cd8-bc93-1182d90c5d86", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637407025, "uuid": "c6ebb117-402e-4835-8076-9dc2372c20f8", "value": "PURCHASE ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04c57036-49d9-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637395697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637395697, "uuid": "503b9d0b-221a-4343-b25d-9e6ebcdd2c72", "comment": "Malware payload (Formbook)", "value": "c295065ea2fe52108c9376c57921c71c", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637395697, "uuid": "8a48ed6d-9bbc-4bcf-88b7-03d4dd2a4a2a", "comment": "Malware payload (Formbook)", "value": "1dda2332d5fafd9ac5b13d221c1689c3535983aa9dbecca7a1bbff1468c45597", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637395697, "uuid": "86f49e45-0c24-42f9-9796-ce03c1464dd7", "comment": "Malware payload (Formbook)", "value": "e5df64434a9dba905efa73d84da9fdd99d45c49f", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637395697, "uuid": "c40d070f-7c95-40b8-8d4b-507205a4e99f", "comment": "Malware payload (Formbook)", "value": "1afa3fee911fd59227ba57c047a0e3049fd8c111247db81d0fafed110994e0a71fd32b0e32b28b29e56cdf5890119d32", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637395697, "uuid": "8a973a74-2e8a-4883-a6f9-96b22c51a50b", "value": "T1AE7284ACC08706988F8AABB82B0B2F45514C766EF7859173367CA7351BD6C7B801793C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637395697, "uuid": "a3f32578-9669-489f-b27d-60f6e0668d27", "value": "384:ReWAG38qE+aVZ4Lvinv3NGwMesxLWsez6qacxCSK:RexG3LEXEvinfcjte6QxCSK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637395697, "uuid": "e42583b3-352e-454d-aba1-053baddf48f9", "value": 16398, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637395697, "uuid": "90951ec2-c28a-4b0b-9ddc-9169f465230c", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637395697, "uuid": "2b37da28-afe3-4a24-bb70-7dec43d7c447", "value": "444order.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9e137b6-4a59-11ec-843c-42010a9c0014", "comment": "Malware payload (njrat)", "timestamp": 1637451057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637451057, "uuid": "fba091c1-1e4c-4199-a75a-c0e1753afc73", "comment": "Malware payload (njrat)", "value": "50d8ddfee97cbec37fe50d0eab3d2348", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637451057, "uuid": "69735ce7-28b2-4351-86ef-e881a5ff3e37", "comment": "Malware payload (njrat)", "value": "1e4e74d129f6e69bcff84e1731c359b9827c61cd3eb13671f7740b9684503ecf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637451057, "uuid": "7624cfdc-94f0-491b-826b-8c6a3aa2de41", "comment": "Malware payload (njrat)", "value": "b69489d86e2256595b2fa9ed07502c0210ac0495", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637451057, "uuid": "5e15c0d5-f8cc-4af9-b9e6-5588cdf2bafc", "comment": "Malware payload (njrat)", "value": "50f6353f2c83726d1d1e388580b3fb8a1d6335d2540c33c702a443fc1b40b601173324b20a89ec18eb76c32b2ba3c59b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637451057, "uuid": "b206a606-718e-47ee-bfd2-992bc01d16b7", "value": "T100F3395A778A4B15E47C1D7190EF663003F19AC31A33E3C92FC4A69D8A122D79E4E7C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637451057, "uuid": "403518e5-1c92-4ebf-a979-b28a2decbf90", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637451057, "uuid": "2dcce54f-b956-4444-ad9c-2d3acb6c7e64", "value": "3072:SiiM/2EmE3vZVFI45pn5MjoxEqVRSb2DSO0nFD:Si1VFII5XS6AbBF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637451057, "uuid": "3323b3b9-82ec-4bc2-8686-b3123355b704", "value": 169472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637451057, "uuid": "b2fcdf20-018a-4bf2-b5bb-2ade638e3c42", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637451057, "uuid": "9653b452-18f6-48b2-ba97-7d0a4ff28b18", "value": "1E4E74D129F6E69BCFF84E1731C359B9827C61CD3EB13.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85348dde-4a1b-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1637424260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637424260, "uuid": "8e7b7806-1c3d-47c6-9d87-5c5f19a19b2c", "comment": "Malware payload (Smoke Loader)", "value": "d617221a618c9839823fe4b2f7bb6a11", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637424260, "uuid": "ac5e4d54-79ae-4dad-b596-9a6ce691e78d", "comment": "Malware payload (Smoke Loader)", "value": "1e9eca61655a28021c83863bb688a37e005416e0cc6612603c1c990737a96051", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637424260, "uuid": "315bd374-84f0-43d0-8a3a-3d35a4b70137", "comment": "Malware payload (Smoke Loader)", "value": "b982b655c5f26e12d7cc3eb5730a043394aa3219", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637424260, "uuid": "ae70576e-5817-4ee2-bd81-06f542ab34f8", "comment": "Malware payload (Smoke Loader)", "value": "a37c987beb0fce9cdd8d3b668bd2c1e3f14b57b2ed7fabe01255bea8d7cdbd67ff5362229deff675fc9532cad140ce3d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637424260, "uuid": "37beea97-6b43-4aef-a678-d79f5b62e4f6", "value": "T1C7649E10A7A0C435F1F312F859B6A3A9B93F7AA1AB6490CF53D516ED4634AE1EC31307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637424260, "uuid": "1aa6a4e5-f921-4ab5-a78f-ccf290788ebe", "value": "bdaee7bf3d7f5fcbbe5fa5d59a50c909", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637424260, "uuid": "6a223665-192c-4afd-8344-f5741bd0d5ce", "value": "6144:kIekhZkke6Dy0pVA/GkKfY6YX4ZwTGQSfb:kIvhTmuVA/G3Az3TGQ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637424260, "uuid": "0599a2a7-9e35-4abf-9a5a-7ce24a4081a1", "value": 328192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637424260, "uuid": "921f93b0-df98-4cd7-8e1d-07b4e41e659b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637424260, "uuid": "f50eefbd-091e-42d4-a263-ee6587cb5263", "value": "d617221a618c9839823fe4b2f7bb6a11", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72c7c6d6-49dd-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637397600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637397600, "uuid": "6d4e73eb-d7df-441e-8e3d-436c6d6b1bfa", "comment": "Malware payload (Mirai)", "value": "72065572635deabd289119cdf47792a9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637397600, "uuid": "b42359ec-fab8-42cf-9e6f-7e4b4d0f3602", "comment": "Malware payload (Mirai)", "value": "1ff31914f5e59a845474c2af181733ae3a5f440f7e3fc2e725aeb7cff632e569", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637397600, "uuid": "8a4e2bb0-946d-4c29-b9d8-4f7ce4ed55c2", "comment": "Malware payload (Mirai)", "value": "b73ad4ed5a7d145aedbb534563dacdd0087b1a35", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637397600, "uuid": "0ab86548-5b2b-4399-9da4-18a9c89d2f39", "comment": "Malware payload (Mirai)", "value": "f73adb9806428ec212b77e93330824b34dd68ef2f7bcdf7cdba34941b524567032f12c73a651e714d022d209e7400a99", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637397600, "uuid": "dfb5da12-8c02-4b78-be98-b258a50de139", "value": "T1B633F136C6D64E40E1B00CF94634D05BFC3D2BE091F9557BF22B820468DB1995F799BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637397600, "uuid": "5e53a495-9477-4503-b50e-54b4e7e051e7", "value": "768:KgGvHcm3TtjU0r4KMBSOEVaggVjZg0HHVhjiJwTJBFu7RZjojs3Uoz5:KgkhjUQsRfZgy1hPdHGoOz5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637397600, "uuid": "615d972a-b364-4371-ae57-f09a88ba7514", "value": 50408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637397600, "uuid": "29c05988-53b5-4596-97f3-e359b21608cc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637397600, "uuid": "8f7ace9a-0282-4fe2-9462-0ad940b9add5", "value": "72065572635deabd289119cdf47792a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "845d1b68-49af-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1637377873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637377873, "uuid": "0adddf51-2a3e-4947-94f8-3d77e85e70f6", "comment": "Malware payload (Gafgyt)", "value": "7f152471349fb929b43a076ac597bed5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637377873, "uuid": "f1244589-d5a5-4aff-b672-02a340cae824", "comment": "Malware payload (Gafgyt)", "value": "2025b91efce3f66f12ccce6eebc6b5b17249dd47fd148bae5085a8c88b48fe80", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637377873, "uuid": "44f9e539-e05c-40a4-8f4e-e5896d61b0e6", "comment": "Malware payload (Gafgyt)", "value": "91e893f19696360f8507fda32a9da477dfd7b82a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637377873, "uuid": "a9104919-dd68-4df4-959e-b92cf6d84f24", "comment": "Malware payload (Gafgyt)", "value": "6d4cf19043d7df74cb1418904a773088b3d4249b3d5aaa05fbb151f88edb24e3925b7d6ce8bb08babb00516a936b8ccf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637377873, "uuid": "950e0cdc-ec11-4d69-b867-660692e153f0", "value": "T1DC83099BB61D0BABC59B5BB12CB737F19B69ED6002A211C4910EFF9007B29702532F75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637377873, "uuid": "c8b3045e-1e62-4c74-aa08-ec7f883dcc54", "value": "1536:rhUB/XYuBXJWiOV7NTEO07Kq6FUIdU7D47otwHUIe:1afYOfwNTZ0Ob9Uqotl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637377873, "uuid": "6a3f4c21-47bb-4639-9b0e-5fe3290dddf9", "value": 88583, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637377873, "uuid": "7f678c00-e7c8-4b5b-901c-691835cd99cd", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637377873, "uuid": "7fb0b08e-a49e-4a73-a43c-0475ce7121e0", "value": "7f152471349fb929b43a076ac597bed5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b542d58d-49d8-11ec-843c-42010a9c0014", "comment": "Malware payload (AZORult)", "timestamp": 1637395564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637395564, "uuid": "f5b2ff66-8c77-4ee8-befe-898326a0cdb9", "comment": "Malware payload (AZORult)", "value": "060e668ca7c4d9b12247cfdd2a473731", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637395564, "uuid": "235c0b2e-db3a-4a23-a3b9-60ca8086b1c2", "comment": "Malware payload (AZORult)", "value": "2431312bcf36a1621d4e59a786795289980850ac07eee3b7fe0f221ace378fca", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637395564, "uuid": "988bbfdf-3d17-43e6-abeb-58eb60e8bb27", "comment": "Malware payload (AZORult)", "value": "0d34b62e6b8f494cf2ff6f8a0634c821c38f8c24", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637395564, "uuid": "7da1ab0b-4f70-4879-8987-7b101f07a9b4", "comment": "Malware payload (AZORult)", "value": "23756bc37aa12e8dc21c2324cded308b755df461b048cc5ff0433e7d13771b7d28b220a55bd4bde2b4a9ac006d7f0958", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637395564, "uuid": "14d50446-3a36-4634-88d5-b00bef77405d", "value": "T1BA74124437D6E742C8AE0FFF6D73040289B5E6890805F68B2EDA165D5CDB3460A53FAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637395564, "uuid": "74b195c1-5b03-4d41-be19-0abc5a983958", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637395564, "uuid": "5810d93b-4c34-4ecd-a370-17c7aae7a9ee", "value": "6144:UmIOQ2MK+oeVpq4JjAcUd//8NuDVx7UEpKuV49xoiZogFdNaxlB:GB2Mjm5cUd/zZ55pdFaogFdNm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637395564, "uuid": "febed903-a952-42f2-a536-ff768facd825", "value": 347648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637395564, "uuid": "881ab4e9-a1c5-4133-b990-e593c309ca2f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637395564, "uuid": "cfba3ddb-1cbb-4017-8ead-8bcc6a42419f", "value": "IMG600094173852.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe173173-4a54-11ec-843c-42010a9c0014", "comment": "Malware payload (njrat)", "timestamp": 1637448944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637448944, "uuid": "41732a41-5ae0-49d9-980e-e0222c4016b4", "comment": "Malware payload (njrat)", "value": "47694f07c6d517c05f97225da98adc15", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637448944, "uuid": "8d78d125-9e55-4ae7-89cd-f978bd7ceec6", "comment": "Malware payload (njrat)", "value": "248819366c125936dce7c0e5af0119c6dcacf2e2f3c3beef78ea03ffe8b9ab33", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637448944, "uuid": "713fdcb7-48ee-4f22-adcb-f9c751bc3fe6", "comment": "Malware payload (njrat)", "value": "8aae74664ca09973615292e572a927043f9d2f9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637448944, "uuid": "5bd1f8e4-db86-4845-982b-eb31994843be", "comment": "Malware payload (njrat)", "value": "668b40b2a3007c51c4ad1b5c4e745de96e66beb0c7053c1913f6ad42aeeb0ca6cbc1d4dedc6ea987cc0ca81ce711c3a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637448944, "uuid": "5bc0fb85-08fd-4e7b-bc73-fdf24a72cfa8", "value": "T19824F43AF9A4297BF577D22242910091F2BD84DA32349EF1D6D37198355E9022EE732F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637448944, "uuid": "0b66ab1c-c86c-4625-a3bf-e0f5bd703e0d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637448944, "uuid": "a87d8080-9ac9-4131-a1f2-6aea381dd591", "value": "3072:Ghhlcda8baRYX2NCakZsMgtNfRn8x6vLdxxy1blb3L68/NXOQSZbHd9SgxMg0khv:RWYsW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637448944, "uuid": "cf4140ff-c0db-417d-b20a-4d1cfdd36879", "value": 219648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637448944, "uuid": "2b93ad76-2213-48ba-b2b4-0135e3955a51", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637448944, "uuid": "914e4eea-9b6a-4694-9fef-30904f385e0e", "value": "248819366C125936DCE7C0E5AF0119C6DCACF2E2F3C3B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12f4999b-4a34-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637434805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637434805, "uuid": "3c24cd87-2a92-46ed-8157-650a53054da0", "comment": "Malware payload (Formbook)", "value": "d4c958b5f69575622ab7559b07e7abe0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637434805, "uuid": "e425713e-aa17-4d19-a136-a400af3799fd", "comment": "Malware payload (Formbook)", "value": "25d0f96b71b8f658d323fd6c0a0ed6051a03b5374324f56ee420fab8f5f5cf97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637434805, "uuid": "71d236ce-2b80-446e-90ef-8b806545bae5", "comment": "Malware payload (Formbook)", "value": "12d7244bcbf96d5a70cfe5f39271600a330334ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637434805, "uuid": "72bec1f6-bbf8-41fd-a1f3-b5fa40d46409", "comment": "Malware payload (Formbook)", "value": "3365df21be84f0b3273f9edd54ea0f57a4703ae17da5fc1a40692e1b121a6d002bba197958c65d9e72503e8b0a5c865e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637434805, "uuid": "641ab0b6-a0f6-4e9f-928d-cdf93d0faf75", "value": "T1A08413099DA59F15C0AA07F237701C1237F49A6F7A61D31C1EC064EADEAA78C1694F2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637434805, "uuid": "f369de96-3009-47c2-bf6f-201773a5e636", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637434805, "uuid": "6a346b79-dbd7-4e1b-915f-fdec97191aa5", "value": "6144:b9OWEVV2Kx3/chpL7dtp904YyVPp1Z48ufBV/m1F6est682ur:xEKKx3/QL7dLecxen16u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637434805, "uuid": "c4376e80-2c28-481a-9b9c-d51ecad97d6d", "value": 379392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637434805, "uuid": "fc83c891-5a64-4696-b6f0-cf55a3a4f43e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637434805, "uuid": "b17f5866-00b6-46df-a1b7-ff8221135597", "value": "d4c958b5f69575622ab7559b07e7abe0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16506829-4a29-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637430087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637430087, "uuid": "aa4ff692-f06c-4986-b833-8f57f82a4dc3", "comment": "Malware payload", "value": "42abb263d4a27426a0d256784b9716de", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637430087, "uuid": "01766875-1e28-4723-9a4c-29784881973a", "comment": "Malware payload", "value": "2c713220292633a35a9c12c026bc3f24e9bcd5728a411ab5dcf0dc34555bade9", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637430087, "uuid": "49dcbc17-fe0a-4bbc-ba99-27567a0dba0b", "comment": "Malware payload", "value": "b32782f760dd5ce4dd9d62c69c48b4db4fa8644f", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637430087, "uuid": "47f5cc5c-265e-4dfd-9a14-8c01ee926c2c", "comment": "Malware payload", "value": "769ae58bd65b9c4f7446f54f27a6c3ef4ec0f4a7bde409561010c32adadfe1f29775621c1f24f27ff495f31336337366", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637430087, "uuid": "adc614d9-7538-4fcf-9c4e-392e84f534aa", "value": "T1D3959D23F2C18537D4B32A794C9B7365A935BE142E38584B3BE43D4CAF3668079662D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637430087, "uuid": "52229596-e2c7-4cd2-b6e0-664d85b4c87b", "value": "24576:ELhe5GYV3n7vAd4IOlVrW5AGaQpTI1/weYaKzd8FVTU+TKSA:EL0GYV37vAduyE1z3TPTBA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637430087, "uuid": "ddf7ef0a-b016-4d24-b0a1-f2edde76a511", "value": 1984512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637430087, "uuid": "ad1a27aa-d01a-491e-b78f-da62c43f4d8b", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637430087, "uuid": "82fc653f-8acb-4045-a3d7-477173b81523", "value": "Factura10102021_(673KB).msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7b94468-49af-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1637377932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637377932, "uuid": "4e9888ba-9de7-479b-adac-85a6c6d5a053", "comment": "Malware payload (Gafgyt)", "value": "8f324a18f6e32390a867586e021f4d5f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637377932, "uuid": "f1b8f9fb-f174-4a71-97c1-af52c0a938ff", "comment": "Malware payload (Gafgyt)", "value": "2c9cf3ffefed9f03662fae2dd6fd64eaaa1b6885db3506314cb3f3b477ab204d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637377932, "uuid": "cdacf0da-ed0d-491d-b15f-d3b163e55b25", "comment": "Malware payload (Gafgyt)", "value": "564051e9050db3ddc1cde48c0910dbf6eeb64c07", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637377932, "uuid": "27656980-9488-41ed-bd36-205e72ffc4f6", "comment": "Malware payload (Gafgyt)", "value": "7fe0a2000d572617e45ef84750cf990441d98a5f693e227a0d03a5efce90b38e085b9e0f1474d4ca0762367d000fbd5d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637377932, "uuid": "2f69b3d0-2191-4349-80f3-659a2a702be3", "value": "T1EFC3766A3E51BBBEE5A8873107F35F70C399299226A1D781E26CFA185F7128C1C5F350", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637377932, "uuid": "45856b9c-feaa-42bb-8ef2-5858036fdea8", "value": "1536:fVNy7K4v/V5KnaVIAsV/NdtkxGTYQH32rKAPtXG/uYe7eal2UD/sNO5e+vg8:KjtSToW/uYeP2MhI8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637377932, "uuid": "09f142dc-e3eb-474f-a423-eddaf5c4521b", "value": 119167, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637377932, "uuid": "d10e4eb2-3bc5-4c61-9da6-49fbec64ba01", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637377932, "uuid": "9779357a-54b5-4811-9e8a-27270f205d43", "value": "8f324a18f6e32390a867586e021f4d5f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6a352a3-4a4c-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637445442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637445442, "uuid": "968f5391-77a0-485f-b3e0-7d0c64b3cac1", "comment": "Malware payload (RedLineStealer)", "value": "154246cb2e702341d6823ca593381bb5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637445442, "uuid": "7cfabb88-cfa9-43e8-8044-a71f8a3301e0", "comment": "Malware payload (RedLineStealer)", "value": "304cdf732f9d9c5ef2ce9e7936b2d667a5ff3115112543774034be23aba5b6b3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637445442, "uuid": "6f7e0791-c4fd-46be-901f-88130d1fd600", "comment": "Malware payload (RedLineStealer)", "value": "8667bc72ed8e4b6bb6c0a7c15728650201d92929", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637445442, "uuid": "d72dc67c-5b78-4dc2-b898-9e28fa3753f9", "comment": "Malware payload (RedLineStealer)", "value": "f5b4f6556211733abe4e1f69c6de68b8f66d475ee91df9bac7e8777565b5719fc9d638fbb9863285b207a61c0c3d83e3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637445442, "uuid": "37d0b995-9d95-40a1-b935-6bdaa537bbd7", "value": "T154842428647FC05940E3EEA62DDCA8FBD99A95E3640C743701B4A33B8B51B84DE4F479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637445442, "uuid": "06844d6c-10de-4ca1-854d-9810f1474452", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637445442, "uuid": "4fae2033-feb8-4c24-94f3-be6c8b986bae", "value": "12288:2EfiKPerRb+GYbCUanTkJkKrdX4Q6+4Os:7iq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637445442, "uuid": "5ed8f14a-2fd3-4802-86c8-525aab429d7e", "value": 399872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637445442, "uuid": "da920d88-d8cd-499d-9927-898eb0c9ac1f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637445442, "uuid": "0cac70a2-8adb-4ef8-9250-3dc34799ac5b", "value": "154246cb2e702341d6823ca593381bb5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "594699ad-49dc-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637397128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637397128, "uuid": "1c0d2bf1-5ddd-4e59-b8f3-3aa30a5bd1a6", "comment": "Malware payload (AgentTesla)", "value": "af5097a8c3b6b83bcde2a79f3e3f751c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637397128, "uuid": "f6958085-c811-43e8-9650-c5a14a4b3412", "comment": "Malware payload (AgentTesla)", "value": "34222f895185b2c0d403d80bc795f773c9c33b0b426e418e22cf0283d923a878", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637397128, "uuid": "479a6bef-9a5c-45f1-91b3-c12abfb0a2c2", "comment": "Malware payload (AgentTesla)", "value": "0958b5529a73c5ed25d058e1ae0480f711301cbe", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637397128, "uuid": "507088f5-9fc5-445e-8970-dd91754aa0ba", "comment": "Malware payload (AgentTesla)", "value": "df2b8b5eabaafe21177e1ee8e6f1451f8e4116d41d39e9b68e9af24d2b8671933db23f5a7a42e8e6db6e79926e3a07d9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637397128, "uuid": "2c071732-5aad-47d0-84a6-85e4373bf08a", "value": "T11841E04D5FE053E103D2FFB3A92DD049D1B0D84A66DB586F5211E0B4B821427D2B6A32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637397128, "uuid": "7f24b7ad-2c72-400a-8a36-80db9b0b56b7", "value": "48:JKDQnWMnBmt90H+DSmdOMAEWmWrv4HSYgirVxdoC:JyWnUt9m+1BnW0yYg6VxSC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637397128, "uuid": "b8f67c88-1139-4659-8ff0-dae563057265", "value": 2059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637397128, "uuid": "db404534-5be2-4cce-914f-6b5671a08e52", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637397128, "uuid": "a057ad54-dcce-4c3c-bde4-243e0a241104", "value": "datos y facturas del beneficiario.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73488a64-49cf-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1637391588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637391588, "uuid": "0422507a-b98d-4e98-be72-0333dd659145", "comment": "Malware payload (Gafgyt)", "value": "1dc0ca1566003986e40dc6e4e9246b75", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637391588, "uuid": "e19aa424-19a1-4dd6-bc27-c11dcf0bd2a8", "comment": "Malware payload (Gafgyt)", "value": "347efdc790ab125098da8d2481c511ee24c40133527310f0f0d211e70ba10371", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637391588, "uuid": "4b572df5-fe39-45a3-8699-eb8c7d27f4a5", "comment": "Malware payload (Gafgyt)", "value": "ef038c641ac343bde402a086067114552e98a89c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637391588, "uuid": "e9ab4610-b460-421f-98cd-0d4abc008ce5", "comment": "Malware payload (Gafgyt)", "value": "82da1586ab7cf17f6fc2d08f9a06eb1288e2faa4d2ed45e1b1100516e7d46d10062172e699c6aeba5c51c05c3adabbaf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637391588, "uuid": "469dd936-8905-4789-bd78-ef27be8b6ee4", "value": "T15BC32805D5508767C2D3237AE79F825D37325BA4A3DB33215A34BFB82BC27891E39921", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637391588, "uuid": "465b8329-6d3f-4da5-a2d4-5a90c286db27", "value": "3072:ekYPUfsgnsb0J2ag/Vf9kDN0dn+mTQOY5NX3cn:9YPUfsgEo2a09kDy+mTQOY5R3cn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637391588, "uuid": "c7451fb1-85ab-4ae4-b86d-32d1707fe78a", "value": 121007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637391588, "uuid": "8b4a9373-fdc7-466a-a29b-c41e5706a934", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637391588, "uuid": "f2613ebf-e8fb-46b7-89bd-82ffc9e91dde", "value": "1dc0ca1566003986e40dc6e4e9246b75", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66db102a-49f4-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1637407458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637407458, "uuid": "461aa087-4ae5-48a8-bf2c-6856944d734a", "comment": "Malware payload (Loki)", "value": "9fba46d150f79cae3187f8f0253fb1b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637407458, "uuid": "30d9e399-f8ee-4bef-a9c1-c06c33e20218", "comment": "Malware payload (Loki)", "value": "382d8d58ceaede166a20a6567ff852ed78439f274f5b3049f5c6b2d780327de4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637407458, "uuid": "c28ef717-91e2-4631-a527-f8e0285873da", "comment": "Malware payload (Loki)", "value": "0fb5f921380b1a942b462466e36879c52fe41603", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637407458, "uuid": "1eae2891-5ad0-4837-ad5c-96b2f46e7127", "comment": "Malware payload (Loki)", "value": "3dfb110439a4261ba29d96bd571ca53cb78ccca18476ddde604939388363074917fb31ee2fd60521eb47f08d8f25f9f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637407458, "uuid": "a4edd2da-d018-4ac1-be28-835a7664e130", "value": "T1456412013BE5D229C57D4F7BBD70001108B0FAA65959EA4B2E9176EE48CFBCB4641FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637407458, "uuid": "1ed5d6ef-2d2b-4c97-b4be-033eb666a3bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637407458, "uuid": "92e75662-d0c7-441f-9458-0f3a68ff3768", "value": "6144:nOKTvFbb0X9AE4J7G7wsC9w56hPfJlBRS31R4PGt2Xkbtb:OqvF816EwXTPPBRS3v4PGYU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637407458, "uuid": "d1ff8241-70eb-43e2-a68e-b66da296d93e", "value": 328192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637407458, "uuid": "8265c336-dbca-4f6e-9221-706d85824c96", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637407458, "uuid": "fdc9bce3-ddbd-4840-9fcd-39f209fca5e3", "value": "Olij Breeding Ethiopia Revised Proforma.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d38bed4e-4a1d-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1637425250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637425250, "uuid": "58a65931-ba91-4d5c-9eda-a56f9f88d27e", "comment": "Malware payload (RaccoonStealer)", "value": "183aeaff3cbbe4991d2211a59221943d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637425250, "uuid": "d8554e51-690f-4357-b26f-c670e89f1f1d", "comment": "Malware payload (RaccoonStealer)", "value": "3acfc103f563564c1375045c97504c574d574ba2574e2348302604274be86d59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637425250, "uuid": "53095688-21b2-49f1-a289-4bdd97be65f9", "comment": "Malware payload (RaccoonStealer)", "value": "b312cc8b070b6a6f588d1ad64a81a4e154efc28c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637425250, "uuid": "15352d8d-b78a-4e48-9a4f-bde041e1a343", "comment": "Malware payload (RaccoonStealer)", "value": "d4c8dba42107541e12740871f66bd3068da9447aa64af97f3c9e1a05a0815c7309f98ec5b4772a33915e2df4f74da73e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637425250, "uuid": "1c9b1ac7-ed1b-4555-b804-bde9bf65fd7c", "value": "T155648D10A7A1C434F5F312F8497693A8B93F7AA1AB6490CF53D516EE5634AE0EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637425250, "uuid": "64b47984-202f-43b1-9845-2241f1872ffa", "value": "bdaee7bf3d7f5fcbbe5fa5d59a50c909", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637425250, "uuid": "7a8e0d30-0573-424c-a3a2-a3d1d576f269", "value": "6144:qV6XDMZF3JASKdIt50bLkVGSvvU6YL4N3aCuYS:q4DEF5AtKgLkVGY8nEaCul", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637425250, "uuid": "93cefe0e-62b5-4a08-a022-dc43d0d44647", "value": 327680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637425250, "uuid": "f91267ef-c5ae-4f57-8ae5-f19996af9ff0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637425250, "uuid": "e8a86b1c-05f8-4168-991b-ac27bb4ff19e", "value": "183aeaff3cbbe4991d2211a59221943d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "984fd0de-49f4-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637407541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637407541, "uuid": "5d01dc84-bfd0-415a-8141-556889565540", "comment": "Malware payload (RedLineStealer)", "value": "11d0dc523d509b5e808c1451755ddf90", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637407541, "uuid": "09abc1b1-90b3-4030-9002-3586eb693f9d", "comment": "Malware payload (RedLineStealer)", "value": "3baf0e5663ee7ab469b386175342700c7fbfd55a19187de3009dc4334a5c2c7e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637407541, "uuid": "e8a2d11a-f03e-426f-b05b-ac577ca02d7b", "comment": "Malware payload (RedLineStealer)", "value": "e8dfaf65e695928b4aeb884546e68d4b6618ca3f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637407541, "uuid": "75a04788-8c9c-4150-966e-8d3e7101ba74", "comment": "Malware payload (RedLineStealer)", "value": "c3f51fb50e83f44e6c04a51bf500946b1f29e98c264c78fff1ca7eed62cd0c39fa6391633f99042c2a68161814dc511d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637407541, "uuid": "488b139e-d8b0-467f-b948-eee26ad2f991", "value": "T14564E05937A2F736D4A30B7068348B614AFFB87264F5818B7B60272D9EB07E04E61753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637407541, "uuid": "ce3a7569-de9c-4e96-8276-632e28777705", "value": "9f36e28e95ecac65660050c1a70ebbaa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637407541, "uuid": "e0e6eb72-cee9-420b-9988-9e95e31ca86f", "value": "6144:xhYP3HNP3SshKZp2m+MjpKqFXw/VLRAPt7/YG6I2pL:xhWXt3S5p2qfAe7gG6J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637407541, "uuid": "fa7ab3a6-e0a0-4f49-b77c-d70546f81a6e", "value": 314880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637407541, "uuid": "49045e57-0a82-4a69-902c-3ed3eda37a07", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637407541, "uuid": "cc4945db-47a9-4dc7-bc11-624cca856522", "value": "11d0dc523d509b5e808c1451755ddf90", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "365bc2b8-49e8-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637402223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637402223, "uuid": "a40b8e80-1a13-422b-b680-4e078f1d2e27", "comment": "Malware payload", "value": "2c175c596f60fca676e7c8e1a9c1e638", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637402223, "uuid": "7d625e9b-3b66-4d33-8cf7-c29f904f77c8", "comment": "Malware payload", "value": "3bc2a2aaf899ed766179252cf084f7bd40f1944c8a608d21527e9f6012cc5b8a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637402223, "uuid": "fd538599-b8d8-41fe-a887-3386fa87736a", "comment": "Malware payload", "value": "d0f95cb7f22b781ca25554fdbe35b3ce1b4bf189", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637402223, "uuid": "d1e55901-46fb-4666-9b8f-85ec1c141f2d", "comment": "Malware payload", "value": "9cd97f2cb8a41eae5dd2f9426af7925218722aa3636bb83b784186ece1eb653a1b9d133fe48e75fd1c29037630172a1c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637402223, "uuid": "f3c97619-faca-476f-9050-4dd3566c6ae9", "value": "T1DDD3A39C765072DFC86BC872DEA82C74EA6074BB530B9203A05716EDAE0D997CF151F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637402223, "uuid": "6fc66413-2d30-4df8-8507-ee1c9783603c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637402223, "uuid": "28ba17c4-c887-4ec8-9237-84d739108c78", "value": "3072:nJPmU/QjrGcm6Tdhlk+T8f2WhPbPdQ9l9Di9Szl16cZ4QF:d4+cm6TdTkw8f2WhPklpiSv6+1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637402223, "uuid": "508ccbf5-57be-413f-9143-296d2d40697c", "value": 142336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637402223, "uuid": "2a475766-5db9-4add-824c-39fe2d475c32", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637402223, "uuid": "3594a34b-4669-46ca-b6f3-b3a43123fb27", "value": "2c175c596f60fca676e7c8e1a9c1e638.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ac033e3-49de-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637398043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637398043, "uuid": "d36165cd-5d35-4d0b-ab80-fae517cba9aa", "comment": "Malware payload (Mirai)", "value": "7edbaefc8dfb3401df07d4c21c707ec1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637398043, "uuid": "1679754f-5080-4674-8559-85fd70efa799", "comment": "Malware payload (Mirai)", "value": "3fb2e5c9aa92fe28bdb398873790841d024889fa565c7956dbee47798b37c545", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637398043, "uuid": "1c8df563-eec8-46e0-8e1d-7104bc9f44b1", "comment": "Malware payload (Mirai)", "value": "0c8446e45a8299d978adf0ef68764c36524caf68", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637398043, "uuid": "0376fc75-9eaf-4b94-b1cd-75fcd4f91990", "comment": "Malware payload (Mirai)", "value": "ab00b4a7e695354e908d65ab36be8a8fa89c97d60894f0d0f97dc4151ea151237115f0bd15a0e64fa17f0380ccc3065a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637398043, "uuid": "6ced6eb8-5723-445f-8d36-7effa434d6c4", "value": "T19133F15802B5C471E9B06D73112408A65C17AAF8CDBF342A5A27DC98BDC36F731DA6C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637398043, "uuid": "50a9a234-1945-4fcb-bc02-8a8f9a2751a0", "value": "1536:5j/3kZTB21uJJ6aZpma9brpEaE//dpUmvHJfLD:2ZTksJ3+ad6aE//d2mpLD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637398043, "uuid": "c0bd973b-c63f-47f7-aa86-816c5e0a3a91", "value": 54876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637398043, "uuid": "08e305a5-80b1-43bc-adc5-832dd3835f23", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637398043, "uuid": "cbe4b1b7-157f-4f1e-8b11-19d6c0fb5742", "value": "7edbaefc8dfb3401df07d4c21c707ec1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8109a6a-4994-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637366417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637366417, "uuid": "adc17b74-0fd9-4c34-b474-c01f1d56927b", "comment": "Malware payload (Heodo)", "value": "ae07aa56daab4d356c2cb251d4663f78", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637366417, "uuid": "1355762e-7281-4900-991e-a577bc852c42", "comment": "Malware payload (Heodo)", "value": "40dc827785eb5dbeecc56381daa40ec5d818e17fd279e3e364238f0aeaba9f17", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637366417, "uuid": "03a4c96e-fe52-46ac-bfc6-66c3f676a0ba", "comment": "Malware payload (Heodo)", "value": "77b110ca206a386cff1f4ca0ad17c24ac705fa04", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637366417, "uuid": "3279662c-7a87-49bd-8f72-07db8c1af421", "comment": "Malware payload (Heodo)", "value": "90f462a1bb77795194a286a557c621e9c279479e12d3794f00a36c6d486f53b8006877fe073a45506e2abcf4f0c43ae2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637366417, "uuid": "98722cb9-891b-4569-8cdc-8415207de220", "value": "T125A4CF11B6C29432E1BE05303978DB5608AD7D318FB4CAEBB7D82B2D4E741C19B35A76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637366417, "uuid": "370234b3-6bef-4d7e-9a8b-741ac6afbbcd", "value": "d2a2f4c68a7903cc45764257f8ed7a2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637366417, "uuid": "d33ea3f4-790c-41cc-9c79-c01899e02dbd", "value": "12288:+AriSOG9c0jc5mDQxqfYR4iTQG8Ht3WZ6y1zTV3z1:vof4DQxMA4iTFUVWXpTVj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637366417, "uuid": "7f64bfa9-d58f-466d-ab8a-a2361d205374", "value": 481280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637366417, "uuid": "e2c08c09-5cf9-41f2-9479-ba1e65a9135a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637366417, "uuid": "555bbd64-b661-4391-bfb7-ce6a0593fcd0", "value": "emotet_exe_e5_40dc827785eb5dbeecc56381daa40ec5d818e17fd279e3e364238f0aeaba9f17_2021-11-20__000004.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9246a5b5-499a-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637368876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637368876, "uuid": "509d17b6-eafd-41be-9b01-393bc693e2f7", "comment": "Malware payload (AgentTesla)", "value": "ae03f8c072f643231e2f807a7215b695", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637368876, "uuid": "ced433be-52b8-470f-bd09-867e10303f99", "comment": "Malware payload (AgentTesla)", "value": "411f10cf8ff748052d265c438d60c922c11870c3adcaf5b2dfdf8516694e569c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637368876, "uuid": "952f9cac-c561-4993-bbb4-b83a21423eca", "comment": "Malware payload (AgentTesla)", "value": "bf7aa6b74c345d06b6c9071780e95e6ef1b578a6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637368876, "uuid": "43b70059-f67a-42a0-899e-68d7a7a8639e", "comment": "Malware payload (AgentTesla)", "value": "c8b5ce3eeef285b809064383e55df53318ccef2fd443bd6d0cedb0a0b310ae754f418c3c3321a1bbec0f9e850db088ef", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637368876, "uuid": "572db2ce-178c-4fce-a7df-1b641cdaab98", "value": "T188C4025037A85BD6EE798FF10AA2C49003B57E265AE5D22DBCC631CE5432B01AB41F77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637368876, "uuid": "066d6951-3517-4be4-a44b-2f6e8a3fcf46", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637368876, "uuid": "7aa24c34-180e-4676-b646-7cdeb8af3c9d", "value": "12288:4owDchtD009KL7p8JFTo386oNgKLhyoAabsv8LZAts+G6Bd6C:UchC06OJFA8nTIqszseoC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637368876, "uuid": "3ac1b176-24ed-45d5-a203-cbd91cd3f7f3", "value": 593408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637368876, "uuid": "1ac3e0fb-9523-4351-8e64-25f60d96dc6d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637368876, "uuid": "05afc474-e203-43e5-87e5-cd9be76205a6", "value": "orden de compra.pdf.r13.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5164474a-49e7-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1637401839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637401839, "uuid": "396e8f27-8652-4ca8-b6ba-aa7905f999c1", "comment": "Malware payload (RaccoonStealer)", "value": "c60ed5077878e0730a01451cb29c9de6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637401839, "uuid": "857f1a1b-42c9-418d-be3d-4929a3ca59bf", "comment": "Malware payload (RaccoonStealer)", "value": "42f71f7375ace133817bcdf3ed89a994cba9772fc7d9cb084cd78f4afb379026", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637401839, "uuid": "6545cba9-623c-4fe8-934a-aa28c8fc4bde", "comment": "Malware payload (RaccoonStealer)", "value": "8702c3246c3d5077bf48263ba3f135061d33bcb4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637401839, "uuid": "a8ca0946-ada4-46d1-8c44-28ce1d7c0355", "comment": "Malware payload (RaccoonStealer)", "value": "a3e9c0c4b5f4bc49853c72d109ec18ec148e7fd2e7598b64aa43df010e062df42d64420368077daa282a2a672fc05fb7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637401839, "uuid": "8a92e1e5-d47b-4759-9d50-5d1cf5e3c639", "value": "T130A4010037B29073E4E362385871D7694A7B3C325F38589BBBAC572D6E702E34A7174A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637401839, "uuid": "a87dbf9f-314a-45e0-874f-364ee64e58a8", "value": "afd7f49f71a4c196b8327a3d6c1e7f8d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637401839, "uuid": "02d07c2f-aa20-4c60-a8fd-1edc4ecb616f", "value": "6144:54XWDvL+jmV7N8A31QObsPe3pInkudcsy9NcDdsIGRMy0Yo6J:5KWbL/V7N8A3WObsC6nA9Ncpk2P6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637401839, "uuid": "776b9cd8-8b9d-4298-b490-06c90c0fd544", "value": 461312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637401839, "uuid": "c06e33fd-7b0c-4431-a8d2-c30b158b2460", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637401839, "uuid": "b5aa9785-4454-4730-a57b-5ec1e4633c4e", "value": "c60ed5077878e0730a01451cb29c9de6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "780da5da-49dd-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637397609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637397609, "uuid": "4a690e75-51c8-4b35-afc2-3a61b1594aa8", "comment": "Malware payload (Mirai)", "value": "4fab29a4705f2161d35bd0373e4beebd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637397609, "uuid": "38a46119-2640-4e3c-95bb-5e05321c83a4", "comment": "Malware payload (Mirai)", "value": "43e8007c7b62c81dae4d609c1e5e87975c8344dd08557460050dd74b22f3c747", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637397609, "uuid": "4dba000d-c47a-4915-b253-c0ff5f747c40", "comment": "Malware payload (Mirai)", "value": "6a3a2cf3178273a9e11e3ed6411bd06daf4e7cb1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637397609, "uuid": "9a27bd05-6f96-4ef2-b6b2-8c33a47ec174", "comment": "Malware payload (Mirai)", "value": "134fe1e0544faeae4bd6211d7d9483ce0f8208ee96b76d3f9d49993835e7cab96d7518348689ac0369f329a61ced12d8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637397609, "uuid": "156a4c2a-263c-4d20-9151-4b02ee3c6dc4", "value": "T1112302E08201B930CD794F794EC187407A542B7FAEAB742A833452FC7662E15D67BBD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637397609, "uuid": "dc4faee8-5f6e-4a7a-a2d6-a3cbb454c4ce", "value": "768:3PTrAuYC4Ut7wwfhcYIeXrGgkoJBSwrauyOgYfZDAK+/BVZUUMK+P3FKxUOpPxQu:3vn4Utwch5Gm70/6UL+P3FK6Qp1z1r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637397609, "uuid": "fa479242-f7e4-45af-b437-30a423aebf3f", "value": 48788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637397609, "uuid": "ae8295e4-1e9f-49c9-ae95-1c826abc2018", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637397609, "uuid": "36299304-e0fe-4341-a8da-3d44f116b652", "value": "4fab29a4705f2161d35bd0373e4beebd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d9a43a1-4a0b-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637417348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637417348, "uuid": "ad925ffe-85a2-41a9-a5bc-2eac0d89a25e", "comment": "Malware payload (RedLineStealer)", "value": "5f1186983c5d905824f4fcf56d1c7b64", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637417348, "uuid": "f867eab5-e924-4168-8c9c-f7f70e99ab86", "comment": "Malware payload (RedLineStealer)", "value": "451b570a7464fabe22a1e96f448f43915bd9bb391ebfe1678968e8e35d6d29bf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637417348, "uuid": "bc526e7e-5360-4d75-b0e8-8ccd2c42069d", "comment": "Malware payload (RedLineStealer)", "value": "9182a08a44dc552a2938b69844e12fc0d7361cbc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637417348, "uuid": "0f6609f2-454c-4f34-b6fb-e039d04be452", "comment": "Malware payload (RedLineStealer)", "value": "d173bba09451e497ea845861b4ad7f19183afc6323b6cd60604e9ad2c4568c282f6becf7d1a0f559f78f995fd6efedbc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637417348, "uuid": "71bd41db-070c-48ed-abcb-c42c3c052b61", "value": "T1CE940FFB2DC29690C9453B7686A3B7048FED21F543274BCC5B08ABE34E8D5227F45698", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637417348, "uuid": "994d96b6-f980-486c-b6da-b6e0a41ef256", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637417348, "uuid": "bba06fe6-40f6-446c-b636-bec99ef15c1a", "value": "6144:KejvO7u8Rw67wZnHkVD8kRhWtIRDH6A3qHT9X0KN1aJpMfT:rjvKH6PH+/DHk/1aJpa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637417348, "uuid": "73d45265-466a-4b6a-a8ac-9460bb3e587b", "value": 416664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637417348, "uuid": "b78ba018-1da7-415f-b7f0-23d96bd73a1d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637417348, "uuid": "e98cf224-b490-45fc-96aa-7e4c85e514fa", "value": "5f1186983c5d905824f4fcf56d1c7b64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3c180b0-4a27-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1637429465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637429465, "uuid": "28a9d580-4eaf-43b8-aa82-a8ecf852d992", "comment": "Malware payload (NanoCore)", "value": "0ff6a252fccfc67fc16d49f9864392f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637429465, "uuid": "171f4ef3-66f2-41c6-977d-df2394eb906d", "comment": "Malware payload (NanoCore)", "value": "464deab7844ff2368027762949bb0464a22939afbb0018376c3be0117c713d79", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637429465, "uuid": "160d2b0c-2c50-4f0e-8103-4e1219815ff0", "comment": "Malware payload (NanoCore)", "value": "13d516cd05e304320fbebdfb4705944ccc96e099", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637429465, "uuid": "c4f241ba-c1cf-43e3-89ad-7b817fdb4b84", "comment": "Malware payload (NanoCore)", "value": "f99e777630da917875d065e998c2d7d2d49ab88a29c12511fc366e17695935d6d6a3d5e6e3350cb1e9fdc8f47842553e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637429465, "uuid": "71f262a8-8588-47db-8fba-8947ee021596", "value": "T14EB4E102BAD188B2D9731D3256296B256D7D7D201E25DE6FB3D82D6DDE301C0A234BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637429465, "uuid": "afc0befa-a837-4882-93ee-925e6d2076e8", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637429465, "uuid": "48b90cad-8495-4a57-8932-b69501341c0e", "value": "12288:5Qnk3GDYKGcblwtX+t4Y8dycZ5KF1/are88+:zAOcZwXY2yKKz/qe88+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637429465, "uuid": "2f6b36aa-1368-43b9-a7fc-9dee6ddc36ea", "value": 495864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637429465, "uuid": "24a9f836-746e-4383-ae4f-3f9266b16a2e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637429465, "uuid": "46a70532-a883-4cf5-82e3-180506230e5c", "value": "750845PaymentReceipt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f60b060-49cf-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1637391581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637391581, "uuid": "f74faec7-59f2-4a00-a9e3-59543c84e188", "comment": "Malware payload (Gafgyt)", "value": "b5af6aabd27fcad6fe6db6dda7d29631", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637391581, "uuid": "764c2b74-4a73-4cb9-aa8e-4efed5f1beab", "comment": "Malware payload (Gafgyt)", "value": "46ddac8d35ba120b36bf677dbd54168a8d45432798790d5587d0130ef87dd7d6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637391581, "uuid": "61f3674d-0e26-43e1-88ce-f4469e0fb8e4", "comment": "Malware payload (Gafgyt)", "value": "c9785f01505727fa4799c672b89e0fe909096d43", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637391581, "uuid": "c4fbb35c-d7cf-4515-9744-77f8b1260a8d", "comment": "Malware payload (Gafgyt)", "value": "70cec4befa43427ef491e5a2b0031a343fbd0349c69e05e175f1b49bcd89e6695ac272ebb24ee9e2e2dcbdd986c43130", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637391581, "uuid": "139a3bd6-902a-4a77-a8d7-b47e365fd146", "value": "T102B31845F8408727C3D327BAE78F479D3B36579467DB33116A38BEB42BC17892A29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637391581, "uuid": "01883577-9655-4316-829b-6dfc36a7084a", "value": "3072:MSY+46m1qOzss5FPPKNy+AmkZrQAhPDCXFke:06mgOzJ5FPzmkZrQAhPDCXFke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637391581, "uuid": "7c732b91-13a1-4413-b612-723a7d4f90d6", "value": 108417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637391581, "uuid": "19341644-5543-46aa-a795-f8430b22a6d6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637391581, "uuid": "06bd0565-62f6-41a1-9cc7-6e6de44cc992", "value": "b5af6aabd27fcad6fe6db6dda7d29631", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c1b972d-49cf-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1637391603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637391603, "uuid": "a89662af-1880-473c-9bea-6e2c3320814a", "comment": "Malware payload (Gafgyt)", "value": "5430cd9b637646aa05561ed2c72612cb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637391603, "uuid": "df4c876e-a844-436d-bb81-c264fb605826", "comment": "Malware payload (Gafgyt)", "value": "474a49f87ad0e1a6baec1c0fc289b582d423e573eaf64e70a4e90bf2d204faed", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637391603, "uuid": "bd617910-588f-48d0-becc-9be79de53fc9", "comment": "Malware payload (Gafgyt)", "value": "653d8c7240e57214b98fc78d03cfc8e3c8e9629c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637391603, "uuid": "0690caa6-a682-4ce0-896e-10a50eaafb83", "comment": "Malware payload (Gafgyt)", "value": "2b0d337220ccaa575610da01e907a160b30634b299c75e168595d8794cb693bd572f6e03c4720eef0e25537ae64fee1f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637391603, "uuid": "b23a9cf2-4c6f-46b1-8bd1-c93d6a1733cb", "value": "T1B6C39417BB618FB7D81FDE33059A8902108DE58A12D96F6BB2B4C92CE74B94F08D3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637391603, "uuid": "35d48fd2-4d6e-4ced-8d7c-49bdd21c9b2c", "value": "1536:/UHeTxCAms/Y8Zm3lKYA43gMJwSkJ8Epo+DzUh8rmW+IFB1Df11hR/:/UyLqAmgMJM8E2+Dw8rmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637391603, "uuid": "3893c2f2-1c64-4c8c-99e3-843982b78e74", "value": 126042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637391603, "uuid": "91ecbef0-b508-4752-95ff-7d849b360cd1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637391603, "uuid": "0dc5a977-ffd9-4abd-ac9f-39adddfdfe83", "value": "5430cd9b637646aa05561ed2c72612cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a6efb50-49e7-11ec-843c-42010a9c0014", "comment": "Malware payload (BitRAT)", "timestamp": 1637401881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637401881, "uuid": "41822f1c-b30a-4d25-aee2-a6d0b964c27a", "comment": "Malware payload (BitRAT)", "value": "35b7f76a7ed775b9b0f851bdc10e75a7", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637401881, "uuid": "15863d87-c2c9-462d-b0d9-c94ace36469e", "comment": "Malware payload (BitRAT)", "value": "482fcdb4d60ba6efdfedec28d5a9f6b026fb21cec672d1a9adfdcc20d9542e9d", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637401881, "uuid": "e2ebb27f-e1f8-4915-afcb-3d48d926a6e4", "comment": "Malware payload (BitRAT)", "value": "41a3b0f4814239903fe1b895bb796f4001e21b4b", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637401881, "uuid": "6e7b9f35-77e9-4d83-aba4-790bde2030c0", "comment": "Malware payload (BitRAT)", "value": "84c66cfdce1833f994d62c12d19b2f3698594b02c67fe98d23dbd520fc625228a09e6c54b9d4be8e4b2a2932a8e69942", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637401881, "uuid": "6d342ca5-36bc-497e-a582-b94be81a1631", "value": "T141B5335413E14C87EED75AB82BB1A201D7BD90B709C9E3DE0A86917AE88F3151F5C327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637401881, "uuid": "ce8ce53f-44e6-49f0-9e4f-cb9b86dd7a27", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637401881, "uuid": "25e2fd66-5d58-43d6-9b51-ccb7d05aeaaf", "value": "49152:pJxKAR8yCW9pyJIuEVF7kLgRBG6IiZKOMZjxmexKndAV:53hpWEVFhBG61KPKndA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637401881, "uuid": "6feefbc5-0e13-453a-a8a7-b63df3613c4b", "value": 2321920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637401881, "uuid": "9acae5f3-73c9-41ad-a6a0-8df3a88a3dfb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637401881, "uuid": "9406e9cb-e79f-4f26-8441-206a39d28a34", "value": "35b7f76a7ed775b9b0f851bdc10e75a7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e88d2a2-4a24-11ec-843c-42010a9c0014", "comment": "Malware payload (TrickBot)", "timestamp": 1637428114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637428114, "uuid": "b237d57f-e771-4f41-9104-e9a606bc027a", "comment": "Malware payload (TrickBot)", "value": "c943e46ad3c645b2a378169a2f1a201a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637428114, "uuid": "2443a9e9-0d7a-42a3-91b4-7fa0445564f1", "comment": "Malware payload (TrickBot)", "value": "487178988d7c3bebc34fe2c40f1b19cd8f89f2753d552a19c4fe5da82f22d828", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637428114, "uuid": "7698c43a-1054-4833-ac54-22a4908490dc", "comment": "Malware payload (TrickBot)", "value": "2b8eeb2b2dc8d577cebbff56051762720fbf1b56", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637428114, "uuid": "7acf1caa-fe82-4bb5-b323-1ca6af9c793e", "comment": "Malware payload (TrickBot)", "value": "16573a577188451fe1fc5ff215b500c5c9f915d374f703d6f00c1a099bd1c5ca50ab499a730c2b0c45ccb4aaf0cc85db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637428114, "uuid": "cf4b1a83-1c6d-4391-834e-a7ac7766cc11", "value": "T18555DF737CAC475DC8901B73CD83E27116AE2E5B5AF2C14A50F66F878BF01989016F9A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637428114, "uuid": "467a576c-afbe-4d32-bde0-5a82aeda654c", "value": "bc70c4fa605f17c85050b7c7b6d42e44", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637428114, "uuid": "27d7c959-578a-41f2-9f7a-334c7a822899", "value": "24576:OQLny3OiG7O5fWcmCM4jBg0nWDqVXF1/Vz897cDH6WboJVIb90I6Rgex:OQLy3Z5ecmCMqhnllLNgIHjbiIb9xS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637428114, "uuid": "9ac31514-565e-4c43-a3ec-40c4b67d133a", "value": 1374274, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637428114, "uuid": "ae9e5eba-5db1-45cf-90df-e88393fea83f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637428114, "uuid": "4cb67173-bfac-4213-82a0-c0c706fba19e", "value": "c943e46ad3c645b2a378169a2f1a201a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7702540b-4a29-11ec-843c-42010a9c0014", "comment": "Malware payload (Vjw0rm)", "timestamp": 1637430249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637430249, "uuid": "215ae6f7-41b0-4d40-ae39-f4eaba404a47", "comment": "Malware payload (Vjw0rm)", "value": "b8eeebd6aa11e3078e1b304c85a6e896", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637430249, "uuid": "58f7b6ca-b279-4131-96d9-cec204bcd729", "comment": "Malware payload (Vjw0rm)", "value": "4e9a08df90d54980a821d9c8cf3ba6e3049320244cd97b5060a33b64eec98ede", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637430249, "uuid": "2f5f6f49-4c10-4fe7-bf8c-883021144d97", "comment": "Malware payload (Vjw0rm)", "value": "c1c765ac3ed42055cabe1df71164ec83cf9042a1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637430249, "uuid": "332e209c-e687-4a9e-98c0-07e3f6dfc6f0", "comment": "Malware payload (Vjw0rm)", "value": "26734396962ab6d26d740c9e69ca152ea0b5fbb597bf56a4ca6908fdf14ca42c6aad0ee96f7c15aaf88aea47800cec46", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637430249, "uuid": "aae6dc67-3565-4bdd-9a38-2f79ea308259", "value": "T1D0B3FBFDF1055F22D352651C88DE0A1873B3E762F5E9CF41466C6A09C1EE82B538AEC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637430249, "uuid": "990cba87-eb68-4b22-b573-862d4dc13007", "value": "384:UTJiBGGMzSb0sLWWAKRoeIYroebmioesg:R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637430249, "uuid": "ffcd9db6-e8a3-4a29-b462-8865013e4476", "value": 108710, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637430249, "uuid": "de32124f-49de-4e0d-8696-2bcfb4d27a72", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637430249, "uuid": "a6d0a7e7-5335-4092-8de5-b4e2a79262a6", "value": "Product_Inquiry.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2a7a498-4a35-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637435556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637435556, "uuid": "625a5684-bbaf-4990-bf49-e1554a814c92", "comment": "Malware payload (Heodo)", "value": "3871adbf62f849a4466ddf056a1e8ae5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637435556, "uuid": "fe29f1b8-6a8d-422e-9622-e84e44aab54e", "comment": "Malware payload (Heodo)", "value": "4fcf00b29cf5bd4354687ee1d52056abbf58cf7b666c90e7ba2d5a72d7a3debd", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637435556, "uuid": "84d2a5e1-51fa-42ae-951f-417bbd9d1a29", "comment": "Malware payload (Heodo)", "value": "cb4d7d04afb43e5ccbcb83c493eab7f521b6203d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637435556, "uuid": "c383b35c-32de-45dc-841c-778eeb5ac3ef", "comment": "Malware payload (Heodo)", "value": "46a2721cdfa68f18c31ae0772effb403b3f66a2ea1e69d36c83c3f83737726e41b3853aa845d7af787807ed81edf6ca4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637435556, "uuid": "ff40e3d7-add9-4c77-9350-737c4e5fba18", "value": "T1E6A4CF11B6C29432E1BE05303978DB5608AD7D318FB4CAEBB7D82B2D4E741C19B35A76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637435556, "uuid": "5c2e9135-dd02-4e7d-b579-861ba314a74d", "value": "d2a2f4c68a7903cc45764257f8ed7a2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637435556, "uuid": "ecd63a05-0589-4c9a-95ad-44e0d6bb48ed", "value": "12288:+AriSOG9c0jc5mDQxqfvR4iTQG8Ht3WZ6y1zTV3z1:vof4DQxM54iTFUVWXpTVj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637435556, "uuid": "c2aa3217-9590-4b96-9249-3726d06a21e4", "value": 481280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637435556, "uuid": "b63b9799-3f99-4cd3-8885-09169818a4cf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637435556, "uuid": "d9629966-77a6-446a-8517-01ea37074ccc", "value": "3871adbf62f849a4466ddf056a1e8ae5.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bbe438c-49e7-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637401749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637401749, "uuid": "5cfeeb46-2ef9-4a1e-9287-1efdab7932c1", "comment": "Malware payload (Formbook)", "value": "c94c57f7093fbee0ff383406b0eddbb5", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637401749, "uuid": "42b444fe-79b6-4625-a7db-d3c3bea34e7e", "comment": "Malware payload (Formbook)", "value": "536cf2655cd38ee185fa13a7ca047e17fdacf8fa46264e44167899ef2f2fdd6c", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637401749, "uuid": "84da1a8c-bb48-4b91-bae4-5094cd67a656", "comment": "Malware payload (Formbook)", "value": "45c9eceb0d9f99209ca5594618b21077e39b9026", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637401749, "uuid": "f6e0650b-79f4-430b-b715-a9c361db30cc", "comment": "Malware payload (Formbook)", "value": "8d2c1229ea5b7107be1df12fb513c3fe6883ee64fe989e63357ccb28b1959775ebda2bbc0f0d977e8c8647aaa510a5bc", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637401749, "uuid": "3e5de9a6-7af9-4f4a-9f48-f8b424e963fe", "value": "T1437284BCC49702988F859BB8672B5F54118DB62DF784953372BCA33127E1E7A901383C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637401749, "uuid": "d87ed3a1-dc0b-4880-88c8-5ef5064b1a5a", "value": "384:jKAhP0USLZKKOA3cOjNiEGlsEUCeYJFrCf0vPeSW+sp/leqZMaH/D:OAhP5UKe3cQineEtCfmPTsp/3Zh/D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637401749, "uuid": "1b6f39fd-c14c-48f3-8dc4-93f028feb569", "value": 16435, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637401749, "uuid": "aad296b9-ecba-458a-afe2-3eb97e5852a1", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637401749, "uuid": "1306c67a-d4e0-413f-899d-94bb95b288df", "value": "Order Speficications.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5ebd5e1-49ae-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1637377499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637377499, "uuid": "dd90778a-f016-4ccf-b159-0b6c99eff1a4", "comment": "Malware payload (Gafgyt)", "value": "da36c9558e3c1e0bf17a01c12b136cb4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637377499, "uuid": "6894ed7a-3494-4b0f-b42d-b6e161f6c6b0", "comment": "Malware payload (Gafgyt)", "value": "53c295252f11b81bd2a4bd78a49500671cec499a2ddbc56e99a77d385ae146a3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637377499, "uuid": "6aafe818-9024-49a4-9a1a-e7aa6afbd545", "comment": "Malware payload (Gafgyt)", "value": "fbab01a70d5723fd3ea61e9e37a476306cd92b1e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637377499, "uuid": "548467f4-871e-4c39-a68a-97e387c8da88", "comment": "Malware payload (Gafgyt)", "value": "f6314dc3d2954b52d45b1cc22ae13f1c11a307cd19cc63053f72cd649a31c911cb6c31f940fba0846d5244deccfa12b3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637377499, "uuid": "44e6ed3f-9ac8-4a27-88ae-d35b22d37758", "value": "T1A7735C466280D6F7D18316F1069BAFA8033AFD3A1ABBEE45F3587CF48B710847925719", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637377499, "uuid": "95862401-52b1-4e55-82fc-81c9c138449c", "value": "1536:8r4owQ6yastO49zyje4MkJLwDnOD8J52rf3BstzWT/O/sCw2I59RLZ5:8r96R+x9zyje4MkJLwDnOD8mrfRSzO/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637377499, "uuid": "e5e416c5-f212-4081-bc80-188a098747b6", "value": 74492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637377499, "uuid": "4acac78a-6dfc-473e-bf3f-111c1abeda52", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637377499, "uuid": "a9a11d3e-482b-4ca2-8c9c-6196bd627f9a", "value": "da36c9558e3c1e0bf17a01c12b136cb4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dde60f5-49dd-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637397592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637397592, "uuid": "ef74cab0-68c4-4e5a-9c2e-a1a90bbb1f4e", "comment": "Malware payload (Mirai)", "value": "cfe52e9067b6e20191e256eb07541393", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637397592, "uuid": "584d878a-619d-4149-bd32-2b9d3dcd3ee0", "comment": "Malware payload (Mirai)", "value": "54c10589350bd0b680fdc4e3a53bbc5beb9c6c3afd073a9ee96d4aea6c278c72", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637397592, "uuid": "78b8960c-6880-46f2-8fa1-753e0bac72ad", "comment": "Malware payload (Mirai)", "value": "7cffb612ddaaab23aa770db1f4f61299e7afc352", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637397592, "uuid": "f167197f-782a-4621-b00d-cacb6c76ca7b", "comment": "Malware payload (Mirai)", "value": "0e817b062cd1ce474814e816cd8862f63c76b65f3d37ee57f5f17bb6ef9bd9b13c7fbb06550732322f00f069dafaf0fc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637397592, "uuid": "9bb9ccf5-6457-4f0c-acae-f1396962ee2f", "value": "T1CFE37D63AE974827D0A8723E42FB8334F0D32B0870389F5E7D530D49AB387956A67365", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637397592, "uuid": "84a6f8df-03ad-4017-8ed9-cf0a3e3f0758", "value": "3072:HF1S2TDhOSx0jzWkWjlDIUo/707a4zouasSJtrTtfrlgNvHy6zwupHNPEjmzgvTi:zkWjlDIUo/707lzouasSJtrTtfrlKvyg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637397592, "uuid": "be6bbb04-38c0-42dd-8979-f9ef2fbad696", "value": 152608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637397592, "uuid": "a961bbe7-54b6-4a60-8237-ad0a81999d12", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637397592, "uuid": "8319cc08-bf71-4beb-bfc2-48e893ff30ce", "value": "cfe52e9067b6e20191e256eb07541393", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ba58e30-4995-11ec-843c-42010a9c0014", "comment": "Malware payload (RemoteManipulator)", "timestamp": 1637366503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637366503, "uuid": "32795e66-62a0-4145-8234-2e3755061ddb", "comment": "Malware payload (RemoteManipulator)", "value": "7825beab377e9a88cd97cf5d2ccbf81b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637366503, "uuid": "6ed2a99a-022f-4162-81af-2872b3cf6409", "comment": "Malware payload (RemoteManipulator)", "value": "56cec810fc6f445e17a04306b653bb3296b55fe481b518c9aca4b1ef69824a3e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637366503, "uuid": "26825c14-1cdb-4543-af14-83221cc2030e", "comment": "Malware payload (RemoteManipulator)", "value": "fbaa432a4ce17068a6af7b79134d9004f569e162", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637366503, "uuid": "7a805946-98de-4d62-9a3e-b2abb1bb46bb", "comment": "Malware payload (RemoteManipulator)", "value": "652dc27356fa1161d6a2a77871cbd6469da7e2e88e96ebf9ebfca3995be493f0b99eada9ae1dc65016f0f52e1f578933", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637366503, "uuid": "07d1bb63-200e-4c40-a8b8-bd350135df96", "value": "T197F63357F3E54815D8FB87BE4DBE4B20032EBC985A035B8D43B9B1294CBA34199653CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637366503, "uuid": "9477b99f-f05c-422c-8d97-03b3b48f4ac2", "value": "19b321cb7a9ce31c90397152f38b67ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637366503, "uuid": "eb061392-49f6-424d-9ab0-0fd434c2795a", "value": "393216:AefskPilMQ8HGDrNnx0Q49ysLso6aa6NR42nj6c:rfbM8HqP4vNHaGnX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637366503, "uuid": "231ea899-35b7-4041-9480-0a211fc1ab0e", "value": 16160432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637366503, "uuid": "472367fd-21ed-4b2e-a330-77f8eb7e7cdd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637366503, "uuid": "4f4877ea-d6c0-49be-b029-a9c6f14c2413", "value": "56CEC810FC6F445E17A04306B653BB3296B55FE481B51.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08227e48-49d9-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637395703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637395703, "uuid": "1fbd5000-b81c-41a9-a9f1-28927d4f8180", "comment": "Malware payload (Formbook)", "value": "250347536c0f798fa8f9d21399a8762e", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637395703, "uuid": "dd9297b8-2f96-4363-be91-ac9902c771de", "comment": "Malware payload (Formbook)", "value": "58dbc1d3aa2985f91ef6cc60c5d64d9e47c2f3cd2c3b1c81da69ae938fe98bc5", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637395703, "uuid": "914bc0db-d0ea-4b05-a0b5-424eeecdba48", "comment": "Malware payload (Formbook)", "value": "edf378b151affbe5cab646b606176b6686e4551e", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637395703, "uuid": "17d61253-041c-4a1f-93df-a4a8681cefcc", "comment": "Malware payload (Formbook)", "value": "6f82e6137581dd608d1201ba9609258cc8e3b65a98dc449665ec4388455f686ea4a3b38a3bd7cf1b393ac635cf16c3ee", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637395703, "uuid": "33ad3ba0-797f-4167-b724-351d294ce10b", "value": "T1995251ACD58706988F86A7B86B1B2F45018C762DF389A533367867796BD1C7B4027C3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637395703, "uuid": "224b431e-0704-45cf-a08e-0edcaf21f394", "value": "384:NhFbIy/ecfd6H/rkBVZgcPuVlETBdzi2Pj4kVnDYtgJXi:NhFxMHTsmc9WUFVsyi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637395703, "uuid": "ee451785-833f-4608-893c-66d3319ca0bb", "value": 13536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637395703, "uuid": "2fa0e44a-e181-4002-8d30-79a4e427b3f4", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637395703, "uuid": "de6c07ee-4788-4876-ad30-50fc04180471", "value": "SCANNED DOCUMENT.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "662d9912-4a20-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637426355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637426355, "uuid": "65aa128a-2371-4026-bede-de65cbf9386b", "comment": "Malware payload (Heodo)", "value": "47bd1aa0c5609d40fa979ecb7b82a1fa", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637426355, "uuid": "b3f7d914-ee00-4457-95b9-93e1f3911d4a", "comment": "Malware payload (Heodo)", "value": "59254e8ec001f88c9d879c7721993c1bd6671a61b543ab39d2485f5e62b5fa6d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637426355, "uuid": "faf689eb-f4f0-43d7-bb3d-c10dfab6987d", "comment": "Malware payload (Heodo)", "value": "890e4ff6d9a58bfc64493263d1c00c57a5fd05e0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637426355, "uuid": "49af5a02-a1c0-466b-a8ae-1e414dd6cfe3", "comment": "Malware payload (Heodo)", "value": "300dc0c613d721f1d5f219d12ca7b27ecd32823f53a100a5e387c7b6b5edb67596b6d381ee7ce1bcacf10d14cea1d37f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637426355, "uuid": "00999b32-b89e-4941-94df-d1f1a827614e", "value": "T175634A10F3C341F3CC970CF625BAA62E9F7D2E037024EF9657984B576EB1605A2A990D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637426355, "uuid": "6660716b-cc94-4fff-b265-a1eb9ae9bf77", "value": "1536:TN1A7oazifsULKrgcencN0fUQ3dxAXVoyfsXwxwO+:TNG7obfsUGM7uGQVmwxwO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637426355, "uuid": "4ad9fc34-56ad-4ee2-9fa0-e3bbcf6c57fa", "value": 67584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637426355, "uuid": "057824f3-4551-45eb-891a-d850e2649e8c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637426355, "uuid": "bab8d28f-5494-4b5a-b9bb-08bcb259d825", "value": "47bd1aa0c5609d40fa979ecb7b82a1fa.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e42f82b-4a37-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637436274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637436274, "uuid": "5bd046f2-9e3b-45ac-b43d-e94f0ad00dcc", "comment": "Malware payload", "value": "5f2f844a081eede8aca4fdd7790a8908", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637436274, "uuid": "440a1ae2-ebc3-49d4-a113-6304fa79d3fa", "comment": "Malware payload", "value": "599b43dcb8a058249baa58e25eba17d1efdc24b7e82d07353923f2c4d718f540", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637436274, "uuid": "12ded53b-0699-4766-9650-663ccb3e7926", "comment": "Malware payload", "value": "ed3dc1e0ff51e622a528eb79ac10a7cb9be2dd5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637436274, "uuid": "61c766b8-de50-4059-9dff-1182e3a3e22a", "comment": "Malware payload", "value": "0a771a65c9febbb2e4e3418c847ba17b82e4d6c5fc3f90088c381dd052e1d11976f52ea19e4cd48bcd972824b6871b87", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637436274, "uuid": "8cfbfb1d-20d2-44e8-8a87-0a349b5de79f", "value": "T188549D2537B85F13C5BE83F8D129510C0BF5B659A1ABF70E1CC3B4DB6D62B804A86A43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637436274, "uuid": "ff8b0c1c-ca82-4d24-8c81-ab3747681c4f", "value": "6144:o1E6SQIMC25XrSYVvfHMF0XSDKXhCml8SkzOZCUEfBGptCcB+8:oXvfnhCcfZ/2Yp4y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637436274, "uuid": "513a19b6-e78d-4336-b0c1-ae0928c86f00", "value": 299406, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637436274, "uuid": "fc3fd1ae-3cad-4266-8c21-a60610532934", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637436274, "uuid": "afcbf9e2-bc75-404e-9029-a8a1033a1f58", "value": "5f2f844a081eede8aca4fdd7790a8908.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52bdb61b-49e6-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637401412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637401412, "uuid": "41bb5a40-9cd1-46d1-9ec6-c2ec7a72aaa5", "comment": "Malware payload (Formbook)", "value": "1157463e1449cd20749ce082521ca472", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637401412, "uuid": "4a19cd25-0a26-4f99-8791-7c10ae2ba919", "comment": "Malware payload (Formbook)", "value": "5a2d98fb6f9e09f3cd49a863aa1290935ef1c5d714aa3beede7ca587f147f281", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637401412, "uuid": "9ca5182c-d09b-43a8-923f-8b967800e093", "comment": "Malware payload (Formbook)", "value": "32b359c8bb8d5e2df92a5b6eaf4e8dae8de5e2a1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637401412, "uuid": "1411b436-4398-4d87-8d60-ebab93bf3b6a", "comment": "Malware payload (Formbook)", "value": "99b797b5d4357eddcc9f16191949eb9a5704d8167fe3067e793a0db251356352b1d8400a179583b1e51bfc98398ccfc2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637401412, "uuid": "5f82ba52-221c-4d28-942a-18933ca72b0f", "value": "T17CC4127EBA98D837D7C4D9742836C47EA7B27080E1B843A73708BDED5E646F4350198A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637401412, "uuid": "abb3e8b3-b7fd-40b0-bd89-444f0f70c30a", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637401412, "uuid": "af6c031c-040a-44db-880c-0adc0aafc063", "value": "12288:s2N5TXwj452kxN+u40IK8QQPM9Wzrnl2A5Yt0hwC:L5xNU0sgoHlx5Ys", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637401412, "uuid": "7f976dd3-9f64-4c25-9e92-0c71306b8431", "value": 597044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637401412, "uuid": "cb965094-a382-400c-8c08-fe8382ac3d51", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637401412, "uuid": "0fb64a21-9518-4cc7-9145-56b73d996f68", "value": "1157463e1449cd20749ce082521ca472", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb352648-49a5-11ec-843c-42010a9c0014", "comment": "Malware payload (Pony)", "timestamp": 1637373696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637373696, "uuid": "a0450d34-4db9-471c-8d8c-5557b2a279be", "comment": "Malware payload (Pony)", "value": "9bb6bad7ac4f121e6faa71e28b22c5d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637373696, "uuid": "7e1f8645-001a-4b08-b7f2-80edb40aa8c1", "comment": "Malware payload (Pony)", "value": "5fe98959812226a5a14c763862049f5b386f31c4db31424af1d7f9494a79619c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637373696, "uuid": "592de398-fce7-47ad-bd36-06aa7fa7b037", "comment": "Malware payload (Pony)", "value": "a32ac43449a79de7d46abe61738b9d195143a62c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637373696, "uuid": "a44b72b1-f19f-42f6-a744-223d6fbb558a", "comment": "Malware payload (Pony)", "value": "50d1700973dc45e4b8b80be61b74c354778a500bfbe8c4ecbd3f0615222bd1e513523bcf6ae5ce46fc140a7b1bc6f081", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637373696, "uuid": "4d70e449-745b-450c-a68f-09d9f0abcaeb", "value": "T18A04DFE0342ECDB5C6BD24358E138CE85504BC649518B90E76D83FBE15B8AF4A62BF1C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637373696, "uuid": "b9eb3c02-2dce-4189-8d19-f0dfbde3e00a", "value": "2efaa208a190a71a1febe2c3537d02a1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637373696, "uuid": "148eea27-199a-4127-b650-acf795513d39", "value": "3072:PrViHw0s+cxLhox+ovlazgyFKtSuQk12o8713zQpdN7:Px8bxkh3od6gltFQk12o871D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637373696, "uuid": "be6c3117-ae87-4d1e-96bb-01195752c576", "value": 188416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637373696, "uuid": "194604a6-30c3-4b83-94dd-5e65dd7291be", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637373696, "uuid": "f1545582-fb4c-401e-9096-e69f146d52c5", "value": "5FE98959812226A5A14C763862049F5B386F31C4DB314.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d858ae4-4a37-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637436273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637436273, "uuid": "d05fb04c-598f-4b9f-9208-22f1e3a0b212", "comment": "Malware payload", "value": "60aeee3e1751405cac8106c344fbbf92", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637436273, "uuid": "14aecee0-ca4e-4ba0-a7c9-b361994ee3c5", "comment": "Malware payload", "value": "6430983f4fdfba78f4a13af4c3fb021301d0b375945699c1969d783248a66ebd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637436273, "uuid": "c8a750f6-e678-4910-a0db-5b9297f8bc91", "comment": "Malware payload", "value": "1dea34e8a8f1501274d84e8f08c374bf5c330873", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637436273, "uuid": "5b99174f-315d-4869-a78f-8be74c8ffcf4", "comment": "Malware payload", "value": "5e8da88d0cfce73449d8770859c7501f2bce7975b89ba63397f8e0196bd097cb514ec27477b873d37ba07f054a9bb5fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637436273, "uuid": "1c34118f-7c0c-48ad-a087-073e0ba3e8f9", "value": "T186749D00A7A1C035F5B316F849B5A3A9B93F7AA1AB2894CF53D516EE46346E0EC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637436273, "uuid": "e0652800-7cf8-4ab8-a1e4-052cd9436c4c", "value": "bdaee7bf3d7f5fcbbe5fa5d59a50c909", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637436273, "uuid": "a1131b50-061e-4dff-a732-3efa506b0c93", "value": "6144:mmiVVBCH6M4/2hZNVZLtBvwVxKYtovB5WosQo:mNkHK/2hZdtB4LJc5WoZo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637436273, "uuid": "fae1c46c-8937-44c4-a1c8-e4cceee6c950", "value": 342528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637436273, "uuid": "bcef4825-1eef-4add-9b5f-6aad4b2bfa42", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637436273, "uuid": "72ff387a-06b7-492b-ad31-156c5c06279b", "value": "60aeee3e1751405cac8106c344fbbf92.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76a678b4-49af-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1637377850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637377850, "uuid": "8fec137d-bc80-4b3c-bd35-89b7fc6e3755", "comment": "Malware payload (Gafgyt)", "value": "45944655675bf514458f07f733daded2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637377850, "uuid": "42706848-a2cc-4c22-92ea-ebc931679f33", "comment": "Malware payload (Gafgyt)", "value": "68ec4a4df37c1596877df0f28d555d722ac0d27b6f7ffead60d73a9378714537", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637377850, "uuid": "8594130f-0deb-453e-8fe1-250b394fb640", "comment": "Malware payload (Gafgyt)", "value": "9909f92a36a0e566ce2a6f1401b245b968bf3269", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637377850, "uuid": "abdb8e7e-e44b-4138-80f3-35f858b9c42a", "comment": "Malware payload (Gafgyt)", "value": "0948da2e1fd4cf05d88cd47fa9d1f7677d86b7e4656928d8e56f51f98c29ffc068bae86042bc5998435a1259c7aba4bb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637377850, "uuid": "ff0a4e13-dd57-4020-93af-b9ecdd48e31f", "value": "T1A2B3F805D9905737C2D23BBEF79A82CE73221F98979733118A287AF41BE5B9D1D39120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637377850, "uuid": "e7174145-c770-4e2e-bf9d-d74be44c8dfa", "value": "3072:o6z1WqLgV4ZQGBcD3i/lMpaLhmVAQ/iz1Ta3ErUxglryYlUg+JGfsJ2W:DhTa3ErU4Ug+asJn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637377850, "uuid": "5b5664a9-4002-40f7-a162-7b459090e348", "value": 117425, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637377850, "uuid": "9d723389-304b-4a86-be5d-592a78b08462", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637377850, "uuid": "db469eab-1a1c-4ab2-9667-8a0fc1d4bd2b", "value": "45944655675bf514458f07f733daded2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5144164d-4a4f-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1637446506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637446506, "uuid": "fb39ddf7-97cb-48c5-a4b4-cad4bd529827", "comment": "Malware payload (Smoke Loader)", "value": "d47697a57ff32b08a51071ceb93b8803", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637446506, "uuid": "7c904acd-7b8c-4d1f-a19b-aad941bd85b6", "comment": "Malware payload (Smoke Loader)", "value": "6ee2b9d8602edb6df8e6d379aad8b4a5bfa5cadf65849562c6e8dd080cdcf3be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637446506, "uuid": "1496f4d5-b4e6-4424-88b7-e95102b0497c", "comment": "Malware payload (Smoke Loader)", "value": "9f7491ab739e18c83be2847a0811771f3b9a5739", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637446506, "uuid": "2f8fc07d-837b-4302-9f7e-5e5f0ca53765", "comment": "Malware payload (Smoke Loader)", "value": "755d6e362873281c88c85f5ce4be4e49bd4a5b1ea3c2f3aa9e086f3c637dbb857e6019473054614a0b21e4c0f886ae19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637446506, "uuid": "0f428627-5e06-4d34-af3e-91b83c630629", "value": "T183747D00AEA0C035F5B712F849759368B93E79A1EB3490DF52D6D6EE9674AE0EC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637446506, "uuid": "b65b28d0-9299-4341-81b7-210aecf972f4", "value": "b2fd25528233ce5a8eaab403b2ce8572", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637446506, "uuid": "0b01c21c-1c20-4536-b48a-6f70d9cb63b1", "value": "6144:muRWyzyOtB578ZfLcasXGDoPdfhI1vDW4y:muRIgw4asXG8VJIDW4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637446506, "uuid": "240f01a4-8dd9-4278-b045-36e94b510d31", "value": 343552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637446506, "uuid": "df76beda-d650-45c9-9168-480af932b025", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637446506, "uuid": "cfe32129-e8aa-4496-be2f-caea0129fca2", "value": "SecuriteInfo.com.W32.AIDetect.malware1.23939.20982", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5456ac1-49d9-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637396101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637396101, "uuid": "9449d1de-79f4-4cb9-a91c-7a6d844a42d1", "comment": "Malware payload (AgentTesla)", "value": "06ca495fa7edcd3d81ed68899e65d547", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637396101, "uuid": "d38f4c77-ba2b-494a-b542-be9c6e766d31", "comment": "Malware payload (AgentTesla)", "value": "6f6467c8948af0aba09b8b3c03f76ae72107fd01f5fb656043cc6f65199840ee", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637396101, "uuid": "8c3ec49c-cd44-4bd8-9936-4aaeebcd1857", "comment": "Malware payload (AgentTesla)", "value": "a9354edaadb9391c4d7300f026212630fa28728c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637396101, "uuid": "4b111f48-99ff-4354-9dac-7f41b5cd34f2", "comment": "Malware payload (AgentTesla)", "value": "cf3acb39a7da77a4d63fbc017e385a19970aa7ef78df0e11852c0547c2d3496ddfc57c93da28aa0919a8a36d6721aba8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637396101, "uuid": "ef66f8d7-aa03-42db-978a-274b3afd59f3", "value": "T12C41CE4A1E4052A003FA0FF7B927D4C6F38EEFDF64A99C459260D8903851535A2E69BF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637396101, "uuid": "7b4ab396-0f81-4c6d-8575-f4983edf4460", "value": "48:gV1UENAoHXMKfUvc07xAnRF+g9KykVxyBje+ECX:gVZMiUvcAmnRb3kVxyBjlX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637396101, "uuid": "a738fb8e-52ed-4522-b0be-de912eb6f6f5", "value": 2036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637396101, "uuid": "54585fdf-0698-4d81-82b5-8c5546539763", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637396101, "uuid": "3998d462-1255-46bb-8fb6-5357ce3aa76d", "value": "factura.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ca1dbdb-49dd-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637397616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637397616, "uuid": "55c2aa70-5f9c-41cf-8181-e4fee3691b75", "comment": "Malware payload (Mirai)", "value": "b42b96ce0564e083dcef51b8c9eafd20", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637397616, "uuid": "776b9901-331c-46a4-be33-a8cda48bb614", "comment": "Malware payload (Mirai)", "value": "72bc2c559cd4f4e9cdaa6303a757d54b12f5ff3902f140b69b7f0c79e435c03b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637397616, "uuid": "008f528f-07f6-4e11-9d1f-dd7aabae7135", "comment": "Malware payload (Mirai)", "value": "8ce4678f9e9bd3ebc481d0299cd6d37f23670ef6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637397616, "uuid": "bc98b152-185a-4748-932a-a71a9f474b47", "comment": "Malware payload (Mirai)", "value": "c361d9df4797b3c220ff1cc64713082e7f0c0121dc0e083839440c359102dde24aa94e9b257bdc30bd29442e89a74566", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637397616, "uuid": "5a41bdd2-5202-4962-ada7-2a2ade5f2fab", "value": "T19A33F12C1B954352D29BF4F45BE20314AD200D3AB486DE97AAF0C65FC983931B9476E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637397616, "uuid": "0d6bdf84-404d-48c4-87cf-6bcb80123492", "value": "1536:fpNnywIp5HUFW2U0jMUroVfZbvosuVJuz:JwSF9U0jMUroVfVohVQz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637397616, "uuid": "54387ac4-2be7-4c0d-8635-b5b06940b14c", "value": 52492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637397616, "uuid": "743efc22-34aa-4bb6-9cd7-5af8fc1f1e53", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637397616, "uuid": "7129e2d3-3281-48fc-82f9-6153b2c0fcdf", "value": "b42b96ce0564e083dcef51b8c9eafd20", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dd2644c-49a2-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637372144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637372144, "uuid": "ad98c3c2-66c8-44ae-a251-83410c72cb00", "comment": "Malware payload (RedLineStealer)", "value": "911669a9c6aedd2806a996ad49adac13", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637372144, "uuid": "6e7a5249-deb8-4a63-8d42-e593c1249ecc", "comment": "Malware payload (RedLineStealer)", "value": "734c31431b89b7501b984af35a2d61bdce27ba87ca484a64fb37ca5794e1a141", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637372144, "uuid": "8e8bdf4f-5d03-4063-8ca6-379f51ce5df5", "comment": "Malware payload (RedLineStealer)", "value": "7b0ad38d008d1c7a40e2575b005e9876aca4f06d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637372144, "uuid": "d09ce3f7-3502-44ab-9876-db2740ac6cde", "comment": "Malware payload (RedLineStealer)", "value": "8a9b3c1751379155663202f50d975b89869e876ecbe236a9ce4be3f359667806630ac3ba0becd407e65b977e97da140e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637372144, "uuid": "3527655b-1cd7-4292-9b4c-96896229d928", "value": "T1F7F533217BF688B6F902607029A45FB8F4BEC98C3E2607D77B454613BF1E89A711B0D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637372144, "uuid": "203ccbb0-c8af-4c22-95ec-478ac3b668e9", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637372144, "uuid": "3cfa8a1b-e2b1-47a3-8773-3a9f785b95f8", "value": "98304:x8CvLUBsg7hxBQbyOwHITwL0y5POTO9iGs:xhLUCgvBQleITwLxJTs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637372144, "uuid": "ae5acca5-469f-4791-b2ce-7f7488621334", "value": 3548289, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637372144, "uuid": "5c1a9ee9-508c-47f1-a5aa-3306576c0793", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637372144, "uuid": "27c4d135-73e8-42f0-a9bf-d4de81c63330", "value": "734C31431B89B7501B984AF35A2D61BDCE27BA87CA484.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68880dcf-49e7-11ec-843c-42010a9c0014", "comment": "Malware payload (CryptBot)", "timestamp": 1637401878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637401878, "uuid": "2cb8046a-08e7-4f47-ae0a-cb1211913821", "comment": "Malware payload (CryptBot)", "value": "26b465ad526feaf337deba0bcd46ce7f", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637401878, "uuid": "2862632a-e97d-4ebd-9144-ea421e87825f", "comment": "Malware payload (CryptBot)", "value": "739a4cfe7bee884476dbdb3437a1beaeb3ba0eae8ad5b95f33803ebf2e759d58", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637401878, "uuid": "9cabf1ec-23f4-43e8-98d7-5c9b1ac454c6", "comment": "Malware payload (CryptBot)", "value": "10c65b69d961672c906f5a6f58d621e4a025a248", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637401878, "uuid": "1856deef-329d-41e6-88d4-ff74d4ba156d", "comment": "Malware payload (CryptBot)", "value": "8704d21623456d9dfef69585e0ebbb33af77fe774e22e09971291b506d7c3f0173136a6e513323d1e47baf6261c03de0", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637401878, "uuid": "6c264c42-ab8d-423a-890b-299fe93455e9", "value": "T1CE54E0113BB28836E6E3DA3144309BA2197F7C32657141CB776C263E5FB12D05AB2B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637401878, "uuid": "119126d4-6f8b-45ec-8997-79d8289d241e", "value": "9f36e28e95ecac65660050c1a70ebbaa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637401878, "uuid": "395638d1-c487-43d9-8ebd-5d8e5100f6b9", "value": "6144:klDh1ey8evA+7JhFi7DIQHvcAPG+hQINodhK:kRh4031IPNPG+hQJdh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637401878, "uuid": "e7cfadfa-6f1b-4155-bd0a-62a4db1d6a8c", "value": 288768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637401878, "uuid": "ce2b9f6c-40aa-400e-92b2-9eb690fe598b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637401878, "uuid": "0226b41e-4337-42a4-812d-99e2d7fe79a9", "value": "26b465ad526feaf337deba0bcd46ce7f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d11acb80-49f0-11ec-843c-42010a9c0014", "comment": "Malware payload (TrickBot)", "timestamp": 1637405919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637405919, "uuid": "62201672-2029-4559-9dc1-18c0735b68d2", "comment": "Malware payload (TrickBot)", "value": "7dfb148ff794dde58c7ab55d93b0112c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637405919, "uuid": "00aca0bc-4639-4eb9-9913-bfb462b3b7b9", "comment": "Malware payload (TrickBot)", "value": "7735a05791f9c8d69e6211b9d5df24a852fcf7e6e8bae876f4ac126023c52852", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637405919, "uuid": "03fb7d84-f71b-4a67-82a4-9d9948ea3b8f", "comment": "Malware payload (TrickBot)", "value": "94ae964cbfcc06246bdb1407315059b9eb84ee43", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637405919, "uuid": "7520638a-a27a-449f-b329-5ff181efe447", "comment": "Malware payload (TrickBot)", "value": "487e7ead3ff3f7afe71b419c1b704dc23ece4656febad8ff46afbf8e4a2b8eb52b8c0b974f8cb434b52c895b399dbdde", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637405919, "uuid": "b9b73728-ba1f-4e0a-babf-38a5dce31ead", "value": "T1E455EF337CAC475DC8901B73CD93E27216AE2E5B5AF2C14A50F66F878BF01989016F5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637405919, "uuid": "f0ce9d57-a835-473d-96ae-9640f01862ec", "value": "bc70c4fa605f17c85050b7c7b6d42e44", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637405919, "uuid": "57967d07-1283-459c-aebc-162ea9ec0e54", "value": "24576:OQLny3OiG7O5fWcmCM4jBg0nWDqVXF1/Vz897cDH6WboJVIb90IrWH:OQLy3Z5ecmCMqhnllLNgIHjbiIb9EH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637405919, "uuid": "05657485-a330-4669-a47e-f2ae4ec12b3b", "value": 1348337, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637405919, "uuid": "0fd3b7b5-a3c7-4292-aab8-9207df9879e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637405919, "uuid": "e7070676-afae-4497-9237-02e059dec66d", "value": "7dfb148ff794dde58c7ab55d93b0112c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dfa416d-49e8-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637402155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637402155, "uuid": "a0a2b483-9a10-4a4b-a76f-0cd1fbc2668c", "comment": "Malware payload (RedLineStealer)", "value": "2a0ecd6047ac3e929413c9dc65fd9550", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637402155, "uuid": "555a000d-2e50-499e-a83c-90778bd4648f", "comment": "Malware payload (RedLineStealer)", "value": "77a56e7215c37931be8cb84232306667ec719336e2ae38fb75ed30bc39c303b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637402155, "uuid": "8591638b-274d-4e93-8fdd-2dda28f002e1", "comment": "Malware payload (RedLineStealer)", "value": "cab43b6a7d163a16b052bde9ad9392fa7fe1809e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637402155, "uuid": "c75d7d45-a9ed-401c-8968-29b7d8fce340", "comment": "Malware payload (RedLineStealer)", "value": "1fdff3b15320a8928a2f7d0e154a9981b25b4f4253b49d335733bf5e973518ba184ad84b516338997b93809af8edb7ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637402155, "uuid": "e6ea4610-77f9-4bfa-8828-00f5bf0bd119", "value": "T1AC549F10ABA0C035F4B756F84AB593B9793F79A1AB6494CF52D126EE5734AE0EC30307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637402155, "uuid": "3e2796bd-6e31-4be2-bf39-380b0cdeafdf", "value": "5a1f25b6d455560f38319cdc6a8b12fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637402155, "uuid": "a389b987-ab17-4003-a7d9-6a81f53af615", "value": "3072:X0ZpT7y6K8A/M//QJlax5zN2RQhDWP6bZTsJmYfi4FwtKvKvqZses:6K8OPaXzNTc6b6J/fPet+Sr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637402155, "uuid": "48eb2d9b-1ccd-4a4f-9d27-3da5311522b3", "value": 284672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637402155, "uuid": "5155e447-c386-4625-9988-d591af25826d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637402155, "uuid": "6b7329af-4e35-44d0-b15d-15de1e3bc4b2", "value": "2a0ecd6047ac3e929413c9dc65fd9550.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58543906-49bb-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637382953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637382953, "uuid": "be3804fd-22c3-4d88-b3a0-e7079e7b67c3", "comment": "Malware payload (RedLineStealer)", "value": "a0183ddc59605205f37af101460de5c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637382953, "uuid": "916bd976-094f-4e0b-bf05-b65cb3082ee1", "comment": "Malware payload (RedLineStealer)", "value": "781824a03b746fbeedba42ceba949da4f93388bfd3c7eae4ab560417fd128a40", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637382953, "uuid": "ca6daf79-824d-48bb-8e55-1224348da8a5", "comment": "Malware payload (RedLineStealer)", "value": "f990eef90be40471bde64df1acddeda15e86947c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637382953, "uuid": "8e03ca55-9618-4cbc-8286-8558368182e6", "comment": "Malware payload (RedLineStealer)", "value": "e96ea030835bb9789660832e81e153ce770401e874d7b8f78fe63866d1de1211b681c11fae288c13ad5d4fb18b2f8d46", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637382953, "uuid": "bdba4130-3bcf-4386-aa11-caa46d6e1920", "value": "T14CB63316B992A9F6D704347C076C93B692694BA86FC04D0B1B70464D6F79CF0D33FA8A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637382953, "uuid": "c4c98589-e7b5-4ced-9a32-e70fcaaa6e55", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637382953, "uuid": "b16b2b9d-92f3-4839-9640-3e62cbb2356f", "value": "196608:xNLUCgjYQqAMer5G65P/KL1jPvNO0YsvFiwyHhlNKYH+5WE3vOeWg4TTGWg8cmiY:xFdgsQDr5FRIjP/rvFcHhlNtmWEfb14V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637382953, "uuid": "e64a0d1b-9a24-40d9-ba77-811345972d8c", "value": 10820578, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637382953, "uuid": "f6152cc9-8f28-4725-a1d4-7b226a3aeb9c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637382953, "uuid": "8214f489-5830-49da-82b0-7f3eb106ffbd", "value": "a0183ddc59605205f37af101460de5c2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c7df18e-49ae-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1637377484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637377484, "uuid": "0aa7b78c-8432-4e43-bdf6-887a77241cc1", "comment": "Malware payload (Gafgyt)", "value": "b71051082ea1b3f19c5e7ac8ea097210", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637377484, "uuid": "027f4a9d-d2b2-4cca-af13-3cd5e67c02c9", "comment": "Malware payload (Gafgyt)", "value": "78d56f83b57a0db40c82c8a53dcbe33a9be691d67c04141f20f17000215adbec", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637377484, "uuid": "75d4ff7b-3b91-4acc-a17a-c09305463a18", "comment": "Malware payload (Gafgyt)", "value": "efe4e290a8ec7b5108c0e9e08c1dab5fbc54fad0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637377484, "uuid": "fccf6cc1-83fe-4a91-8525-3b6a387f4670", "comment": "Malware payload (Gafgyt)", "value": "4d4246971e566e68df6dfcb2a925af2f511de22e2e96506f7e92093ff67d8d9882f3a05b25ff13e3017b286ef0d3142f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637377484, "uuid": "50a06f67-814d-4d13-88c6-04e75df3b463", "value": "T1DEA3B53777270E63C0CA547101EB1331ABA9DE4438B94BD7A9917DA83F36E8834593DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637377484, "uuid": "8c5af31a-a855-48da-a7ea-174b754fb737", "value": "1536:qIumRLOB2fHSo958f9tutbUiwbPAjzUI8:9L3SoP8UCAo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637377484, "uuid": "5b5a2c4f-6478-49be-b1c0-e5a7ee6e4df9", "value": 102986, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637377484, "uuid": "3c93e62b-75ad-4d89-a8a4-cb28a5731c9e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637377484, "uuid": "7079739d-d91b-43a0-90b8-77b568e4c13f", "value": "b71051082ea1b3f19c5e7ac8ea097210", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c3252be-49e8-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1637402233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637402233, "uuid": "69ab63a6-5dab-41ef-8fde-b4fda34bdada", "comment": "Malware payload (ArkeiStealer)", "value": "bea60cdca89b11887158afac4d4d98db", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637402233, "uuid": "b8b46837-7d7d-40da-9cab-ecc1eb87fb33", "comment": "Malware payload (ArkeiStealer)", "value": "7c8e77237e7cdd86ef4f36039b78d3663af0405fd889fdce402e5786864e1c8b", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637402233, "uuid": "7ba1610c-568b-4076-973a-ec8cf6015212", "comment": "Malware payload (ArkeiStealer)", "value": "4a234bcc16b576b9949fd85b2c6386be89d2ad7a", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637402233, "uuid": "e8720937-1315-411e-8af2-759c6d131300", "comment": "Malware payload (ArkeiStealer)", "value": "e905805c62ec43446b87651710c0c62c638ad445a6d9fcfce5eefda6263abbd3f933e1e7ff8881a6e710769736660f85", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637402233, "uuid": "93533a0d-9117-4b48-906f-20b351517b02", "value": "T19C24CE1137A18032E7A3193355B08AB25A6AFB3F5375818E272453FE5E703F04AB5B5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637402233, "uuid": "fcb7e5c2-f7e2-4c1f-8aec-bbbc26f4b048", "value": "d447c88e5ba79016e49c5de135738a35", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637402233, "uuid": "e3510f40-8f56-43d2-a431-9cfb6ab6f009", "value": "3072:n1764Sp6XeG/MZf46oxBQdktYpKHNqBf2G7x6+z8nyeslDpW4yjaKll:nm6XeIsQ6MBQsSEvyNlCL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637402233, "uuid": "cc08839c-8df7-48b4-bffa-d1ceb16bc8d8", "value": 209408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637402233, "uuid": "0165d117-5f79-455a-ac92-dba132fd7324", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637402233, "uuid": "beed0b6b-8ba1-44ed-9fb5-94262c0bbfc3", "value": "bea60cdca89b11887158afac4d4d98db.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80e9d4ea-49de-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637398053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637398053, "uuid": "b82cc564-f214-46ee-ad7e-8cec07f50127", "comment": "Malware payload (Mirai)", "value": "58e48bc18e530c50a66853280bc4eecf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637398053, "uuid": "5f4f420b-a382-49f6-89f1-b8a1611ec8ae", "comment": "Malware payload (Mirai)", "value": "7daa53263b5d22ea00c26600f8d196d990474047b567c5e49476a1276126d797", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637398053, "uuid": "7837ec24-93c2-4a3a-880e-3c69357900cf", "comment": "Malware payload (Mirai)", "value": "526895706c1ad5c1f69a889088414670419309ad", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637398053, "uuid": "ab753412-5562-4639-8b91-5c063cfd09de", "comment": "Malware payload (Mirai)", "value": "03d7d8a2b61c17789bac2768d9d678257458bbc9da8298cdd95da8c704889fe5d4b00b73cb09de06ae5349218274a575", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637398053, "uuid": "34e6bf35-38bf-413d-9c90-73c6f0fe2937", "value": "T1217301393A9C4276CD7D6C37D8CE85C39629E2BD94FAA15F0009422A3ABF31427DBC51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637398053, "uuid": "8f552d61-f7e2-4bec-a329-6c61084987b2", "value": "1536:ay075uyG0dzeH/ROESqEq2a7XAuqMz1yLCm7j1sPZr0IVA:ay0757VdzefRO76LXAuRz1yLnOhr0IVA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637398053, "uuid": "3cac6179-0826-4a91-8e1e-a35e8ee68dfb", "value": 78120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637398053, "uuid": "071a453e-0f9e-40ce-a66a-38327328f28d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637398053, "uuid": "240872cf-f83c-4d17-8cea-0e91071eb877", "value": "58e48bc18e530c50a66853280bc4eecf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79d4b0eb-49cf-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1637391599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637391599, "uuid": "9d82cfc5-191d-40ca-8ac2-7acbd399565d", "comment": "Malware payload (Gafgyt)", "value": "cdc063a6ffd6c85bacb9e5ca83711659", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637391599, "uuid": "c747a2f3-92f3-47fe-b44b-157b16c66b48", "comment": "Malware payload (Gafgyt)", "value": "7ef0aede0a8d43007a575ba275d193f9cd0e7c6224444e059e7b21b141cce27f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637391599, "uuid": "4ea95d32-cc5c-478f-bae9-d0f22b6b7d6e", "comment": "Malware payload (Gafgyt)", "value": "3029f54f9f8ac8502000c90b8f233435069e1984", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637391599, "uuid": "31d99018-418a-48d2-80c4-af211c6a8d7d", "comment": "Malware payload (Gafgyt)", "value": "9b3f1ff1e96f115efa5ebc3ea4b28f5879b89a6734c79383ab32d02a981fbed471666627aa54678a742af5fbfceb651e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637391599, "uuid": "16e70c47-837a-44ab-be54-097b1873ac79", "value": "T1F2A31A44F841872BC3D327BBE78E479D3B36569467DB33116A386EB42BC17C92E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637391599, "uuid": "147c619d-7436-4c80-9172-21efa12f8282", "value": "3072:VSx+i6mqaObhN8nPNKV+qKmZuqQ4DPwXXtse:y6mRObn8nP7qKmZuqQ4DPwXXtse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637391599, "uuid": "ae02b52f-0ec2-4e22-b846-032b736e7066", "value": 100871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637391599, "uuid": "feb53536-d5d1-452e-a7cc-d12b6822b5a7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637391599, "uuid": "46ea6093-6f9a-4388-a316-fd5184cb213c", "value": "cdc063a6ffd6c85bacb9e5ca83711659", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d4c5c4b-49e0-11ec-843c-42010a9c0014", "comment": "Malware payload (AZORult)", "timestamp": 1637398879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637398879, "uuid": "c586c26e-356e-4188-9fc0-0acbc80edf1c", "comment": "Malware payload (AZORult)", "value": "744361c1728393f619216f874f6d874d", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637398879, "uuid": "2a5e53cc-684a-45ef-90ac-3f1966f5b477", "comment": "Malware payload (AZORult)", "value": "8185bb58f4a49dc3a96da380986f7d387b8b223605c898f458d6d9b66355b9ee", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637398879, "uuid": "b4449f35-e7c7-465e-8cdb-606ffd8ab62c", "comment": "Malware payload (AZORult)", "value": "f6292e3c5ddcd694d9c4bc274b9ad18b1bced06d", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637398879, "uuid": "107708a4-dc9c-4abc-9c0e-5cf3d49ce5ff", "comment": "Malware payload (AZORult)", "value": "17b0ad70c55de4beb5b2d6fd37adf9fca0b4e8d1baca3536c68f8b80ce50e715c41559baf86fbd2d1776217df47771e9", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637398879, "uuid": "74b1988c-424e-44b8-94eb-71ff64f80949", "value": "T1E394BF883650B2DFC857CD768AA85C60AA217CB7470BD247B04732AD9A3D6DBCF151F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637398879, "uuid": "aea794d0-6faf-4047-8a34-82916e6e81e9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637398879, "uuid": "54c23e81-26a6-4de1-afa1-c3d93ee55b29", "value": "12288:wstIUvzspkSD+tyTM0kp34D8sHOK/w0kqZgQDSTvZBQmW:wINspk6MT34AcC0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637398879, "uuid": "b5d929fe-3c1c-432f-921e-afaea9012a8e", "value": 416768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637398879, "uuid": "f4011e5d-4535-4b23-9a47-e238e5cd6a95", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637398879, "uuid": "13064561-e38a-4437-9e6b-5b4e311b2940", "value": "temp order (2).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4715a31-49f3-11ec-843c-42010a9c0014", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1637407240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637407240, "uuid": "abb8d909-539e-4dc6-bc1d-0c302b83c8b4", "comment": "Malware payload (AveMariaRAT)", "value": "f50996f507d3ac99b9373b8778661482", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637407240, "uuid": "5b0df827-ae5b-4ba4-9a22-202b5d810268", "comment": "Malware payload (AveMariaRAT)", "value": "81f2631519263a896e2b52cb8cf435f633578daf240315d284837e47f90294d3", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637407240, "uuid": "feffdf99-1114-495a-b61b-22fb2525eb11", "comment": "Malware payload (AveMariaRAT)", "value": "6d447e5eea405b129b6c2db3e7d0d75ea33fcf8f", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637407240, "uuid": "373dbcc2-43c6-4510-afe2-fc3adb823d35", "comment": "Malware payload (AveMariaRAT)", "value": "aac73690f2ccb7332a85090e9acb2ef187701b7f7cd2411534ef7ddd05228b113a5320bc6c837423f36637f25726b6cb", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637407240, "uuid": "9f329468-faf2-4811-a487-3d62ead84412", "value": "T14574128C7FDDD52AC57E0FBAA821057117B1DA8B1802FF1B5DC66A6D0CDB3A94580B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637407240, "uuid": "d44b0232-2803-4005-b67a-784350e2c69c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637407240, "uuid": "ed22dcf1-d19c-463c-83fe-db4c75b67349", "value": "6144:euNq4GuU3+uPPpxY/WozXF8sy+iB8WcJ5z6ALdoHTadwabV:563+uPPpxeWozXKsT68WcJ5Brjx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637407240, "uuid": "9f99ee21-0df6-4762-8539-e73d74668c23", "value": 346624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637407240, "uuid": "9d818044-b8a4-4a3e-961a-f74120a458fe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637407240, "uuid": "1b52a3c7-eb3b-4cb0-9264-2bbdfa6640d5", "value": "Order PV2106938821.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "326f2a10-49e8-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637402216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637402216, "uuid": "6a5274ef-537d-4a7a-b449-a5b90c5a2465", "comment": "Malware payload (RedLineStealer)", "value": "e96fecdfdf0c0a57cfeb530cac9e993c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637402216, "uuid": "b5927e0d-bcd8-4ef1-b07c-29ee4528b86b", "comment": "Malware payload (RedLineStealer)", "value": "8288fe5cec4ff5d36020ab6e02e34a89ef9682e8978293cb4ac1c5d6b7bbd25b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637402216, "uuid": "c65c9c8f-59fa-4d1b-b001-7bc7cac33c81", "comment": "Malware payload (RedLineStealer)", "value": "b155edf2ad592a289aefebb80ccc89887b9f3ed0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637402216, "uuid": "7a2fb0a4-77fd-45ef-972c-16477f1c38f8", "comment": "Malware payload (RedLineStealer)", "value": "54e3bb87aa137c493c8d1d71cc31b21faa725eef924d9da21cca943bddb4c69e8853ba9fcb71c66b30bc03f4b84acd4b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637402216, "uuid": "902606ca-fc4e-448d-be61-311cf1c138e6", "value": "T17344E01176F0C435E9E366309934B7A58A7BB8F26B31806E235413ED4EB07C28AB5797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637402216, "uuid": "4e3dcea0-069b-425f-9c4e-44e44acd9398", "value": "d447c88e5ba79016e49c5de135738a35", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637402216, "uuid": "fc4bc0ce-f5f8-4ead-bd2d-8df5055cee1c", "value": "6144:fhohsfD0GSREcrIqZvb93CsPX5JPV78Z:f6hsf1CF0qZvbRtP5P4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637402216, "uuid": "f223eb33-75cd-4b94-b3cd-378dc58ef001", "value": 267776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637402216, "uuid": "0520b54a-925e-4b4c-9c86-b82e63e952c3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637402216, "uuid": "a42202a7-1ca3-4335-81b7-fe1f492b684d", "value": "e96fecdfdf0c0a57cfeb530cac9e993c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9beb92eb-49ce-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1637391226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637391226, "uuid": "849ddc15-3789-4a3a-83bc-bd183aaa9f25", "comment": "Malware payload (Gafgyt)", "value": "48f8e06c40b637fa98171884279898f0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637391226, "uuid": "8f50076b-8ca4-44e5-b3a8-150674e51477", "comment": "Malware payload (Gafgyt)", "value": "82b884e3a0abc5c60237fba71a6375c6a02cb2e36d837a232464485aa0adecdf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637391226, "uuid": "9ebb6165-30f9-4f9d-9eaa-6d751a86d3cd", "comment": "Malware payload (Gafgyt)", "value": "4103a2cf016ed47b76b6dbc71008a8e85f595663", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637391226, "uuid": "fcbc78de-484f-4f5a-b830-bf7dde7570c0", "comment": "Malware payload (Gafgyt)", "value": "d270abb6075f7e4cd7703dec6214d9911c9098b7bb382fee69ef88383b9d51c78c1417b269c0e588f83a12205d88a0aa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637391226, "uuid": "42369f1a-deef-4cfb-80ba-8af2f2be259f", "value": "T1F8933A47B71C0B53C59B5AF12DAB3BF08B69B9E113D76185A10AEFD00372EB12412FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637391226, "uuid": "bf76964d-e4b5-41ba-9738-4a012941d72d", "value": "1536:QQK1n7bzX9jajzvxRq57wBRcGCMCZDxeBk+82l4umXxVqDrstKfz9e:Q97vk51RcG7A0l4umXxVqDrIKfz9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637391226, "uuid": "f318ecf6-c704-4bf5-8d11-9eea0843401f", "value": 93907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637391226, "uuid": "38fe2427-d771-485c-826c-0d1731cf9f0e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637391226, "uuid": "af887186-eff1-4d0e-894b-518dad6d0018", "value": "48f8e06c40b637fa98171884279898f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f65f794-49de-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637398024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637398024, "uuid": "c008f281-2420-42fb-a438-89d77e05c0d7", "comment": "Malware payload (Mirai)", "value": "1c710b7f9b67491a7cf019d2779d83e5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637398024, "uuid": "aea00774-13e2-45a9-af41-6c4097270153", "comment": "Malware payload (Mirai)", "value": "8737c39cc74c50de4c9e84bc0c4613bad6a3d77becfd9fc245c0466f3762ae7a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637398024, "uuid": "6aa8d5e0-c449-4936-9d07-65e94b1ac5db", "comment": "Malware payload (Mirai)", "value": "25937dfdef6dca748525b01d2cda97d94c337a5e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637398024, "uuid": "24bd0d3d-7b52-45aa-b4e2-ea6363029f65", "comment": "Malware payload (Mirai)", "value": "02096f11ac6fa7700e88a564db97efa0c810a2b1e5410349af9f2c5220a48d51baca8bb6e17d10b138c5c1108178dfea", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637398024, "uuid": "a9d80bee-8deb-4785-960e-bdb86a8877e7", "value": "T15E23F131E09945C7EEF5DA7BCDA0C6E937F08DE722830D2C05193B61872372BBA50599", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637398024, "uuid": "8e13ffcf-a95c-4b5d-b21f-09597f75ff7d", "value": "768:gnchWkGAdkwkq3hS0fcC7u0jVqdkTTKVFcz9sOUTxasWnzXSDCQu4uVcqgw096:BVdjzxhXgdk6VChoxjSzXZh4u+qgw096", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637398024, "uuid": "c72a41c5-c617-416e-a1c1-9a518a02295a", "value": 49160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637398024, "uuid": "70e9659e-4f68-481e-bf0c-a8702e82af33", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637398024, "uuid": "09441593-a003-4a0c-8ba2-52198ee1caad", "value": "1c710b7f9b67491a7cf019d2779d83e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87103759-49dd-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637397634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637397634, "uuid": "24740b7e-f517-4eb0-9a46-2bc5a32dd6b4", "comment": "Malware payload (Mirai)", "value": "c8a6877b7ee1184920922882806d1cb3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637397634, "uuid": "4af4a9ef-1f57-4fe8-9684-3398e02041ae", "comment": "Malware payload (Mirai)", "value": "87c01de5a3b198b299434e55f2105eed66f8efb2d2eb9631880954cd2c67d000", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637397634, "uuid": "d2124f79-862f-48fa-a7c7-159da2a0ceb0", "comment": "Malware payload (Mirai)", "value": "44325026746887ebe22f8e828d8f7ab6f05d0229", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637397634, "uuid": "6259d105-50a8-40d0-8040-8f0b354f1def", "comment": "Malware payload (Mirai)", "value": "59e5527f18193984222fe16ffa8c8c92b8790fdea963ea5d14192ea9f12923711058813074bbd92957ad64a1ba07a917", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637397634, "uuid": "3d1b7124-a9bf-448f-8105-76f5ab922ee9", "value": "T12633E1D9DEA028C5CCEE6D7C70CE09798643E181A3898394E2054CD8EBE8BC7746DD9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637397634, "uuid": "0b9dfedd-5b59-47a5-8f9e-536086ccc7af", "value": "1536:+kZmb1tixCdWslx+XvTdL6/nPnZ1+RdpV4JB:+aO1lQvTR6/Pn+RdpSf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637397634, "uuid": "08880545-bcdb-4739-90d5-93f37b344070", "value": 53364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637397634, "uuid": "f55c1634-e04c-4a83-a803-0d5a7b97201c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637397634, "uuid": "3fa1ab7b-557b-4aea-8a5e-68bf239e2f92", "value": "c8a6877b7ee1184920922882806d1cb3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "345609ca-49ff-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637412098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637412098, "uuid": "0125f55d-3075-46cb-8d59-3f2b073ef59b", "comment": "Malware payload (RedLineStealer)", "value": "d835fe342927d532fed2376e050c8b18", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637412098, "uuid": "124df85a-e825-48b2-b364-995eda629e8d", "comment": "Malware payload (RedLineStealer)", "value": "888b7c0da59de4fb96352a4db14b1674881eea78028100bd8ffd8757f21fffdc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637412098, "uuid": "5b803a6f-cc48-4cc9-83b2-6adbae373d0b", "comment": "Malware payload (RedLineStealer)", "value": "f1b6543572e1c8deadb108249f3c6b8fb38e9b9b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637412098, "uuid": "37061b0e-8933-4be5-9ae0-c630092e43ec", "comment": "Malware payload (RedLineStealer)", "value": "64665e02159bb5caaef81d3b2bcbff4d4ce4cb656adf40a5294d4558ac3e3e194a951c961c01094a0279dee4477a891a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637412098, "uuid": "8c5b4503-717a-44fb-a121-ffc756fd00eb", "value": "T14BA4411F22D29650DA67277BD6B3ABB07FF110D1832B57C89B4885FC8A494617F03EA4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637412098, "uuid": "1bfd255b-15e1-4e8e-8941-be473b33e8e0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637412098, "uuid": "c1afc640-4802-4792-9307-abeb761614ac", "value": "12288:h4f5B4e5pIJ9f4tuItUlfh0wD3+rWK7NF:qHE9f5Imlfh3irT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637412098, "uuid": "65ab551d-ef99-40da-92c3-e667cdc0cd62", "value": 470936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637412098, "uuid": "8273a286-4cc0-4aa5-b655-9f1b70084aa4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637412098, "uuid": "2e393e46-a9c6-4e30-8fe6-fd2dc896ba0f", "value": "d835fe342927d532fed2376e050c8b18", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b5f3bd9-49e8-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1637402258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637402258, "uuid": "adfb390e-9d3e-4268-8dc6-56ba07468acb", "comment": "Malware payload (Smoke Loader)", "value": "52ec168708a81dcfa6dcaeca0100474a", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637402258, "uuid": "12ae550f-fc30-4474-92ac-a2f7451368e5", "comment": "Malware payload (Smoke Loader)", "value": "897572054e7490da731996e653af1d639526a90cd3acb684e9df764986725ece", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637402258, "uuid": "8307da36-ec9b-47d9-b2db-72089193796c", "comment": "Malware payload (Smoke Loader)", "value": "fcc84c8ef565bf9cbd7aeba3c8da0e93b9d357dc", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637402258, "uuid": "8e6ed4d9-47e0-48ee-8b27-51a4700a3483", "comment": "Malware payload (Smoke Loader)", "value": "bfeb3420008d690706e121e4831e1b011811ec4034eaf89a16e562b8e0d0a89475781c98f129c5de8ebbca483b98b6c2", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637402258, "uuid": "ceb97ef7-26f5-4405-bf97-b8632f27f94a", "value": "T1B3F39E3136F9C272E5EB1570A97CF7B12A3AB8722671448B3758263E1F702D04AB9717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637402258, "uuid": "b47fcfd1-cfc2-4bdd-9be5-22aeb5e2b3f3", "value": "d447c88e5ba79016e49c5de135738a35", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637402258, "uuid": "7309f10c-b1d4-44bd-adac-b91b4cea01ae", "value": "3072:k7Y4zQFI4uw9dTHviLFiOG8FdxbvjKkcqesnnSEgWP:KkI4uw9d7viLFiPw52qdnSY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637402258, "uuid": "b1b59878-1152-410f-8758-c483864cbd7b", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637402258, "uuid": "2bcfba58-f841-4a87-a303-146aea3563a5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637402258, "uuid": "cb50a2c6-dc41-4515-bc72-043a60b4bf28", "value": "52ec168708a81dcfa6dcaeca0100474a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9b8f1b4-4a12-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1637420455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637420455, "uuid": "5c67774d-e59b-47f8-a200-c3ab75bcfa30", "comment": "Malware payload (RaccoonStealer)", "value": "f6710c8f49ec5164e47e6892f78efa22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637420455, "uuid": "b58b1117-9589-42db-922c-a336074e74cc", "comment": "Malware payload (RaccoonStealer)", "value": "8a1888404b62e2e76cf154a2c00be005dcd27e3e97148bc5588e1e7f74086128", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637420455, "uuid": "40bdfd4e-cedf-46c9-9aa2-ab055ea233f9", "comment": "Malware payload (RaccoonStealer)", "value": "5fc7a11c0badea679522fd058030d53f755d3994", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637420455, "uuid": "90bcd44f-7c10-4f91-9b86-68eb63f666f6", "comment": "Malware payload (RaccoonStealer)", "value": "f3cd78722c5d253b6aac7c5642fa1058ed3746705e1d69a9a5800dca376d91eaaeebf08142fbee3dcc81909f49a45ef3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637420455, "uuid": "959ab7fc-c567-4823-a0c6-c1431afbf120", "value": "T1BC649D00A7A1C035F5F212F84976A3A9B93F7AA19B3490CF53D516EE5634AE1EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637420455, "uuid": "020a6f76-16f1-48f4-96b6-fb9f35d4813e", "value": "bdaee7bf3d7f5fcbbe5fa5d59a50c909", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637420455, "uuid": "e4a2186d-fa5b-41b9-a2d6-a2b5c18ac3dd", "value": "6144:kcQRX2k/5PyBHtEhr7Z0GlRyGkwB46Y74kdHWkP4TQ:kcQd/J8+p1VlRyGFqXPHWkgs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637420455, "uuid": "fe03b17c-1cbc-4baf-ac99-6e2567a4e980", "value": 328704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637420455, "uuid": "314084f0-1846-49ca-8c82-49853e57e6c9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637420455, "uuid": "05af5863-6a64-4e19-98a4-db400fa5bd75", "value": "f6710c8f49ec5164e47e6892f78efa22.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f9be624-4a47-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637442987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637442987, "uuid": "2ab274f7-a9c5-428a-96ff-dc52fb7df1fd", "comment": "Malware payload (RedLineStealer)", "value": "02c44b60fb9fb4451962a6829cef21c7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637442987, "uuid": "f8befa58-ffa2-4aee-b2bd-716ce9fc55ce", "comment": "Malware payload (RedLineStealer)", "value": "8df75aad857d0f7b14d033e17b101104d6ea4baad173cd1f5b43105d630dde0a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637442987, "uuid": "7c6b1932-5f7b-4370-b1ea-01de8c1d0956", "comment": "Malware payload (RedLineStealer)", "value": "da884a2ba20d476b414b50e2a80b9fe550a1c8bc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637442987, "uuid": "15a27645-b720-4492-9488-983637b2341a", "comment": "Malware payload (RedLineStealer)", "value": "cde2a903ce1cb8e93103cd0a5ebca73a72cc93c8348821ce4532742a779e003f13ed8e55f8f7ef8cc1de4714f060ed98", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637442987, "uuid": "10547e48-b8b1-4e4c-ab8b-f60c1a88b016", "value": "T14694BE10F7A1C035F1F616F8997593A8B93F7AE16B2490CB52D526EA4634AE0FC3130B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637442987, "uuid": "327d2abb-c3e0-47af-a018-2d33f968db4f", "value": "bdaee7bf3d7f5fcbbe5fa5d59a50c909", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637442987, "uuid": "4322a834-6288-4ded-bdde-8f6985169e82", "value": "6144:qxXSUshZdBQabh79KK+H2KArmFstemGfS/CRwyssYryYid48cHA:qxW3bh81+mFsbGfS/Cm5FCd48I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637442987, "uuid": "bd26905b-04f0-4757-a73c-1f54e708ba9e", "value": 440320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637442987, "uuid": "0b1a7c15-537c-4251-baf8-3b97637b50a4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637442987, "uuid": "d2e6964a-a806-42dc-b197-9e9d0b240397", "value": "02c44b60fb9fb4451962a6829cef21c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19772554-4a1e-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637425367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637425367, "uuid": "f4a4a03c-9d66-4b38-bbff-acf9c624b485", "comment": "Malware payload (RedLineStealer)", "value": "3de720b232f3f2ac641da4ff06989560", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637425367, "uuid": "3b03189d-9a52-4438-9127-ca230a2defd6", "comment": "Malware payload (RedLineStealer)", "value": "8e7d62f065db87ae8a824816af5447845b4f1fdd02d97f759f251f0e1254f5c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637425367, "uuid": "7506a62f-1830-468c-94a8-1090b4219d7e", "comment": "Malware payload (RedLineStealer)", "value": "ad938a4d64c4606ec4c22c02d96e33faddc82152", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637425367, "uuid": "e702734d-bb5f-49eb-bae1-0c9899955182", "comment": "Malware payload (RedLineStealer)", "value": "ad3390fa48f5403c834995e7b35f9acdad4a6cd617c6259be7f1ebe9e574b788a9fc5d24c3c77cb44401ff7f4594f0a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637425367, "uuid": "01aa941c-c4f2-4321-96d4-7aecfc41de12", "value": "T1F35533B47AD02996DDDB51F4662E2782CE10A2781EE4A141A53F1C4F470E4FCDB2CEB9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637425367, "uuid": "dc63fd6c-e328-4b0a-9ec7-d95edbd28454", "value": "15aeac4aa1d11f9ad3fc4c4ac7bb9468", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637425367, "uuid": "48016aba-fd97-4c6b-9ae1-deb6103dc185", "value": "24576:nqLVTsuyb8WtI6yP6FW0M5v2JKoy3yGkEaHNYK3L7oy3NVzLr:qLOOWeUbM5jDNa5U6NVr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637425367, "uuid": "71bcc224-8b81-4d57-a6a0-f6bcab774663", "value": 1291776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637425367, "uuid": "5271a072-e876-4db5-8955-7bba4c41d9f0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637425367, "uuid": "0997c54b-9d70-4ffc-9a12-9640c6a77ecc", "value": "antiban.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "805c161a-4a34-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637434989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637434989, "uuid": "e5a86464-8c19-4c19-9624-2de1e6721ec0", "comment": "Malware payload", "value": "f0556c1062a2f72452574cc0fdce0d55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637434989, "uuid": "e4dc6ea1-b19c-43e7-a758-ec251bed810f", "comment": "Malware payload", "value": "8f17e6dd80617012865d8ad822f18d2c7accf31fb78b459e51e1da174541bad1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637434989, "uuid": "58dffd82-9fad-4c63-8239-7a55a6844a16", "comment": "Malware payload", "value": "7f0909c142cdc73be0c5b29a09fd6342c7582875", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637434989, "uuid": "45963664-d9c2-4c0e-bd0a-b79324cb7688", "comment": "Malware payload", "value": "7bb793aa982b6b15113ddbe81ad1cc1c0e6341741a90be2d416d9b5d52a4004c93ecb7c961b8de35602e5e9a4118c723", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637434989, "uuid": "b5c46132-082c-4d90-9aab-52393f7cc261", "value": "T1A6836A12A7F918A9F3F7AF70A87246984E33BDD1BD71C44C4649018D0A72E5ACE39763", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637434989, "uuid": "673d01c3-c652-424c-ba74-9cc84317eaec", "value": "1536:0brUZpzeSyZ30JpLrBKyGF/BbUogEfgVx76MJnNQJXPM:00Zpz7yZ3OFrDGF/BbUogEfgH6gnmJfM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637434989, "uuid": "63a68e7c-080b-449e-ad0d-c6dae99d3fd2", "value": 86566, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637434989, "uuid": "de4cd7f8-29df-462c-a0b1-a14b0440e591", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637434989, "uuid": "6928f451-58e9-45f8-9b51-f950b6cc3bcd", "value": "f0556c1062a2f72452574cc0fdce0d55.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bf40552-49af-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1637377805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637377805, "uuid": "aa7f0507-dc8d-4c42-825a-f29e0b8f2740", "comment": "Malware payload (Gafgyt)", "value": "9f80cf1000c1a236e62213aa6dbc0f05", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637377805, "uuid": "40d63676-1a12-4153-8bf8-e791946d2548", "comment": "Malware payload (Gafgyt)", "value": "9099cce5d65ee7e5b46a75154bfd633fec295f92ef1f6db6ee333411d44be6fb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637377805, "uuid": "365487dd-1857-4d56-b723-7ba209f4c53e", "comment": "Malware payload (Gafgyt)", "value": "7625b95bde67c5979523d0da99aa1f1502e3176e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637377805, "uuid": "d0ba72bc-c072-4a6b-97f4-5a2bb38c7784", "comment": "Malware payload (Gafgyt)", "value": "39982615dceed049824d2e36e7c3ba30d1407789861bf37c315a53da109ec32e76fbdeea23e82bcb590c324abaee9a30", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637377805, "uuid": "c0031003-47fb-47d8-94d5-97ad6986f08f", "value": "T16CC3954AA761CEB7E85ECE3B0699450110CD9D4A02DD6F2FB2B0F61CE3AB88E45D3D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637377805, "uuid": "654df06b-d41c-408c-bc33-403d76876959", "value": "1536:umSoeTABpDae/NfeKOpyzLZ3UX1y6wo7I/zbXj+vg8:uMvfeKOp4LrKqzbT8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637377805, "uuid": "a75e8466-f560-4e4a-ab29-9c42bc952aaf", "value": 119167, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637377805, "uuid": "4e83fb82-8fc6-40eb-a205-f63ab5c52cbf", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637377805, "uuid": "e661b694-e0c7-4f62-bec3-e4b61270bba8", "value": "9f80cf1000c1a236e62213aa6dbc0f05", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6aa62cd3-4a29-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637430228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637430228, "uuid": "40429c18-5d7a-44ca-a9fc-416057b8a5b1", "comment": "Malware payload (AgentTesla)", "value": "0a8286384847bbed356a1d96f58c6046", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637430228, "uuid": "880a66dd-9deb-4226-b6fc-314237f724ae", "comment": "Malware payload (AgentTesla)", "value": "92eab7dcddf00ec9c4479330ed39c9d25b21e90700ca69461204344573e031f7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637430228, "uuid": "349ff38b-0f04-4ad9-ab90-0a2227b79b1e", "comment": "Malware payload (AgentTesla)", "value": "827c276aca80ce554821c6bdb82d4a449e63234c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637430228, "uuid": "922f49f0-d44c-4b69-b174-f7a850aa1557", "comment": "Malware payload (AgentTesla)", "value": "f88995833c5813b83036bbe01bb7ec4a6f87ae005c60551bbd358e00defc78a6530c9566cdb6168857da5ebff55d24fd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637430228, "uuid": "d033bec9-eb2d-4917-8067-865f830d775a", "value": "T123A412042BCCE275C1390F3FEA72052209B1B8925A05EA4F6EC976DDA9DF3054712BB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637430228, "uuid": "0a6347f5-e4ed-4b27-b9a7-0dcf66fdeaf6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637430228, "uuid": "6ddac89b-de54-4c5d-8355-6e48089f689a", "value": "12288:VaMawZQgHu2FA20gTb1jynLvDCPvsWtZa1:dZjxBQXCX/tZa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637430228, "uuid": "03fe834e-9aa0-4f39-9c2c-d11897855927", "value": 476160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637430228, "uuid": "a55a604b-c3ac-44e4-9c56-811a098394c3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637430228, "uuid": "a391f8fd-19fa-4877-affc-c4b1e52507cb", "value": "HSBC Payment Advice - Customer REF A0019G1109_100182.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fcbddbf-4a29-11ec-843c-42010a9c0014", "comment": "Malware payload (Adwind)", "timestamp": 1637430263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637430263, "uuid": "b36bc1b7-61f1-493b-852a-99146029d6de", "comment": "Malware payload (Adwind)", "value": "1701de3c5705bfc7ec0012c025ec00e7", "object_relation": "md5", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637430263, "uuid": "243bf741-ff08-4555-86e4-86627a8ea59e", "comment": "Malware payload (Adwind)", "value": "97f2a240b37ca97fafe2e8685b90ce1c28a32ca2818f6489085fda85e3615e98", "object_relation": "sha256", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637430263, "uuid": "29792dc3-159e-47d8-b35d-db3f17c2eb5a", "comment": "Malware payload (Adwind)", "value": "1000f175f50f80cf139213c0971bfa71699fb0e3", "object_relation": "sha1", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637430263, "uuid": "d00f2787-0028-4262-8f7b-2b194cefbacb", "comment": "Malware payload (Adwind)", "value": "9f53dcbb785028d67113afb51db1a9153689b84f3d94f46717c9033f67204cf65d27487ddfc7b5cbb2e2232cc9dd86b5", "object_relation": "sha3-384", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637430263, "uuid": "a57a087e-5693-4e6b-93cc-195cfcc187f2", "value": "T1FBD423E9382D62C1ADD5B0304CB4572FFD62AE45A480BF6BA67C113E389B0663DBD714", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637430263, "uuid": "53f6778a-3e8f-4244-b338-d1823d9a28b8", "value": "12288:CkTwTzjuW0QjurUfOnVbYQIPaKfPMfq5no8RSIda6V9yx/OGPav:CkMzjuWFjcUfIbYJtfF5op09yxq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637430263, "uuid": "7725b916-f232-4aa5-8313-7441e8489d1b", "value": 643975, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637430263, "uuid": "d0a149e7-3ffc-40e9-8b36-9c822cc4bf4b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637430263, "uuid": "69051870-d114-465d-acf3-116ea46a7b10", "value": "56432190PDF.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac03c50d-49af-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1637377939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637377939, "uuid": "7c9f910b-01f8-49b3-ac50-fc1f450bd418", "comment": "Malware payload (Gafgyt)", "value": "2e115c7ae8e8887480f5f3193efb8c1e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637377939, "uuid": "0ee46878-35f1-4cd9-942e-645162d315b4", "comment": "Malware payload (Gafgyt)", "value": "991b00551b3bf56756492374e356cd65b0cd4272e950f74ab5dff8f1a3e21499", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637377939, "uuid": "39aa744b-594c-408b-aa5d-e69221b0403a", "comment": "Malware payload (Gafgyt)", "value": "6d864095e8fbe32444826f663e539409bc363519", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637377939, "uuid": "1d585cc0-5aae-42a6-a3dc-12ce92f9a5d9", "comment": "Malware payload (Gafgyt)", "value": "8bdc638aff0fc3810b11911f34d189c9db0915ed1e9ac610d9eb562b1f1db6d5984e29dd953f3710a050c091970f5ccd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637377939, "uuid": "f35d944d-485e-4e76-913c-010e8a09512d", "value": "T1A493D604ED505737C2D23BFAF79A42CE77351F986B97334196283AF41BE5B982A39120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637377939, "uuid": "6dc693a1-d3e5-4dfd-ab14-6cc53c86579d", "value": "1536:FSyqHwbRuW1i4sB9xQMOvA9dHB1WoAgqWhQaaZiJBU1WhRYP3fHR8uPMJ+f6/H2W:WwbRuW1i4sB9xQMOvA9dHB1WoAgqWhQo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637377939, "uuid": "cd0093d7-251e-4c31-bb1c-4f2b9f965406", "value": 95137, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637377939, "uuid": "b3cbfffd-5e17-470f-86ed-bdcb9ee6d5ba", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637377939, "uuid": "d6000e14-0cb1-4331-9f32-433e7a0c65b2", "value": "2e115c7ae8e8887480f5f3193efb8c1e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "362d42ee-4a2d-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637431858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637431858, "uuid": "bb030b9b-5bb7-4521-ad45-4c2507c9ebd8", "comment": "Malware payload", "value": "627612dbdccc6a6252583220f04464f5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637431858, "uuid": "1b44c5fe-b6c4-41a9-899d-3d04986dd120", "comment": "Malware payload", "value": "998ec265b9d7110e7f4c0dd916f7a9a0721c2da49417b219311c30944718d788", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637431858, "uuid": "4bf87c65-c439-4073-bac2-56e5825b1263", "comment": "Malware payload", "value": "0006fed6edbb125de56458884a2194e6023c5941", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637431858, "uuid": "55d90592-932c-498a-9414-763e13159534", "comment": "Malware payload", "value": "f8061ea64461d867a02ec84471fd946f371129ecefe97072e11d5a71cde0c2069a4d2f4f63145141779fc5ecec4f828b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637431858, "uuid": "58706e03-492c-4509-8b0c-68531a996254", "value": "T1E763F805738A8732DA6C577880D7122003F9D387A373EB4A3EC815DA5F46B998E9D78D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637431858, "uuid": "e85b40b4-e545-440d-8ecf-20e035d51509", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637431858, "uuid": "66b5b956-aac6-45a9-afd3-16c0ed6e0ef2", "value": "1536:VzGEqKIm0kUodVOC2m43ZrD6fCGbR4rLiBlmpYSGt7UY8+esGLNke:VzGEqKIm0kUodVOC2m43wXIYSGt77VGb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637431858, "uuid": "7c72a268-2e7d-4159-917c-3da781b00e73", "value": 71168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637431858, "uuid": "7c0121f1-2af5-4108-a17e-482d2fc7e419", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637431858, "uuid": "ef775d92-216e-427d-8af4-a2c7021a894e", "value": "627612dbdccc6a6252583220f04464f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c465a8f-49ec-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1637403924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637403924, "uuid": "5a02882a-d430-4cb9-9dde-957f6ed0f567", "comment": "Malware payload (Smoke Loader)", "value": "a650d873ffd8b9acff9a95ad30cf6e34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637403924, "uuid": "506963a1-4a71-4d34-bfca-0fd77839153d", "comment": "Malware payload (Smoke Loader)", "value": "999707599db51fc274a5caa26c04799211b52f5ef729afc8a253579a1188af19", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637403924, "uuid": "a21e04bc-b239-435f-8c69-b22632d02f12", "comment": "Malware payload (Smoke Loader)", "value": "cc937302df835a7c26f70f4fd724c6de81dbdff3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637403924, "uuid": "a66b8a82-e228-4b3c-9167-00a6ce095008", "comment": "Malware payload (Smoke Loader)", "value": "96f7ebb20db2453a6e660170a23ac3f694d54e1821ea9844d05a0776352ca5654a3c5633089486b2f0cb32226d4dfd74", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637403924, "uuid": "cd795d16-0f73-44a3-992b-cc53b36a6f02", "value": "T170049D1537E294B7F5E316302970DAB23A7BB8325730819F2794263E5E713E08A75B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637403924, "uuid": "2e59196b-402d-432c-9086-fe3ffde8e779", "value": "9f36e28e95ecac65660050c1a70ebbaa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637403924, "uuid": "0c6a296f-7ffa-4ca2-91ce-6a5095141709", "value": "3072:17M4Kqw7Vg5AfRbbduOW0Ih2/L+KMqXJz440kxyXS3h:6QAfRbbdoUDLJs1kcE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637403924, "uuid": "1434ae6e-8ade-4344-8f44-31fc6fde202d", "value": 173056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637403924, "uuid": "1302b0e4-731c-45c5-beef-d142772eeba4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637403924, "uuid": "3643ca6a-6352-4085-a5dd-83592e5c7e51", "value": "a650d873ffd8b9acff9a95ad30cf6e34.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31008afc-49f9-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1637409515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637409515, "uuid": "3bbb0046-003c-4711-baad-a1a30c45f16c", "comment": "Malware payload (RaccoonStealer)", "value": "e1a287e16e419ba8580f21ac2af196ea", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637409515, "uuid": "8649a6e0-4ba2-4d47-8214-d9235fe62b47", "comment": "Malware payload (RaccoonStealer)", "value": "99f6bad7e932642508b33725452dbac5aa528d8b60819710a388aab28b59f2fc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637409515, "uuid": "2072071e-8336-4e96-8cf2-2a289734a7f3", "comment": "Malware payload (RaccoonStealer)", "value": "644ba0c27e92b2e9e7986b0a81147ef4c4a9dede", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637409515, "uuid": "6829fb85-c17e-4757-b7c7-dd8d59907d7f", "comment": "Malware payload (RaccoonStealer)", "value": "a79062c5331364891cd1368a5b6d5d8c1016066113892a69c9d91517fe933140af9bd6156993929816a4c3817e891eea", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637409515, "uuid": "dc287547-09bd-4400-8dbd-e64b33fa56cf", "value": "T146A40111F7A3A03DE4A2D6715930ABF24A777C736131848A27646B1E3EB13D34AB5723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637409515, "uuid": "249aedea-2c3b-4c62-a95a-cd37a84dc238", "value": "afd7f49f71a4c196b8327a3d6c1e7f8d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637409515, "uuid": "c4db755f-f6a4-4628-ae50-568066023577", "value": "12288:6KWbpIuU7eCv7k0ZGdyvDzMJafc9fOJZ/N2:69pIu2eGkFdyvaf+Z/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637409515, "uuid": "8102022a-cbce-4bfe-81a7-a1ba7a5c9791", "value": 460800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637409515, "uuid": "f5b4b2ed-ef7c-4e11-92db-70c2bb705d5b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637409515, "uuid": "7d142f5e-69a9-440d-8180-d8412caed40f", "value": "e1a287e16e419ba8580f21ac2af196ea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "056823f2-49d1-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1637392262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637392262, "uuid": "906c7fd0-77e3-454f-84c2-9b58fa2ef51a", "comment": "Malware payload (Gafgyt)", "value": "3c6cccca570fc554ddf9b55a1bb17c17", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637392262, "uuid": "cb3026c3-eb13-40e4-8831-7435d203776d", "comment": "Malware payload (Gafgyt)", "value": "9a8e13e8423f4ff1f48e71583a42ca5b9a106051a0fb531aa86d4b8b09558bcf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637392262, "uuid": "2f2d5094-f694-4c2e-aeac-9b4f1fd409b2", "comment": "Malware payload (Gafgyt)", "value": "b000f1b0354b8a1deba52a47b1c7246572c61eb1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637392262, "uuid": "aff3eb61-af4d-4a49-9775-a7e2439a114e", "comment": "Malware payload (Gafgyt)", "value": "247dc4a1c0f71513fb58d8e4a16641b47b2243bc241d6e9538eb08ef57e87af9501ba58299a3ea44553dda994314c820", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637392262, "uuid": "6a743aa7-c44c-4f6b-8d74-56a35bb1ceb7", "value": "T141F34905E6408B57C1E2277AE6CF824D33338B94A3EB33155938ABF43FC27995E26915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637392262, "uuid": "cf8e93fb-01b4-4fe8-b3fe-cfa7326ecde0", "value": "3072:T1g2/eINNlzx2kkQCMOaQcvB6YnyLRM/9q3tmFwfBxKQodn:hg2hNNlzIkk/MOa/oYnydM/9MmFwfBxE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637392262, "uuid": "dc7769b2-9d01-48e5-a20b-4820c606d1b9", "value": 159888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637392262, "uuid": "98a8d30b-6cce-42e2-9faa-56ff5e8f5487", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637392262, "uuid": "88610662-ad13-4af6-b070-1063f9edc8b6", "value": "3c6cccca570fc554ddf9b55a1bb17c17", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "068682d1-4a2a-11ec-843c-42010a9c0014", "comment": "Malware payload (AZORult)", "timestamp": 1637430490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637430490, "uuid": "7c8d1912-7ab2-4cf5-b5af-d332c5337f15", "comment": "Malware payload (AZORult)", "value": "4aed32fcecd3890b60d6de7571049b14", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637430490, "uuid": "d27ca28d-114a-4a8d-8740-b077639bce3d", "comment": "Malware payload (AZORult)", "value": "9ad4b4913b1d97f17b387857a03aaa8a1b3fd116ade9a746d3d1dc69071242b0", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637430490, "uuid": "ac301844-4289-40e4-ac7e-193377ce6f62", "comment": "Malware payload (AZORult)", "value": "4785f94b05be4338c41e5c8d1a742b9b7ca164e9", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637430490, "uuid": "8c871ac5-2809-4d97-922f-49fc4cba7840", "comment": "Malware payload (AZORult)", "value": "7c985d204216dafc97ccf717b78b17073e2f06cea5a47bdd130983e84bd8847d99f85280b897d05f17de5dfcd88acd91", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637430490, "uuid": "c70a6c86-a0d9-4a67-aae3-2bf520b586e2", "value": "T14CB3197AF6C19272E02809BDCD46D1B6912D76302D3918B6B2DA4F8CD5F95C26E1C3C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637430490, "uuid": "d8c5d9d9-e8b5-4939-8898-e16be0a6fc35", "value": "6d1f2b41411eacafcf447fc002d8cb00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637430490, "uuid": "4216b925-f099-4f17-b1f6-dfa301ebbe80", "value": "3072:tuOSXpMx7ZAlHsbfUkolNGti7lfqeSxM3SpyEY3E/Jxg/:Zzx7ZApszolIo7lf/ipT/J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637430490, "uuid": "0eef2fce-4e41-4cf6-9f5d-73e72e67e856", "value": 115200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637430490, "uuid": "a409e1ab-7fab-44c7-af8d-0d195d7e6ddf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637430490, "uuid": "0be4da7f-eb8c-4761-8f06-8b7508f2f2db", "value": "peacenew.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0299b52d-49d1-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637392258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637392258, "uuid": "4ec20fcc-2a3a-4996-8682-d9dd124257f2", "comment": "Malware payload (Mirai)", "value": "76d788b1c6a0f3817aa8b1d5a3b2056a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637392258, "uuid": "5a60956d-4221-40ff-afa2-3e732df10292", "comment": "Malware payload (Mirai)", "value": "9cf488002d69abcf9632d5534f64fa86ba10df8882cd635f53b85de51ae30fc0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637392258, "uuid": "7d5b7560-6cef-4cdc-8691-ce9fff555f9a", "comment": "Malware payload (Mirai)", "value": "534f00c7d89f87d090213b6ad3437a30bc571273", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637392258, "uuid": "71f28a5d-931e-4dcf-a769-72375c6be7e3", "comment": "Malware payload (Mirai)", "value": "253817afba94a4d9b5585f13df977232b0003aeccb1b7c8c26c58356fea3c2c55a5d09e71e0d14ab4932438dd03c7eed", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637392258, "uuid": "d72fbd25-6c46-4e97-a54f-8ef9ee4dd332", "value": "T13092D05E32546257CAF42A7F99C54B13BFB816D2BF3BA8501FEC6F9C13127208368515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637392258, "uuid": "d2a9aee2-def4-4dc5-9177-b182e315629e", "value": "384:cTdUOpxu5Wgg2V/FzWPFlaqWJn7qEojJqjN1izY/U2bGQ+4dfdTae:cTdhEV9jqkn7HHucbl+41Ye", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637392258, "uuid": "02386cb5-3a2b-4f0b-b9f1-d48693a53a30", "value": 19968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637392258, "uuid": "7915f064-12cc-40ea-97ff-bd6388346095", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637392258, "uuid": "5f84e980-bec4-4bd2-b6d5-3eaf09e657af", "value": "76d788b1c6a0f3817aa8b1d5a3b2056a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f8f3349-4a35-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637435390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637435390, "uuid": "441c460c-a524-4f5f-b907-0155dc7f3563", "comment": "Malware payload", "value": "164aa2aea7e328084cae7f032c48a605", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637435390, "uuid": "4fe12b1b-a023-46f7-b170-f07b2dfb2bba", "comment": "Malware payload", "value": "9f665eee1fa1cbd7a79ffd676a6806c9447f8377a2173f4915cff3e593c63942", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637435390, "uuid": "e69cf9f9-1244-4a24-9003-fd1994d0b795", "comment": "Malware payload", "value": "58cb8619a4ecd0dd5d338b3f616f0728444f0552", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637435390, "uuid": "8ea24085-3c3e-49e4-bb40-d5052770bdc2", "comment": "Malware payload", "value": "1f147f777e532e7e7a32f39197d3c97994ab95d2e639a565dc9c3405836ad3c7b03d918c194a86e2bfe345d050d3a1aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637435390, "uuid": "f3f0961c-56d1-49eb-a37d-e2d1f99fe5b2", "value": "T120835A11B7FA1864F2F79F70A8B14A845E37BEE1BD35C11D4608148E09B2E99CE39763", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637435390, "uuid": "ae0dba2e-5635-4579-b3b4-752a16d3230c", "value": "1536:9JbrUJ4QuknCNkSyHCA+MoccwOfMVbnnkDV6KsmOpaMvHojle+go:9J0J4XmCN5yiIbvKV7HOpkjle+go", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637435390, "uuid": "275aba54-2f04-4292-997f-f8187d0788ac", "value": 86566, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637435390, "uuid": "d72c8e6e-013d-45ef-965c-f09c99f93ef5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637435390, "uuid": "32f44c96-68c9-4689-aa02-c3eedba5fb32", "value": "164aa2aea7e328084cae7f032c48a605.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a668d51-4a31-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637433717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637433717, "uuid": "a91bbcce-c07a-496d-aa54-cc241a9b0ef6", "comment": "Malware payload", "value": "a8d3943a8da4717bb569474900dbc703", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637433717, "uuid": "5ebc0d8b-6ec7-40b7-a492-8dbcfbc32752", "comment": "Malware payload", "value": "a026d098163797c17ff2c9e6b61464b4dfe8defeb1dc557cc20b99ce5b4f9ea5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637433717, "uuid": "6025fa5a-a1e9-415b-b848-72dd8452266f", "comment": "Malware payload", "value": "22590b55d37bb9b585347f855ba893e37d5a747b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637433717, "uuid": "c297439f-11f6-4418-b666-769b3081f43f", "comment": "Malware payload", "value": "32acd0ed7162c3ff053c6a31c463724c8129a5df8414c2fc927938556a07df2f2f30fce4b1b8630e9956e50520177060", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637433717, "uuid": "54ad7ace-f53e-41d8-815e-1ebd0229d780", "value": "T192658E4AA3A901ECD0ABD278CA529607E7B17C0107349BDF13D55B6A2F23BE15E7E710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637433717, "uuid": "b46cded4-03ba-46bc-88de-7b2f2bcf6558", "value": "ce919e1897288d41cd87bbb1edcd434c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637433717, "uuid": "07671089-7557-4196-bd90-3beb578b0e63", "value": "24576:HnLw0wRJXSBtrvY3+hB5CC/QixBOD0la9I4QTD0X:HD0BSzrA3cBbQ4BJa9q8X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637433717, "uuid": "3e6cda4f-bc21-4f2d-946b-5ce2a2a21149", "value": 1426944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637433717, "uuid": "620b9a57-b5ff-491a-8789-46a674728ccd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637433717, "uuid": "c077d92b-eeb2-4bc2-a3e4-e938537e1017", "value": "a8d3943a8da4717bb569474900dbc703", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "925f75f1-49e7-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1637401948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637401948, "uuid": "17a45ed4-55f5-446b-8727-fff89013622c", "comment": "Malware payload (ArkeiStealer)", "value": "5ed0b4599cb7192f29c47abd61ccad7f", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637401948, "uuid": "354b5a5c-300f-4b7d-bef6-61b39e1a42eb", "comment": "Malware payload (ArkeiStealer)", "value": "a379317e2d47cf80c29f3bab304f189ba41446ddf24dd8811d255cdad9f6f2c7", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637401948, "uuid": "7c6c7e2b-2a37-450c-8033-7ac0a25eb25d", "comment": "Malware payload (ArkeiStealer)", "value": "149e4531f4074848d6235f46fe929e18b0b17d58", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637401948, "uuid": "fb996571-89f9-49af-9712-fcf349f2a5ce", "comment": "Malware payload (ArkeiStealer)", "value": "75d28976f30e72be555875872d2f8cf896f0903e8c8db5381a3821d5e0b7e2861a8f0c42038eed9188f34d793c55731a", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637401948, "uuid": "1604570d-71f3-4303-ab18-83e792410d9f", "value": "T1F124CF2177B2C4B2E4B7093067B6DBA1097B7CB26B30D94B2764972E1E312E09DB5743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637401948, "uuid": "c0456eb6-b619-4ccb-a743-1b27d0b6f5b2", "value": "afd7f49f71a4c196b8327a3d6c1e7f8d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637401948, "uuid": "b0ba72ae-ab1a-4560-9d65-50b5073ec76a", "value": "6144:NktVcbKY8ZnKCt1yjnxu+elV0dgYVn5H:No+7Un/KnxOV0qCnF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637401948, "uuid": "64c32077-3bcc-46b8-880c-ac9115c0fd54", "value": 218624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637401948, "uuid": "88350576-15b1-45cb-9488-8f5f8007798a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637401948, "uuid": "bd9092c5-0541-4a18-a92a-c8ac0b311a50", "value": "5ed0b4599cb7192f29c47abd61ccad7f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b00a6b40-49f6-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637408440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637408440, "uuid": "d78aa9ba-72b6-43e6-8a57-560c549c1a4d", "comment": "Malware payload (RedLineStealer)", "value": "1ac985ef7d99c942894029b739070be7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637408440, "uuid": "5a8eed95-d233-4c5f-a0d8-b266ac599cc1", "comment": "Malware payload (RedLineStealer)", "value": "a63beda0f0df881abac53fed0654d5c49643cbf63a0a3168cfda67c11775da7c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637408440, "uuid": "bcfc22c5-8a06-4a81-a048-bf56b5c38469", "comment": "Malware payload (RedLineStealer)", "value": "92b204dccf3d7aeaa2615f51ac9da9611f332bb8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637408440, "uuid": "62fd66e3-3bc5-4523-8343-2976f48d907a", "comment": "Malware payload (RedLineStealer)", "value": "ca21a68f9f314e6156dd0bb91b74ef4b659f2a972ee928fa908c2561cb2e60bf2951c172d34ad5ca0e3b06230c968ae8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637408440, "uuid": "7e07afa6-1fa3-468d-ae8d-17288bfeb1a1", "value": "T16EC4128137E3C035E4B25630252156A5067BB97267BA06BB379B171F9F702E04F7AB23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637408440, "uuid": "6ceba4e4-cbbc-4e40-a7ba-a55cc97faacb", "value": "afd7f49f71a4c196b8327a3d6c1e7f8d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637408440, "uuid": "9fc46a82-0ef1-4433-bfb5-b1283b3396ee", "value": "12288:OqBsXP0y+urK5KKsZQfvmihs6nJT7hLYUNAfRCs6T6:OHsy+It1Q2iOcJRLYCWCs3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637408440, "uuid": "8d6256d1-6d1c-4dee-b497-6d42300ebbde", "value": 580608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637408440, "uuid": "f36a1b41-82cb-489d-a99b-d85eed6980f1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637408440, "uuid": "3d0ca53b-b820-4312-a383-39b7d3cfbe23", "value": "1ac985ef7d99c942894029b739070be7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d525519-49ec-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1637403872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637403872, "uuid": "b6c4ab3a-ca56-4ab8-a22e-7c6c52b2fff6", "comment": "Malware payload (Smoke Loader)", "value": "3c3c88c076ace95ad350e31e46a2f289", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637403872, "uuid": "251a090c-88b1-4ebf-942a-755bd940b37c", "comment": "Malware payload (Smoke Loader)", "value": "a6a485d3b393b16390e46a494aafb086b57451db9ee480e04a52d07efda4196e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637403872, "uuid": "d0df3585-1731-44c9-b7eb-095bcc90ab6c", "comment": "Malware payload (Smoke Loader)", "value": "db96fe010e87047049a1e5dab5ce570dc49b4ead", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637403872, "uuid": "4530f110-1f85-48f6-b1ba-8829c8bd4f51", "comment": "Malware payload (Smoke Loader)", "value": "200f5f0e6e9352686da3982ba492b2218c66528af070e46b8e501509f6e8d0f6cbbc52804a790ec8c5dc99e855742898", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637403872, "uuid": "353102df-5e93-4b36-a41e-c10ac0f92c91", "value": "T13B049E2137E2D4B2E1E71730E4749AA1197BBCF26274506F27A4263E5EF02E04977763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637403872, "uuid": "886d22ae-e309-4aaa-8c06-81a9aae73bdd", "value": "9f36e28e95ecac65660050c1a70ebbaa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637403872, "uuid": "7717a3ee-d88a-47c4-8ef0-c1b3f21cb68d", "value": "3072:77M4Kqw7Vg5AfRbbdS2D3YblOpTvlqXoz44RWX:UQAfRbbdrLYkTIos", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637403872, "uuid": "4dacc9ee-3d65-4d75-8bd1-0aa7f217ae9e", "value": 173568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637403872, "uuid": "79d58931-1d79-4f15-a90c-760b168500b3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637403872, "uuid": "56607174-5a3d-4369-915b-78f8b461820c", "value": "3c3c88c076ace95ad350e31e46a2f289.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c5b5e88-49e8-11ec-843c-42010a9c0014", "comment": "Malware payload (DanaBot)", "timestamp": 1637402287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637402287, "uuid": "14eaa01a-be8b-457a-8bf7-21067524b957", "comment": "Malware payload (DanaBot)", "value": "c11a1ec7b97cb4f53c47bd03469bee7a", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637402287, "uuid": "6a12d72c-0259-474d-b5e5-6e761fb7660a", "comment": "Malware payload (DanaBot)", "value": "aaba33fbea2a90c26205589be2807c7f04b571e5b410b06bc6555224392e18e7", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637402287, "uuid": "1e64e7ea-b8f8-47f2-8873-8a1cccf24e3a", "comment": "Malware payload (DanaBot)", "value": "00bd21853e6cccffd8fa8f35a69dbe395f464a69", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637402287, "uuid": "0735dac6-b608-4694-97c1-bd009828a74d", "comment": "Malware payload (DanaBot)", "value": "edf1a0d7d7a3f92eb3599d4f8f9329bd932a050eb5bfe3dd0c9a7a3de56fe91a1bb440f7ec6b52a66f4ad5c7eda7829c", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637402287, "uuid": "ea04bedb-5e60-4512-92d2-1f95027c25b3", "value": "T1A3958C51B602E726D6A86CB8FC00C5EF14F0BD49FE44D267F6C17F9FA932241A82519B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637402287, "uuid": "6077022a-8093-4d67-8ec0-fe2c896d2997", "value": "a8472a0cc6f7b03346f06721b8aa1d69", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637402287, "uuid": "6ec29142-669b-4646-9d78-9b0123c44c86", "value": "49152:lQU1aLhQhG5NUAgoOa8nBc0SmmdWwMLwktw4B7eEqfn8+nFFQCxEsJwKQB:lfaNQh+NUABO/c0Y9AdIEqf8+gqJW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637402287, "uuid": "9baf0a88-6f60-4e9e-8916-683e2d1e1e76", "value": 1945600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637402287, "uuid": "efe8dd0b-3126-49b4-9b9b-d688f677838c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637402287, "uuid": "60ae07fb-1e29-4267-a128-67c39b30776b", "value": "c11a1ec7b97cb4f53c47bd03469bee7a.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5331255e-49a1-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637371777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637371777, "uuid": "821b1383-6989-4941-90bd-5f1a7a3b1799", "comment": "Malware payload", "value": "92955b0795291d2e85ae95c76c6392a2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637371777, "uuid": "feef4961-fa25-4937-a09b-4cdf9a1dc9e7", "comment": "Malware payload", "value": "aac5a9949dd50c434924869ec0ccdd28dacaf9729ba2cbf0744b3c9731b91010", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637371777, "uuid": "0ca4adf0-3a55-45cb-ab7a-55d0f1d06980", "comment": "Malware payload", "value": "1236953931df21b7fd255e6d1a2be476e0edb644", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637371777, "uuid": "93dce7ed-833c-4d63-aa12-e2eef30a1488", "comment": "Malware payload", "value": "84c518a801e4b710c1fd44d4a840df7d43357f01cc9f60d49eb040ed1b00269ad2a589cff3b58b4709a6023425e956c6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637371777, "uuid": "19384b65-8396-4b84-929f-679b5b740ac2", "value": "T1CF744B1BB31F4645D424EBF8DEB37F211360FB675861470BD3C5662E602E2ABAA80747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637371777, "uuid": "da4f4d5d-1ffb-4b70-91df-af916741bf6b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637371777, "uuid": "082e915f-b13d-4b0f-9009-be613b062b9e", "value": "6144:xbb1wABdf13cIbvxzYllO0Fx1jiiQyoATqfU78dfLjTqEO5vRF2AURDDQQR:vwAtsyvxzYtpTqfUQdfLjT7O572vv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637371777, "uuid": "611af905-9b3c-4776-a8b1-b73d87d8e9c0", "value": 352256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637371777, "uuid": "b4fc1d41-a3db-4b8d-a072-0cd4932871b1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637371777, "uuid": "81ee7b14-9f01-43d0-bb3b-b5b982645322", "value": "92955b0795291d2e85ae95c76c6392a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a10401ed-49af-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1637377921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637377921, "uuid": "08022f9b-ed10-41cf-8d8e-d2af100e91f7", "comment": "Malware payload (Gafgyt)", "value": "526315896c5fbd672e3c51f42f2061ab", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637377921, "uuid": "51a19211-6852-4e10-9fc7-5733910505ab", "comment": "Malware payload (Gafgyt)", "value": "abf02709d072e96677e5c38e7dca5966203dd3bdf6745b1d0204191780055377", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637377921, "uuid": "bfb9d820-8376-4a1b-a68b-4593b06f3f3f", "comment": "Malware payload (Gafgyt)", "value": "8bfdb242a8510cf6db89aa9f45efbecacd9f83d8", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637377921, "uuid": "338ada5e-d415-4957-8115-453d407213bb", "comment": "Malware payload (Gafgyt)", "value": "35c623afdbf8f4ca5f3cdd128e510279284ac3e7ad29dfcef863656142af08f65befabea695114842b23e7fee2efcc92", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637377921, "uuid": "978bcd31-e47b-4bd1-9a73-c145350b7e77", "value": "T11383182B9251C1BEC08346B12ADF9961AC73BC390B3662067395BE6D3F35CDC4E99342", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637377921, "uuid": "4b4ae480-bbf3-42c5-b4dd-c6b6f25d7a75", "value": "1536:q2u1gHrMtjWqtgI6kev6mJgyPyp6z7m4fkr6iLHzEawOikIpHqJRU:qn1gxqWLDv6gPyu7zCDLHzEawO1Ip", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637377921, "uuid": "30da6862-1449-4cdc-a60f-eeae5cde5fd9", "value": 88523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637377921, "uuid": "e551f3b7-cef6-4e80-af11-4044c4c2c8bb", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637377921, "uuid": "9810f6d6-1847-4c1a-be2c-3080b49f49f3", "value": "526315896c5fbd672e3c51f42f2061ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "546c35b3-4a35-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1637435345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637435345, "uuid": "5610b7bb-7297-4804-89d5-5e398d08e8a3", "comment": "Malware payload (ArkeiStealer)", "value": "8d9f015f65947d5b32ec119fbabbc508", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637435345, "uuid": "7bd7fddb-c847-4e90-8375-85876a1191c9", "comment": "Malware payload (ArkeiStealer)", "value": "acd9d8053269d3cebd97bf369bbc60483146a79c87e4eab9e5c21ab1ad7f8837", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637435345, "uuid": "489e96e3-74dd-4db2-b801-9512566eaa8f", "comment": "Malware payload (ArkeiStealer)", "value": "6c8ef31378be9f1b1dacef410306ef4f48f65a27", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637435345, "uuid": "34b0a36b-742e-47c2-b450-d1ad1c0d4daf", "comment": "Malware payload (ArkeiStealer)", "value": "6de8909bfd98215e4dbd4053ead65c3a7ed54e9df1f87e9ac58b416d86620a77474a5635ec64b2baf1c78dac5fea24e4", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637435345, "uuid": "2eecbd84-f51a-491f-b996-98f0b436fde5", "value": "T1F0749E00B7E1C031F5F316F849B5A3A9B93F7AA16B6894CF52D516EA46386E0EC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637435345, "uuid": "8a919461-3fbf-4cbb-abe7-6facaa212db8", "value": "bdaee7bf3d7f5fcbbe5fa5d59a50c909", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637435345, "uuid": "d4fc433e-a805-4e88-aa6a-6756642e8cdf", "value": "6144:NsbNqowuULvuIChLZjJFVZ6tBG/0OKYtofOZOIgGK:NAqfIICBZjJUtBsppbZOIq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637435345, "uuid": "a584afc3-a775-4a02-9a31-a43fa79ec894", "value": 343552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637435345, "uuid": "062ac839-b5f2-488c-8c1f-d7f37adf7f84", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637435345, "uuid": "1c716d6a-79f8-4745-b425-bd8e080dabf0", "value": "8d9f015f65947d5b32ec119fbabbc508.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f636006-49d9-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637395715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637395715, "uuid": "4d453221-fd9f-4544-a4cf-6bac6a8cb85f", "comment": "Malware payload (AgentTesla)", "value": "7eb8b3486d5447be4d62b3e60fdb8c1c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637395715, "uuid": "fb64eb05-5901-49f2-bad2-3c546dcec850", "comment": "Malware payload (AgentTesla)", "value": "af72f592e350743c547dcd1fcc9c344118be40609d320548339675b6da0b710d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637395715, "uuid": "9aad2935-bd23-4705-b76f-ac53256d70d4", "comment": "Malware payload (AgentTesla)", "value": "b4ef2a7c6ab0b497a486190f0cac1b07025680d7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637395715, "uuid": "01d24b0e-2488-4601-aa6a-37d40af2c706", "comment": "Malware payload (AgentTesla)", "value": "0886db39ea8a5f7c215c450ce47df2480930de0629288be49f77c6cef80b72ef9172d675f87aa8ddcdb05a553b2e7aa3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637395715, "uuid": "1b4c0164-f97d-400c-855b-678dc422d26c", "value": "T1CC341223B0A4D8E5C5F221799ADDAC23A548DD271EABA30138AC3F1B6EFD11715E0F15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637395715, "uuid": "61d5d6c6-c7b1-4ff1-90d3-eebea54e9de1", "value": "6144:H1UlJXYQlc3BvsF8hSfh0QwjF5fwBgRJ+cVgbNSwfTl:H1Ul5YTBK8oq+e+zbFfTl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637395715, "uuid": "cd7c8002-e7bf-450c-be9b-306956e3d80b", "value": 234392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637395715, "uuid": "a79c27e3-4071-4b4e-b26e-f610df941a9a", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637395715, "uuid": "582941d2-8d7b-4ffd-b412-f80da00fd5f5", "value": "PO.27353.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "126e0447-4a1c-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637424497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637424497, "uuid": "af8a5bf9-c5ff-4d80-944e-98c423c152e3", "comment": "Malware payload (RedLineStealer)", "value": "0e0b71130e39bc784305c37d6cdd6ff9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637424497, "uuid": "348865ab-2cb3-4dc6-9a22-2e927d068f1c", "comment": "Malware payload (RedLineStealer)", "value": "afc6ee7d16e3b051fa6003e0168923bcc4ba21e850ab0af617b6ce91e8bed589", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637424497, "uuid": "62ae7fd8-6224-4728-a428-4964b43eda77", "comment": "Malware payload (RedLineStealer)", "value": "bbc620695a2ca4314f6886cf77cda59da0fa86b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637424497, "uuid": "862a952e-2b4b-4f95-8c30-99aed9c12355", "comment": "Malware payload (RedLineStealer)", "value": "d64321c1be6505d2a86e354459cb42b7d68088a657ca4e70b2275032f2af0ba2a83226433f4f20f39cf90f1abb470abd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637424497, "uuid": "3777110b-bc03-4820-9870-c84a7bc4afb9", "value": "T1C255339243567F4EC25DF9F2BB377B1F94286239C6E42912956E1D4AE0470F32E123E8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637424497, "uuid": "532f8530-247f-4922-b3ca-aaaab5271971", "value": "15aeac4aa1d11f9ad3fc4c4ac7bb9468", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637424497, "uuid": "5ac53cb8-1ed0-41f8-ac6b-061ca23a6d5b", "value": "24576:yfIn3nyKCI3WJCcr9f2tFLChpcrxt1o/WuG6ioHBVP93PbGS8bv2W8XibkEaHNYW:Ln3nybnCcr9et8qrxM+uG6ioHDPJPbx1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637424497, "uuid": "d34c9eb1-608e-4f0a-afe7-07cd58c8d9d4", "value": 1359872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637424497, "uuid": "56a95674-c43f-4357-8f15-2d5df865b0a5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637424497, "uuid": "ec50f0bc-ed76-4ac0-a713-8d534a9dda3e", "value": "NeverLose.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2e036a5-4a0f-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637419209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637419209, "uuid": "3707378f-e70d-4a42-b809-8e764c59a65f", "comment": "Malware payload (AgentTesla)", "value": "47c1b8d27e775a5ad8aa029f3860b627", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637419209, "uuid": "0e6a884a-2208-496e-acfc-e0eee5b2df51", "comment": "Malware payload (AgentTesla)", "value": "b14149200776a2bf34834eb49ff0df241a89e7fe38b6fa4c28eb74bb58965191", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637419209, "uuid": "a44356c1-33c2-46d7-a26b-90c8443909cf", "comment": "Malware payload (AgentTesla)", "value": "090c24f017577b4cee98e0a43fee38038e650048", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637419209, "uuid": "00e24160-af64-4f5d-b3b7-3f5fde8ecaec", "comment": "Malware payload (AgentTesla)", "value": "ea6481033a407e8d50dcf57133a4cad6bafe7b3d65bdf10b84551cbc000784b6ee794ccdc2cf26a0a365f0e6573848ba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637419209, "uuid": "5d5e2f14-11ea-4622-aa03-932973da696c", "value": "T1A9241A166715D421CB5F417FC016820831F1E707A72AD6CF5AA6D8FA2F852CEF92B8E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637419209, "uuid": "df18c6ab-7b10-4711-a3b9-1436f57e8e54", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637419209, "uuid": "a2e25a49-a901-4f3d-a261-42d7ce1a97a0", "value": "3072:0bhAXYxp1mKvXvwRFAUs0s4TzLwtsYQ1egmHI4UwgZ62Ih0v17jTZ7ItUAOw:qmKv4UUbT/wd5whXNTNcUA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637419209, "uuid": "dd95c73b-1fa9-4b4d-ab31-e772455a755b", "value": 221696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637419209, "uuid": "1aaf6b4e-c5b8-4cff-a3c9-0e3626422a22", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637419209, "uuid": "c5da3aba-08a3-45bd-9f9f-3f61c4c74098", "value": "47c1b8d27e775a5ad8aa029f3860b627", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bbd4e2a-49d0-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1637391924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637391924, "uuid": "7a535964-f2be-4413-851a-8e638d305069", "comment": "Malware payload (Gafgyt)", "value": "f127ee7bf021114666d8d9454c955d52", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637391924, "uuid": "b2baef56-ffb1-44d6-81f5-e83332a25167", "comment": "Malware payload (Gafgyt)", "value": "b1cc837f1c0e5fbcb67851fcd76226af30ccaf53328adeff6417f3085d547c52", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637391924, "uuid": "e7cc42f7-410e-47c3-ad9e-d1303b8bf4b4", "comment": "Malware payload (Gafgyt)", "value": "0495631c145e4e942c7c7d3960feba6b52be3cdd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637391924, "uuid": "56000c13-2328-47f3-8f92-3d7b617b5882", "comment": "Malware payload (Gafgyt)", "value": "3038296fb312c147cb41ff8a78d6a1ef5775a1b82290145980f1a1de9ca25f35786d1664e7d920c120f1eced17c41b0c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637391924, "uuid": "7435376d-adbe-48f4-99b9-3760775fc9fa", "value": "T14C833B47E9A19FB7C0866A7565AB5E300B13E9912B4F1A4A303CA7F8434F4CD790EF64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637391924, "uuid": "e8a783b1-fc52-471d-821d-45b2bca00554", "value": "1536:ClN9YyOXmMSr4k9dgGwKGg0CfjGJCedojMyTRLmkxVqOEeofzee:g7OXmMSr4krG3JFBQLmkxVqODofzee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637391924, "uuid": "99d7aebb-ce94-4922-8446-fa2968642063", "value": 88733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637391924, "uuid": "adabff9d-a840-46d9-82ee-6d4e7ce0eb6c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637391924, "uuid": "ffec5da7-9f8c-41e8-b1e7-1b8557ab1047", "value": "f127ee7bf021114666d8d9454c955d52", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89b8e32e-49d9-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1637395920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637395920, "uuid": "ed3114ac-7a58-4377-a1cb-722856f3a4c0", "comment": "Malware payload (ArkeiStealer)", "value": "9e93213e249415159b0b616a4e1e6504", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637395920, "uuid": "d3f73fda-bc72-41cc-9949-4942985f07d2", "comment": "Malware payload (ArkeiStealer)", "value": "b1db9a17312d9287f7ca3c6763a7741b758b88481657479a6212aa23c535b48c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637395920, "uuid": "1e04dc7c-6b88-4547-990b-d5c310e6fd96", "comment": "Malware payload (ArkeiStealer)", "value": "4c5f8fdff30f48b5cd554dd5dfd94bf4f28bf51b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637395920, "uuid": "e1882b24-7e5a-4b70-a4ae-4a2a963e7825", "comment": "Malware payload (ArkeiStealer)", "value": "2696569e4ece24f3a43ee00092d1a32272cb08d271ccca90ae71d9e344da6a2f4f534d4270796c1e0555738fbf2f6c09", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637395920, "uuid": "d46a8d25-2c20-4de7-85eb-a3b6a9d2ed5e", "value": "T1E9548E10BBA0C035F0B712F849B593B9793F7AA1AB7590CF62C516EA5635AE0EC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637395920, "uuid": "26c128d0-5838-49fb-b896-eeea30f3915d", "value": "fa7452f5263e392d1a3ff0250ffef13a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637395920, "uuid": "866d16ff-eeab-4cc1-bf36-96d76c78df91", "value": "3072:7cj0ZpU7yvFIgf4LrDnWAfM3nIgZBekVIvw+LfcQKiJPhbS7UJFZYB4FJ5oZjcdc:7coCr7WZZ6JL1Hhb9JYu352jcuD+M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637395920, "uuid": "298bff09-d1b0-4280-8182-712cc440d8b7", "value": 286720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637395920, "uuid": "0693a623-6e76-4002-b9ee-ba724bfb33b1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637395920, "uuid": "e53b717a-3f7e-4e80-bb2d-4e0c9fac530b", "value": "9e93213e249415159b0b616a4e1e6504", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41833f48-49e8-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637402242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637402242, "uuid": "3166323f-624a-440d-82a3-f7b81ec306e4", "comment": "Malware payload", "value": "ffc2d01dbfdcfae3ea2683cba1d23145", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637402242, "uuid": "e3ce4def-9fe9-41dc-873b-f8f091f4791e", "comment": "Malware payload", "value": "b34c0cdc7d961ef71dbcadc1a16f14b14bbc98452ebba64718b1912fa6987373", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637402242, "uuid": "9f55b0aa-0697-46a5-9c98-2d30890501f7", "comment": "Malware payload", "value": "1c23f00124bfe50e209266f8a241533e4db8c61c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637402242, "uuid": "e8dac593-e0dc-4989-b9bc-862efaccccfb", "comment": "Malware payload", "value": "a39181c4578d6a455685f99670ad97d50304af46247b3d8f29fefd9ae4673fd5644b799f3c35ababb64567ac9444b68a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637402242, "uuid": "0a34e19c-8c21-42df-a127-d14afaa434b4", "value": "T1FE84719D365072DFC867C876CAA82C64FA6074BB931B9207A02715EDEE4D997CF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637402242, "uuid": "776b0e2e-6924-480a-8af9-e026633b9938", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637402242, "uuid": "e03242dc-9859-478d-8b2e-73a450f6abf8", "value": "12288:gSi4CWVkLOFmVsZ2K9ZVnIdBWRIRbYoK0f+oU5Iuiz89P6CLu0AaIv:Z1VEO0VsjIv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637402242, "uuid": "4bce91d1-fbda-44a6-ad9e-47b25ed6118f", "value": 406016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637402242, "uuid": "d82cf7c2-da0d-4eb4-a938-7df097927341", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637402242, "uuid": "ae499183-8d3f-4753-b221-e671f499bd1a", "value": "ffc2d01dbfdcfae3ea2683cba1d23145.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "413d5abb-49d0-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1637391933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637391933, "uuid": "190b74dd-86b0-458d-842c-eab00b5fbe6d", "comment": "Malware payload (Gafgyt)", "value": "1eaf5d72d731bef94e4cb38a952d9dc2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637391933, "uuid": "8d93bf29-125d-492f-bec7-cc23cbd0c0b8", "comment": "Malware payload (Gafgyt)", "value": "b62e983a0fa285c9852fbdc4d5636c12dea31f08970606f9d4aa73c10873d584", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637391933, "uuid": "32c84a3c-a155-4e07-90b0-70ab53620d07", "comment": "Malware payload (Gafgyt)", "value": "c0c0577d1453efaa6739e674990bc488708216c6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637391933, "uuid": "0fb380c5-5825-439c-9985-f1856245e18d", "comment": "Malware payload (Gafgyt)", "value": "b67c6f6a7a4d004394ec94abaeb8dfd9947c811730afbaa0f33f72206c69918b7e33c2f86f9bb5a1cc3a536c7f6ccb9a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637391933, "uuid": "b90557b5-e523-46c5-9ef4-d2676c29d595", "value": "T1A8A3F896F800DFB7F40AE67604D34B24B670BBE14E532622731739A6AE762D53823F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637391933, "uuid": "ece4a7cf-09a9-4927-9e40-4401f2c22960", "value": "3072:Vgdr2vIBAxMyAOLRcft7hOemuxVqDr78fz1e:Vgdr2vIRyAYcVhOemuxVqDr78fz1e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637391933, "uuid": "320dc84b-c97b-46a2-91a1-cc2a431cdc03", "value": 98919, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637391933, "uuid": "7429627c-e714-4d1e-aadb-f7290adce82f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637391933, "uuid": "d2e31e2b-2214-4990-bba6-1bd68ea2797a", "value": "1eaf5d72d731bef94e4cb38a952d9dc2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d348fa90-49ec-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1637404204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637404204, "uuid": "b00ba97b-0d5b-4882-8331-11726a56d35d", "comment": "Malware payload (Smoke Loader)", "value": "a72efdeb9c30c3d0d9b9feb619766f3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637404204, "uuid": "f7b730a3-c4d3-423d-9c7f-44d26571318a", "comment": "Malware payload (Smoke Loader)", "value": "b65668fb8cace35e3e040f6159bad6c2f80f2f4799156bc5bf8766fa8dfe7c36", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637404204, "uuid": "d0415c48-397e-41db-9756-f93b2b24a3e4", "comment": "Malware payload (Smoke Loader)", "value": "1a0889ea3c3af5417104f45bfcf3a690589f942b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637404204, "uuid": "07135c74-f8e6-42ff-b40b-11739bc7500d", "comment": "Malware payload (Smoke Loader)", "value": "944ae6380dd9f5eb67c1cb850714b82bab76b7ec977dfbbc9e316addefeef98439b9878f0823f3ed9f245267b1e9a4df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637404204, "uuid": "33be34f4-73a1-4a05-81d8-4de578c688af", "value": "T15DF3AD2136F1C032E4E7263024739AA1297BBB73267545BB335A272E6E703D04AB5F57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637404204, "uuid": "a6147138-86ae-4fc1-b967-7a06c2fe9f99", "value": "d447c88e5ba79016e49c5de135738a35", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637404204, "uuid": "f44ed2ed-6634-4762-8133-4c52931abf22", "value": "3072:F7Y4zQFI4uw9dTH5bV5fRm05pesOFK8p4L:tkI4uw9d7FLw0HdOF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637404204, "uuid": "bd4df148-ce31-4de1-8e29-8d430387f32b", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637404204, "uuid": "d92634bb-c558-464f-9204-603672501177", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637404204, "uuid": "f11f156c-2687-4d83-98cd-baff852dcc26", "value": "a72efdeb9c30c3d0d9b9feb619766f3f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "255d9cbd-4998-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637367835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637367835, "uuid": "93e55b58-7bf8-4779-8b50-e4ead3fa7f99", "comment": "Malware payload", "value": "526c4af305f4438ee3ae6ff894d76597", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637367835, "uuid": "3a9faa01-250f-49c2-9a37-27562aa89b20", "comment": "Malware payload", "value": "b74cc5a17329986d8de5f8a6485d15b3f143cd900fb71b004862777ca39b33bd", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637367835, "uuid": "34aa640a-e657-4c5d-9a26-4491004ecc67", "comment": "Malware payload", "value": "66c219421cc5b9e22311c57f1e70c2ab28f244eb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637367835, "uuid": "2f888398-b8b2-40f6-acec-a69297679d35", "comment": "Malware payload", "value": "e7e80592afa3e988fe2431bd9f7d7c24d97aa5b1af0e546c6c01888a8b73c7dc29980053f4c8e0dc4f8b260ceede59e6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637367835, "uuid": "0402665e-b9af-45d7-a6fe-00a3d8cc181c", "value": "T10A150135609212F4C6F5E2709D525C4F7AB4508F31282CBDF6648633D8A6A0B7EBB5CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637367835, "uuid": "d450adef-7729-4203-8850-a118aa01cdb1", "value": "0fa5f603594be57c7a33042959196729", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637367835, "uuid": "9de7ac1a-9a60-44cf-93c7-d4462c8f9f8a", "value": "24576:qZbu54jB/DmCOrMy9xCZcdpKj/eXhXF33LAR:qFQiiCu/xCZcSj/eXhX1LAR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637367835, "uuid": "2aba8dee-9b1b-43ba-9727-1b73a350e660", "value": 876544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637367835, "uuid": "dbae5316-96bc-4787-b51f-0de9c5a2f74b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637367835, "uuid": "6fb110a3-2f6a-41a3-9e67-e978f1e4a7a9", "value": "steam_api.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8442645-49f7-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637408910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637408910, "uuid": "2d909e95-b369-4a5a-9015-80175d30ae8b", "comment": "Malware payload (RedLineStealer)", "value": "c93afea9b6f7f7b3829e0f77d4ad4469", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637408910, "uuid": "2c7b787a-ad52-49af-a163-c777ef909654", "comment": "Malware payload (RedLineStealer)", "value": "b7f734b951368a6d7cea9fe0a58d64e53c8962aea126fa484e8a3592c00ff25d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637408910, "uuid": "349040f3-270e-4223-a99f-6049e26cea65", "comment": "Malware payload (RedLineStealer)", "value": "58e0fd5a05192324ee2bd796b6139fcac9c79c25", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637408910, "uuid": "846f4cfa-667c-4f68-a37a-be55f12d3612", "comment": "Malware payload (RedLineStealer)", "value": "79390c7271564914714312e5196c462516583a72c21116f0fa3ea07223d4a6fe73bb13314ba970a43e10cbb6d1d2ff58", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637408910, "uuid": "52ae3db9-b7c7-4877-97f3-f6294b6f24f7", "value": "T18C64F12277F2D03DD5D3193064349B6259BF783269B6425B27E4222E9FB03D18EB6743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637408910, "uuid": "31e6ac39-0591-45dd-a822-ca79758e38e0", "value": "9f36e28e95ecac65660050c1a70ebbaa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637408910, "uuid": "17523a06-5979-47ec-95d2-2c33fdee680b", "value": "6144:Za4vH9fZzl+ZPIh0dF1q95zks9W2phUyoS6Q:Q2HNZMPIh0fSJE2pay", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637408910, "uuid": "b9173f22-1d16-4021-b01e-afe2edbf4572", "value": 315904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637408910, "uuid": "1cc7e7af-d619-4247-a6e5-370f97358d0a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637408910, "uuid": "ff45a540-9efc-44d7-bf21-fdd28d3f1b9c", "value": "c93afea9b6f7f7b3829e0f77d4ad4469", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "216a0915-49f5-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637407771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637407771, "uuid": "17d108f5-a1db-46e3-b93e-d154929177b1", "comment": "Malware payload", "value": "774f3cb3521aa153ffd90aa3ed89da9d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637407771, "uuid": "717e9340-650f-4495-aca5-0d9165b718c5", "comment": "Malware payload", "value": "bb2663414da0559386ce76e5d91e02be32f707c9086433cbf0da3ac0c3d2a8a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637407771, "uuid": "1a575e6b-25c6-47e7-b499-380ddca57cc2", "comment": "Malware payload", "value": "c6547b2f72d4f88a3abe1bdfb63f788653e71093", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637407771, "uuid": "2d678cf4-adb6-4e51-8af8-bf211c71e612", "comment": "Malware payload", "value": "9176820fe6b83525fd04a949929ba93ea47b33efc690ab730678e560af5424fb92bc1bc5ea527b22df292ffb8896e5b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637407771, "uuid": "490b5530-af04-4e79-a0bc-5b377b94e62d", "value": "T13AA533B9B6DA30BD96E8A1776BFFC934303BE6CD60164BF0ADA541CE1406231D9D4A1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637407771, "uuid": "4a606dda-6827-464a-a84a-74b80e90ec71", "value": "49152:HT0+oOBiXLUNaRHKmjsbS21i2F/ecE+0n9aFctnpbbTruN3MKQg:Hos909Qg6ecEZHyEg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637407771, "uuid": "34265193-703e-4586-a430-d0b0f482f612", "value": 2125824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637407771, "uuid": "bd5c4792-ae55-4234-a0d9-e56587149ee2", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637407771, "uuid": "c72f689e-88ed-4b5e-81d4-306306b0c7c1", "value": "bb2663414da0559386ce76e5d91e02be32f707c9086433cbf0da3ac0c3d2a8a3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bc46ef0-49f8-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1637409211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637409211, "uuid": "e0b2eea9-6b48-4c38-9d32-301fba26fdf6", "comment": "Malware payload (RaccoonStealer)", "value": "fefb3ad9f0f596eb173366e7a82b055a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637409211, "uuid": "9db634bc-adef-49cb-9201-e1d5aa827800", "comment": "Malware payload (RaccoonStealer)", "value": "bbce7aaecfe5981538518598a00491dd0cf73ff62074b68cdca9a51c009dbde2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637409211, "uuid": "dd62b779-54ba-412c-8c65-33dd6fba676b", "comment": "Malware payload (RaccoonStealer)", "value": "f57f6d0766607203e7f02d81b2efebdcb728b646", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637409211, "uuid": "4821df19-8820-459a-9678-bc4179a20d9f", "comment": "Malware payload (RaccoonStealer)", "value": "ef87e88e829d80df6fc0ac99e6bdf4ce312171e9c7885691023d6cc5df47ec2150a1a1341e8548105634f7fe458beb3d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637409211, "uuid": "9842386f-74ab-412e-a2db-1839c311fd60", "value": "T109A4011A27FAA036E1A2E2346D7082B15D7B7D72A130854B7B894E3D3F716E14E79343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637409211, "uuid": "f98a54f7-8783-470a-9d12-de558ecbd2a7", "value": "f9127c363bcea23d1bd962e71624f505", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637409211, "uuid": "f2bf92a9-9b63-4ed5-91a1-e04a1c6bfbdb", "value": "12288:/Xn6FvZOT/0ekUHJGwWLdxKVTKP51xzsT1onsh+fP:/iBOT/5xMdeKhjyin", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637409211, "uuid": "1abbdd03-3dc9-4d57-9cf9-01d86c659124", "value": 451072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637409211, "uuid": "9705c51b-94ac-47cb-ae1d-7ac617af3a4e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637409211, "uuid": "08fc5fa5-a6a8-410c-a7ac-41493ca3797f", "value": "fefb3ad9f0f596eb173366e7a82b055a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97c99c65-49ce-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1637391220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637391220, "uuid": "106f908d-c247-4260-b290-8ff2b34f80f1", "comment": "Malware payload (Gafgyt)", "value": "b350c797099ce23f6351702c86b5593f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637391220, "uuid": "0c9afa1f-e8ac-4cda-b83b-8fb6a9c48d72", "comment": "Malware payload (Gafgyt)", "value": "bd4dd794495ab8f1dc15c07a78ba4ba37c0327e75c10f0c7e0e167622bffd425", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637391220, "uuid": "4311c099-0e56-4a8e-90ca-04233f457b96", "comment": "Malware payload (Gafgyt)", "value": "0d1698cb25e72c083480f882a213ff353a3fc544", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637391220, "uuid": "a6c23315-a0f2-4885-9f69-96e6b774e64e", "comment": "Malware payload (Gafgyt)", "value": "08c6afd882476852ee6b8b3ef950d2eb7b94c658e6d06d858bb65999d28cf78bb2832c2f6b924ba25779435d014664d2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637391220, "uuid": "c354005c-cb4b-4414-8520-8a7530702a00", "value": "T123833C02E743C6B3CC830BB2029BAA665931BDAA1E269F49F31D7DF45B128C47116F56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637391220, "uuid": "ac8b12ea-619e-438e-b186-59f4532c43fd", "value": "1536:W35b9Vc4N3J6lreu5r4hWj8LXWDloRmF+wVOz+sXcfW7k:Ab9Vc4JJ6liuq0Yz2oRmEwVOz+ucfW7k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637391220, "uuid": "d3cf0108-3869-4e60-867f-40cb5ee7c572", "value": 84999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637391220, "uuid": "54a28e72-7d8a-412e-a989-3cc47a60f11d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637391220, "uuid": "1d37f82f-88ce-4f18-969a-eccd4a8f90e0", "value": "b350c797099ce23f6351702c86b5593f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cacbb8b4-49d6-11ec-843c-42010a9c0014", "comment": "Malware payload (Kutaki)", "timestamp": 1637394741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637394741, "uuid": "01899ab4-d90b-4b35-b76a-eb0a0c69c4e0", "comment": "Malware payload (Kutaki)", "value": "e4cc7fb761fc4110b631dbabf46363e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637394741, "uuid": "bd8aef9e-eaaf-4732-bbfc-141431c970ab", "comment": "Malware payload (Kutaki)", "value": "c0478341ec19cae4fd4093d53e9cc777210ad57122836f4aa911addeacc911f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637394741, "uuid": "5b57076b-336c-40cb-b327-f76ddf68e40d", "comment": "Malware payload (Kutaki)", "value": "f433972fe7fb1b165eaedadb2d31193e94ba2d33", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637394741, "uuid": "720f08ef-83dc-4144-bd29-61bcbc0b6923", "comment": "Malware payload (Kutaki)", "value": "3631af2c77db6d805c0b97fb7b9949d60f3bbe0dca1b9a039456e596d15d2cfded38c41e896407077a52c7a4bf77ae2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637394741, "uuid": "233ad15c-e244-414d-8934-22a3ba1348e2", "value": "T10CD4CF1263E19D86E85A46309DC785F02AB6FC53671B438B318C756E3F77F90482A39E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637394741, "uuid": "45474ea3-9a7f-4081-ba96-8d10857e1d11", "value": "42a06c58d84caf7041b08deabd5104df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637394741, "uuid": "581ddae1-0418-4572-9d02-60609c363427", "value": "12288:s8G2r2i2G292n2l2Y2Q2B2j2T2CRE9h7L446A9jmP/uhu/yMS08CkntxYRm:sHfmP/UDMS08Ckn3r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637394741, "uuid": "9009b7f1-17d6-4e71-b4d7-d22c83db434a", "value": 606208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637394741, "uuid": "b74df0e5-0a15-4947-8b78-388428d83f3a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637394741, "uuid": "a4cb2847-6fd3-4ef2-b871-d62d711f08df", "value": "image.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aad7c9f9-4a25-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637428618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637428618, "uuid": "647df4d3-9af3-45e0-8861-8f3ca06d44f2", "comment": "Malware payload (RedLineStealer)", "value": "01da14f69056908bbb96c3cebb3075de", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637428618, "uuid": "1f85f680-3865-4501-b300-6f5ee37dbd66", "comment": "Malware payload (RedLineStealer)", "value": "c3eb35213fbf2fa8956747d7a4eb433a7b78590c1b14db12ecd31f69abb5d9d0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637428618, "uuid": "a3a732be-421e-4c04-9bdd-2d6a61215ff7", "comment": "Malware payload (RedLineStealer)", "value": "e1cb8682681a3c4ff541b58b19e6f85653dc8b19", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637428618, "uuid": "22436957-4a24-4c29-8ec3-3db9537e4784", "comment": "Malware payload (RedLineStealer)", "value": "fd89fe5eb026de3ac21184e55cd671d67e94ba04c2c9ed6a7d9b293559cf18b2f799cda74c40c3eebb7864b7ea29964f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637428618, "uuid": "e6825457-018d-4646-aab5-05b0e2b4e193", "value": "T1CD842528687FC05980E3EEA62DDCA8FBD99A55E3640C743701B4633B8B51B84DE4F479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637428618, "uuid": "9f2ab881-e5ce-4c0a-8f73-8e7f99544f9d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637428618, "uuid": "214fc9fe-25d7-4761-86e7-479f3ebb2962", "value": "6144:rOIEbKiGLkWrOuRMlSh3c+fg2y2tkQ9dX4Q3A:XEWiIkWrOuRMlSh3c+fg2yKkQ9dX4Q3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637428618, "uuid": "b2f16a7d-de73-4218-b982-3a153a2e7752", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637428618, "uuid": "c47fba0f-9952-4ca5-a299-d67affa9af98", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637428618, "uuid": "a88aacac-452b-44b8-9162-6aa2700648d8", "value": "01da14f69056908bbb96c3cebb3075de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6abbc04-4a1b-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1637424343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637424343, "uuid": "82a09b99-391b-422b-acd1-6d6f23ff9170", "comment": "Malware payload (RaccoonStealer)", "value": "83b62ccce9d742a53e5fe0016fab9ded", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637424343, "uuid": "6934a3ad-156c-4a61-92e4-4ca967791a79", "comment": "Malware payload (RaccoonStealer)", "value": "c41ecbb533f6da059e2996cc5065805d2038ba4d0e670d57939b30b109bd6eba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637424343, "uuid": "607a241b-131d-4f4d-997b-95890feda708", "comment": "Malware payload (RaccoonStealer)", "value": "4ec481fc61cb5fa86296975000c25e0eec7376b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637424343, "uuid": "9db80e45-e6ad-4a36-bf67-5f6a3d75ad55", "comment": "Malware payload (RaccoonStealer)", "value": "51812243c549ef2d0938b8dccccd5c9ba8be0e847c73951c6dffe105f96400f91350650845870b9b84f89ff9e16b867d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637424343, "uuid": "cf9f14a0-d341-4f5a-8ce0-d3e986905231", "value": "T1E8649D00A7A1C435F0B216F849B693A9B93F7AA16B7494CF53D516EE4634AE0FC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637424343, "uuid": "c7c3ab75-26b3-49d2-ab23-986a40ed9931", "value": "bdaee7bf3d7f5fcbbe5fa5d59a50c909", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637424343, "uuid": "f784a9df-8f63-43b4-8f25-d1000e2a970f", "value": "6144:3Q0PhKVfzoi0smjxG8oqv6YH4FXnDwDjkF:3thcnmjxGtOTknDwH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637424343, "uuid": "c0c58e6b-dfcd-48d7-abbe-07ea3a3b1a36", "value": 328192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637424343, "uuid": "77990d20-2208-4166-952b-c59e1b5bd5d5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637424343, "uuid": "4e06e33b-bdf5-4be8-a2f6-09d636f3d3fc", "value": "83b62ccce9d742a53e5fe0016fab9ded.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d1a53ec-4a1e-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637425481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637425481, "uuid": "1cbdf9f5-cb06-4bd5-b342-c4a803502667", "comment": "Malware payload (RedLineStealer)", "value": "094498332e7dde3d032c41457daee8f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637425481, "uuid": "564c43d0-4c4d-4a81-9d45-40b4dea3fb4d", "comment": "Malware payload (RedLineStealer)", "value": "c4e9742a6a418ee7366c594a4f1206d468f6147792407fcd9ac6b452369d88bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637425481, "uuid": "87b20546-375d-4920-8478-2a2d2086fd51", "comment": "Malware payload (RedLineStealer)", "value": "dfd9a40294b4e7e54f272aaa67cbe076d913919f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637425481, "uuid": "c1d843b7-296d-487a-9832-02187edcb1a4", "comment": "Malware payload (RedLineStealer)", "value": "80529df49245df72838fade1b99d34a95f63e06a65939fd471acca7fc0deafcbf08353fc41311392f1799361acb08cc3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637425481, "uuid": "b8f317df-f58d-47e0-97e9-701f4f4c6b23", "value": "T1CF4533522544A93DD78F62F11A269719C267063823E5930C4CCF6F8E2C76EFE8F5D868", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637425481, "uuid": "19df93b4-eeb6-401d-b356-79c090c1eff9", "value": "15aeac4aa1d11f9ad3fc4c4ac7bb9468", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637425481, "uuid": "bd64d75b-98ba-40c3-b771-bc6a489302d8", "value": "24576:MxfRqdKchIS9Xu6d8z7giucwDDXqkEaHNYK3u7oy3NVzLC:ef0dW8+62//VNaAU6NVC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637425481, "uuid": "85dc023e-bf4d-41f8-87a1-40980373a2cc", "value": 1246208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637425481, "uuid": "b899116d-3c31-4a4b-ab75-78d6576568d6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637425481, "uuid": "bd3108b2-c66b-4280-a8fb-fa1635a9296a", "value": "BREELOK.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46bd04d6-4a37-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1637436181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637436181, "uuid": "0ef25e30-7cd4-4ecf-bd1b-6316b5b0bab4", "comment": "Malware payload (Smoke Loader)", "value": "52a4aab96984b740210ce3b0d39b7b1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637436181, "uuid": "336b13fa-bf7b-462f-afeb-052a7a25dc41", "comment": "Malware payload (Smoke Loader)", "value": "c60dca9b2972f1b24381e5be94425981f38d98b817d2dd86c4a8f729c70c95e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637436181, "uuid": "5a9b2655-7d66-4b04-9063-ae3f1e188f9c", "comment": "Malware payload (Smoke Loader)", "value": "49a6e4839f0466eca0a05e0e6e828a218a96c37d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637436181, "uuid": "33a8545b-1ce8-46f5-86a4-1c2310b8343d", "comment": "Malware payload (Smoke Loader)", "value": "d5d9acab70a290e547aefc7d7d200c78b24bd0ed0b5cbc1f53b8fe8e2343f74e39593b9d4599db4815b9edc61dbad0d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637436181, "uuid": "fc4f3f4e-0a2f-4157-93f0-83f5149868bb", "value": "T1AB747D00A7A3C038F4B2D2F849B693B9B53E7AA16B2450CB62D517ED56346E3EC31747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637436181, "uuid": "f2186bab-0ab9-4d0b-8ed1-8f4cf7db22bc", "value": "b2fd25528233ce5a8eaab403b2ce8572", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637436181, "uuid": "02634027-3769-4294-a6a6-1a6596597e06", "value": "6144:xQbL5ehH4X9oLMsnrGvHOsuIi0/Sx1/v:xQbLYhxgsnrGvVuc/SxJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637436181, "uuid": "a2fec21d-4fcf-46f8-ace3-d918fa262057", "value": 342528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637436181, "uuid": "eabe5aa2-a2b3-48b5-8a2b-edd28d5972be", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637436181, "uuid": "9a472c52-46ce-4795-aea8-286d669edf1e", "value": "52a4aab96984b740210ce3b0d39b7b1c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76071e6f-49cf-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1637391592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637391592, "uuid": "ca1a1eee-4e5d-4343-b866-974168eb187d", "comment": "Malware payload (Gafgyt)", "value": "614faf89e6cc2838a8a4ede6eac6303b", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637391592, "uuid": "40fba761-13e0-4ea9-a9fa-851aac4238d5", "comment": "Malware payload (Gafgyt)", "value": "c7d96b42fdc8c33d2818eee2c66028a7908ccd8a64f53b1b89d9dd7110b38c54", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637391592, "uuid": "48d4bc79-d0a2-439d-af64-c230a8f055fb", "comment": "Malware payload (Gafgyt)", "value": "1242270ef0862b4b1f9e7c9805cdd02678e70609", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637391592, "uuid": "02f0e8d0-3494-4add-8052-1b6ff6213cdb", "comment": "Malware payload (Gafgyt)", "value": "e3ae989aa502c89b3614c35671ec06a9d40111af68e5d6d8c44d26e125e2ec2abf007b0d6b052d05d6c1ac456ffd4866", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637391592, "uuid": "56d5ef78-135d-4fcc-b297-0e98ea9c1f5c", "value": "T1C3935D27B552C6BBC08752B42BDFEA615833B4BC0B32720B33D47DA52B259D91E6DB01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637391592, "uuid": "30781041-cbbc-4de6-bd4d-9b01e62a0e97", "value": "1536:W7uJtxNeVE8zV7aDlvhE1hmkJ0S36W6bWjK3cyPXfH0mA+KWOXFseaZYxe:4SsVEeVMlpmXJ0O6WpjKMifUm/KWOXFE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637391592, "uuid": "54802992-4915-4428-b76c-4545044c268d", "value": 94679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637391592, "uuid": "adf188de-7970-4c95-9886-8229ef6e1815", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637391592, "uuid": "702e8d9e-f85b-47d3-a4b3-71cbd9d3cbd2", "value": "614faf89e6cc2838a8a4ede6eac6303b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35fca541-4a37-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1637436153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637436153, "uuid": "2f3aadb3-cffc-4ec9-9a62-4b341b0c4928", "comment": "Malware payload (ArkeiStealer)", "value": "da860a8dc7c014fd938007c9101c9334", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637436153, "uuid": "2141c539-d058-4edc-ae9c-9c0a85f6158f", "comment": "Malware payload (ArkeiStealer)", "value": "c85b3ce4557c064062590d402502ac1252c32dddc997805ec437f21514fa2e4b", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637436153, "uuid": "7123b882-0e56-48e7-85bc-9cfd9e5becc3", "comment": "Malware payload (ArkeiStealer)", "value": "d651983a367a77f3d6965031c0425c233bfac25f", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637436153, "uuid": "2fa0335c-c401-4993-bf65-bc6c9b94a1f5", "comment": "Malware payload (ArkeiStealer)", "value": "459d0ff9b0618df3785aaf245dc3e5514298c61f001714cddf00a89bc16d410c5ecc5c1b6f44bb41534b362141a58a37", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637436153, "uuid": "3395f042-57f1-4905-a241-1ccff2dd9eee", "value": "T182748D00A7A1C035F7B216F8C9B5A379B53E7AA1672850CB52D827EE56747E0EC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637436153, "uuid": "58ececd7-41f8-4205-a943-32c13833c739", "value": "b2fd25528233ce5a8eaab403b2ce8572", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637436153, "uuid": "404f0ade-bd69-4d34-a660-e98a69f635e9", "value": "6144:5nclDa2ookE8y5qA98M0VZ2BR3yFYY2oIm3Cgp4TrpdMAf:5clD4okRW98MPBx4YcIm3wnp6Af", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637436153, "uuid": "1423949d-7191-4537-8849-99724b16d79e", "value": 357888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637436153, "uuid": "467039c0-f20b-41d1-871d-a61c71be54bf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637436153, "uuid": "cf6543bd-2431-4d1b-9ed7-983597dbd03d", "value": "da860a8dc7c014fd938007c9101c9334.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a273eb8-49e8-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637402229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637402229, "uuid": "24483ae3-2bc1-40ba-bac2-94204de7d06e", "comment": "Malware payload", "value": "07318310cb1d2bb0df339214f4ed0759", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637402229, "uuid": "6c0c55f6-05c4-45c1-98b5-da48a1427318", "comment": "Malware payload", "value": "cba5fc9160fa5273a7469af3c5a4a2abe429934604d36852b6203c3954113b69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637402229, "uuid": "0df2eb4a-b8cb-4c90-8c45-ac79010a2133", "comment": "Malware payload", "value": "c86a02bbe47efb1bfb6b6f7f9cca1310a6e068a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637402229, "uuid": "9f8f4f9f-aec7-428b-9465-a803e7f3dfac", "comment": "Malware payload", "value": "22c4212283118adf687c59e11e23906513baf16eba7aee90c38dac68a6c5aa33a13a2ecccac324d7c935561abaf7b786", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637402229, "uuid": "932fff40-6898-458e-8024-76044715cec8", "value": "T16074399D765076DFC86BC476CAA82C64FA6074BB431B9207A01716EDEE4D89BCF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637402229, "uuid": "716a6fbd-204c-46e6-b1a9-f7d2ad9c22f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637402229, "uuid": "6e7ba89b-37f2-4612-aacb-326a690c30d3", "value": "6144:ptNPPjfqN7xgd1fcZo/Y1QSsyNlnezMxmod1WBwSZMOxPrdBJ6Z3rt+jC9FlRvQN:7NPLyDgdhc8Y1QSsyNlnezMxmod1WBwC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637402229, "uuid": "3df5df88-75b4-41fb-b1a3-4dcd3c65988c", "value": 353792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637402229, "uuid": "5a8885fc-0d88-4745-a72b-4a3aaedf875e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637402229, "uuid": "2d5f74b8-4728-4ae4-9642-9057ef026b22", "value": "07318310cb1d2bb0df339214f4ed0759.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fa23593-4a1c-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1637424572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637424572, "uuid": "1e540a2f-9d84-4b03-af5d-504d8b96a3d8", "comment": "Malware payload (Smoke Loader)", "value": "55c4ede4aac565c4def9e011a197a786", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637424572, "uuid": "c1c73594-817f-406e-9a6b-5179f796a01f", "comment": "Malware payload (Smoke Loader)", "value": "cc4ae2644ce0c4128deaba7bf562089481c866df6a3591c9f0cf6bb06e3e62b7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637424572, "uuid": "5b13a309-dbcc-4004-a6d8-cfc9ac2a2dfe", "comment": "Malware payload (Smoke Loader)", "value": "7ecd6111f4970402f28dbcceeb28827673fff30b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637424572, "uuid": "880dd255-5556-4ef2-83eb-477ba11f12e0", "comment": "Malware payload (Smoke Loader)", "value": "d0b47c9d7b3c87710889f5de97b522c25d8bcee437cd36860849b37df7e1cd128d4a3521155e8a3b3bf3e370c1885698", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637424572, "uuid": "5de5332a-7228-419a-bc73-46ce7c1c6c01", "value": "T192648E10A7A0C035F5F312F849B693A9B93F7AA1AB6490CF53D516EE56746E0EC3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637424572, "uuid": "89984e12-825c-4f7e-bf7f-64b50f88c828", "value": "bdaee7bf3d7f5fcbbe5fa5d59a50c909", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637424572, "uuid": "61134f9e-97fc-445f-84c7-99bfb7c10e9e", "value": "6144:HnCmqzUFiN0DOosV0gbxZG+7sP6YG4wmzSXG4BR:HQz6itDDbxZGggC4zSXfBR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637424572, "uuid": "c1902dce-16d3-4005-9224-9e953fb493e6", "value": 329216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637424572, "uuid": "af941ed7-e26c-41ab-aeac-ac0920ebbb49", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637424572, "uuid": "62acad12-63e3-4e9c-9981-0fb8f350b486", "value": "55c4ede4aac565c4def9e011a197a786", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d38bb348-4994-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637366409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637366409, "uuid": "aecf159d-421b-42a5-9bef-6e4fbf50b557", "comment": "Malware payload (Heodo)", "value": "45ddb4f4715434565857eebc761f3f3e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637366409, "uuid": "23d216a2-c37f-41f2-87d8-163a6736161c", "comment": "Malware payload (Heodo)", "value": "cc572d7dda3f7af6d2eb196ed1884004be047dfba7bc85f157064ff6a4f01734", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637366409, "uuid": "42046e2b-df40-4861-b30a-ea8bd3ab5ca1", "comment": "Malware payload (Heodo)", "value": "ca4e791de0b983121cb7e45ce937d615d4d610e6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637366409, "uuid": "64b4ed88-5a01-471a-b6d5-4c64f6ca665f", "comment": "Malware payload (Heodo)", "value": "bf26d25803008f564c4c5317addded55f5a14048ee652e63d74967e15ad9f466623ac9f9eb0f1f7e4764250dcc257a6f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637366409, "uuid": "209d2a9e-18d8-4663-8a47-8c948482e010", "value": "T1FAA4CF11B6C29432E1BE05303978DB5608AD7D318FB4CAEBB7D82B2D4E741C19B35A76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637366409, "uuid": "6b7b207b-08cc-45c2-bc5d-778ed6097f79", "value": "d2a2f4c68a7903cc45764257f8ed7a2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637366409, "uuid": "a7102718-7564-4f84-b912-5e0f8fc5b2eb", "value": "12288:+AriSOG9c0jc5mDQxqfeR4iTQG8Ht3WZ6y1zTV3z1:vof4DQxM24iTFUVWXpTVj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637366409, "uuid": "d84b26e4-4fc7-49c0-aa5b-21a663eed01a", "value": 481280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637366409, "uuid": "66b5d1ff-5649-4159-b103-4a72224f4a0f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637366409, "uuid": "f9cf3991-8854-49a1-96e8-fd18a90c86ba", "value": "emotet_exe_e5_cc572d7dda3f7af6d2eb196ed1884004be047dfba7bc85f157064ff6a4f01734_2021-11-20__000004.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11dc4e2e-4a24-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1637427932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637427932, "uuid": "f84ded37-dfcd-4720-b13b-a8401235adae", "comment": "Malware payload (Smoke Loader)", "value": "655ff3e5cdfbf7126c361702b9504ff6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637427932, "uuid": "fb72e12e-203a-4d18-9f4d-7a3f25cbbef8", "comment": "Malware payload (Smoke Loader)", "value": "d07d3fae50f2902ca589d857ffc91473c52b5801f24f94497cd53fea16c411d1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637427932, "uuid": "b26c0420-a8de-4095-a5c9-9b17cfd88994", "comment": "Malware payload (Smoke Loader)", "value": "714a755ccae4ff42ed9050c79a7262669efed166", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637427932, "uuid": "3940d1da-89dc-4b49-ba40-d01b511e4255", "comment": "Malware payload (Smoke Loader)", "value": "5e32821f868c0351ed533fa680d10df10642f48f302ba6581ad20aa4a36acba742b2a54f41c1f147b577bdf5bb3c257c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637427932, "uuid": "f02e14f8-7f99-4062-b2cf-b2fbb7e92dfa", "value": "T191748D00ABA1C035F5B213F849B593A8B53E79A1ABF490CF72D516EE5674AE0EC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637427932, "uuid": "40e33945-0d80-41c1-a28c-c3e78344ce5a", "value": "b2fd25528233ce5a8eaab403b2ce8572", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637427932, "uuid": "3c6b41e7-a41f-44e9-b864-40ab1c826f0e", "value": "6144:UC9ksmPJSuIwViN94LO8XBG4QLPyIk0LjqQiE:U71RSuVp68XBGZjyKLjqQF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637427932, "uuid": "5589c6f6-2c5f-4ef9-819c-aea78048fe7e", "value": 343040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637427932, "uuid": "53f58ba6-f4e3-4d44-8acd-ec62e7dea89f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637427932, "uuid": "8d1d92af-e797-400d-8a08-e10d7dbe9016", "value": "655ff3e5cdfbf7126c361702b9504ff6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7812fadf-49e7-11ec-843c-42010a9c0014", "comment": "Malware payload (BazaLoader)", "timestamp": 1637401904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637401904, "uuid": "ebe0c4b1-ae0a-402e-8cbd-02cfbedcbd79", "comment": "Malware payload (BazaLoader)", "value": "96876015ec0de0704d7b51609979e297", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637401904, "uuid": "2fca7fa7-7a3b-4f09-8083-d88d88b86a59", "comment": "Malware payload (BazaLoader)", "value": "d1c628414464ca89e07404650c490ca1e3dfab596b4ec603e3811d37f48bbf7c", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637401904, "uuid": "fc802177-1148-45e6-a8a4-2be25db4eef9", "comment": "Malware payload (BazaLoader)", "value": "05a0a65e02c142f057eb2bd5a096d16edc054348", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637401904, "uuid": "64a67b0f-0f28-4418-bac6-bf8f4941fdc9", "comment": "Malware payload (BazaLoader)", "value": "ecca7ec64fa79a89ca1f1fcdf8f86b865d85ddf252add6ebd1b64f697f0ff122f4a2bdb24315fe98aa88caf7bc0b7007", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637401904, "uuid": "dc861f64-2b37-48b5-aa37-9bfa5f3c0c82", "value": "T153C4BF05FBA80069E12A417CCC334681E6B67C49176196DF23BC5B7A2F37BE0157EB62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637401904, "uuid": "160109e8-4350-453a-91df-e9a154b63fb1", "value": "1a3e40f664dd8522834526b4a62c8c92", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637401904, "uuid": "81f60821-070a-4d2f-8ff8-e874633e500b", "value": "6144:aAhTGSV0YPcEzjF2OdoHxWlMyMhqszQdoopP02uEgsdALbxohUCGJsjaIjWvQRaf:aLhEvFPdoHxaMEARom88QR4QIYlj4FJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637401904, "uuid": "2eaaffb0-30f8-4b2a-950c-96660a4ca7f7", "value": 564736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637401904, "uuid": "6c220835-e938-4350-a2a2-ada11782c08c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637401904, "uuid": "e604f7f4-720f-4619-b39e-fb373e2757c9", "value": "96876015ec0de0704d7b51609979e297.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5956a18e-4a15-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637421609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637421609, "uuid": "ae741682-c8af-4af0-a7e7-361a0169ec6f", "comment": "Malware payload (RedLineStealer)", "value": "c22ba8a93e20487fc1f37cbab8d1ece6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637421609, "uuid": "09421846-fe05-4487-85b7-9516f03c8504", "comment": "Malware payload (RedLineStealer)", "value": "d38921180eefad28ad164b96e902491cc9fe2a4f7a6a42ca08a06c6474d431de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637421609, "uuid": "17a5fd86-8d33-404e-95f2-b10494c5fa4f", "comment": "Malware payload (RedLineStealer)", "value": "c67ee397968029b40615940d639f729aaf8350c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637421609, "uuid": "1da20020-b1df-4134-b372-4f89d2172034", "comment": "Malware payload (RedLineStealer)", "value": "db7411b421cfa9d8e38cc8caf04b0c634ef6df0362f9584ade52ce265a7533ee165cb653e0b49abffd8ca59f318a49c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637421609, "uuid": "54638d10-cd02-4b33-b60b-bf1246a0e524", "value": "T1AF648D10A7A1C434F0F312F849B693A9B93F7AA1AB6490CF53D516ED5634AE1EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637421609, "uuid": "319725e5-a622-412f-9c07-195f61a42bb5", "value": "bdaee7bf3d7f5fcbbe5fa5d59a50c909", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637421609, "uuid": "e88fae20-e1e5-4234-9305-70f22611089f", "value": "6144:lTR0hqbJ7U008uQIGR3aw6Yn4OkYGQx/o5/8:ldVBXuQIGhdz8YGQJo5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637421609, "uuid": "84f73631-4110-4d9a-8d4e-590092247ca8", "value": 328192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637421609, "uuid": "f41e9a0d-125a-4795-917a-5c813259e71a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637421609, "uuid": "8681004a-c849-4951-9800-f5905578d7d7", "value": "c22ba8a93e20487fc1f37cbab8d1ece6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0eea075-4a33-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1637434695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637434695, "uuid": "82afad56-c047-4649-b176-e503ed0c84f8", "comment": "Malware payload (ArkeiStealer)", "value": "e05fd67f69e1ce73a35e3b13852aa3c6", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637434695, "uuid": "0c0da593-3c1d-4394-8af3-358f3e14846a", "comment": "Malware payload (ArkeiStealer)", "value": "d5b763c1b69d9e6a312c3282792a537b6a72c3be6b59e043ffa6a8338ae0a817", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637434695, "uuid": "1fe920f0-94ea-44a4-a3b3-c9726983e1cc", "comment": "Malware payload (ArkeiStealer)", "value": "e8014a7ddb4a939994710c7afd9237d450ed58a3", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637434695, "uuid": "cffaed0c-2ef6-4c8c-8047-2991000465f3", "comment": "Malware payload (ArkeiStealer)", "value": "533d0432497c5d9a945604463695aa1c58d6cfabd11d107918666765e905cfb71c64f19df240f176f78508966b8e3f80", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637434695, "uuid": "152f6247-b3d2-41c0-80bd-11a5413f9461", "value": "T19D549E10ABA0C435F1B716F85ABA9379B93F7AA1AF2494CF52D116EA43356D0EC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637434695, "uuid": "778e4b35-a718-4b2a-9d03-d63ca67ca7a6", "value": "5a1f25b6d455560f38319cdc6a8b12fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637434695, "uuid": "4ef15a55-885b-455f-9a17-20c58b4f6de9", "value": "6144:ih2rOMv5BdH4R4TS/l3b4tZsS3NOzkz58B:iVMbyRCS/l3b69NOzI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637434695, "uuid": "2ae7c02e-7730-4fc8-805b-30e7ef79099e", "value": 300032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637434695, "uuid": "af08a436-b93d-4732-b18f-0c55c0977ff4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637434695, "uuid": "c445367d-c555-4dbd-84fe-e0b91d86c82d", "value": "e05fd67f69e1ce73a35e3b13852aa3c6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16501bb5-4a53-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637448125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637448125, "uuid": "30f09925-4920-4915-8958-3df4969e51aa", "comment": "Malware payload (RedLineStealer)", "value": "463da4a49b7ca37e89ddebcde02e9c3d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637448125, "uuid": "682dbfb7-938e-457f-aee0-05d795befbb1", "comment": "Malware payload (RedLineStealer)", "value": "d813cfe0969c5ffd66db1fcb585e10cdd426da03b2aefed1a5aa27f1ef396993", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637448125, "uuid": "b1bd2580-5b19-4f40-bbef-06589a146d05", "comment": "Malware payload (RedLineStealer)", "value": "a4d8bcb057624dd7c90feb6f60d828ff8250d8db", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637448125, "uuid": "113feff5-9ca5-4b8b-a897-5c49219b9d90", "comment": "Malware payload (RedLineStealer)", "value": "5621d6d4dd8264410b12dbf66262cef9ac456bbfc9d23ac5920384c7ae7a51585eeeb547c71efafb79083efb9e363b6c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637448125, "uuid": "66bf5542-8f1f-4fe0-bc4b-d8d0d15b93fa", "value": "T11C44DF2031D1C1B3C4BB113044E6CB795A7A70721B7A95D7BB9D1BBA6E113E1A3362C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637448125, "uuid": "adb41aa3-8bd8-4db7-bb36-adc3a54ba2fc", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637448125, "uuid": "e30fd6ca-22f5-4119-b893-1122a0a83b37", "value": "6144:+DKW1Lgbdl0TBBvjc/vBq0nAGNIqBKvK4uUg:Yh1Lk70TnvjcRnAyqvDG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637448125, "uuid": "cd8019d9-328e-479e-9ea4-eaa2411c3265", "value": 254976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637448125, "uuid": "832d55ea-ebea-4c4b-8b9a-0793877260da", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637448125, "uuid": "a2bf0212-5c6b-48bb-aabe-d87cdb6bff3b", "value": "463da4a49b7ca37e89ddebcde02e9c3d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "308dd773-49e8-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637402213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637402213, "uuid": "3b934634-9379-4bc2-aabf-91eafd6b4610", "comment": "Malware payload", "value": "0e0d42c0458316bd7693b442251d7ff2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637402213, "uuid": "88374980-1f09-4cd2-bb9c-3e18273a037a", "comment": "Malware payload", "value": "d8f09ceb5f0956277b36af5b751c353891420250fc5aab01538e8d78f5861934", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637402213, "uuid": "41b75d0d-20c3-4d4a-a582-1580cf6c2c05", "comment": "Malware payload", "value": "571a024ef53d137b059db3be669055f53a330d98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637402213, "uuid": "66f05c9c-eb41-40a0-8b57-d1ebcf868cc2", "comment": "Malware payload", "value": "aa5f7677310c2b694bf9d0420841c25bddb90ddd222c14c44ee30e570aea5c5079ee492c49bc411faf40b7b0ccdfd81a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637402213, "uuid": "5ed5c8d0-ddb3-4663-8f08-334cb5f44876", "value": "T16B34A39D365072DFC867D872DEA82C64FA60747B930B9203A01726EDEA4D997CF150F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637402213, "uuid": "44fb0597-4fb3-43c7-8a4e-9bcdefd9984f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637402213, "uuid": "21a9eacf-210f-48dd-bb22-5f4717145a4c", "value": "6144:yKDcVBww1GjCiC7PSavnIi+GjebhCb/ngn:yKDcViw1GjCiGaavnIi+GjebhCb/ngn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637402213, "uuid": "ec1fad35-5975-4529-b44a-3bd7646b8420", "value": 232960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637402213, "uuid": "75acf818-965d-435e-9c96-f7eb5962e723", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637402213, "uuid": "6fc68423-79cf-40eb-b168-1daa20c7d235", "value": "0e0d42c0458316bd7693b442251d7ff2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3384c64c-4a1e-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637425411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637425411, "uuid": "c6231dfe-0214-4af2-95ab-b2cecf6bdc53", "comment": "Malware payload (RedLineStealer)", "value": "489ec43439f6105bd2b0292fb4a10a49", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637425411, "uuid": "75500e3d-7132-414b-9f59-fb29894bb8fb", "comment": "Malware payload (RedLineStealer)", "value": "da2a0a00fe54fe1a2ada397081dd0892afdb5662e6f3898c859ec6e19501a5b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637425411, "uuid": "c5bc4580-3954-48bd-81c8-319576f00554", "comment": "Malware payload (RedLineStealer)", "value": "91d6eb88e70a474a84627c067f7f8466dfd79ce8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637425411, "uuid": "58c7b20b-b861-4107-84db-a0e2bfac87a4", "comment": "Malware payload (RedLineStealer)", "value": "dc51b86600480eea722c9857504fd3f6d0b3e933cc6bedb518f7e789faa90f92c1023a815a279dc1d2fe8fe81168b219", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637425411, "uuid": "0640e984-07de-4028-be6f-05cef55a36ad", "value": "T193A35D3067AC9F19EAFD1B75B4B2011043F0E08A9091FB4A4DC154E71FA7B865957EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637425411, "uuid": "98dc5d2f-e2ea-41f5-b879-28ce1d74c547", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637425411, "uuid": "4a31820a-dab5-4d13-9a9f-5cf9441a31e9", "value": "1536:yqsynqBxlbG6jejoigID43Ywzi0Zb78ivombfexv0ujXyyed2mtmulgS6po:QYi3YD+zi0ZbYe1g0ujyzdyo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637425411, "uuid": "4f8d29ac-e851-48e6-9c06-98a406e5b67d", "value": 97792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637425411, "uuid": "be6891af-f2f7-4d0c-bd4d-a92b197c5e0b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637425411, "uuid": "249d4326-80fc-4a3c-8571-1a85edc726a2", "value": "Brawl Stars Gems generator.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ffa3132-49e5-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1637400977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637400977, "uuid": "03834524-98a2-4148-b4d2-831fbfefb573", "comment": "Malware payload (Loki)", "value": "6a51b8b71173219c11f735c7ad16f741", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637400977, "uuid": "dc49a45a-9931-4ccb-b4a8-bebd3f3c230e", "comment": "Malware payload (Loki)", "value": "dc2a0f6c36043029df5292edc1398b39171a483ce512be5fbc5848cff84b6a1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637400977, "uuid": "1337ceb1-192c-4a1a-9fda-5f1db697b63c", "comment": "Malware payload (Loki)", "value": "a5bfa81c7642ed27696eed04135cb6b5b5db8a44", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637400977, "uuid": "bf81e5b3-b7a7-49e1-907e-351a08d08d3e", "comment": "Malware payload (Loki)", "value": "ffb3dfb24490da2883b6c98ddeee7ffc371cd976fa9e3b37a6128f6f02c7b1ee7fa4bd232fd1f3277784e3be49436adb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637400977, "uuid": "58d96644-289d-4b45-997c-363a21e7f16e", "value": "T1F854128422F13701CDFC4BF85AE11504A776A6565929D62D2EC7A0FA287FF808790FDB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637400977, "uuid": "2e88085b-f4f0-4c08-a05d-b0d507bee19d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637400977, "uuid": "dfb6163b-b649-4ea3-8d67-5cd44feda984", "value": "6144:+9cjbikizwU0yrwlGVDsirdjWCfth8diWSoQWSNR7Oq:viM1yr6JilQxQWSNR7Oq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637400977, "uuid": "45998f6b-6ab4-40b4-8904-84039911c9a4", "value": 284672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637400977, "uuid": "be6796a6-3472-4ade-aa1f-21b485a0e406", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637400977, "uuid": "3cdede5b-a11b-4430-881a-8cf4d1af6eae", "value": "6a51b8b71173219c11f735c7ad16f741.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeaa1fbb-499e-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637370642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637370642, "uuid": "f4e31c1a-3bcd-4eae-9a37-4f0035a14e1b", "comment": "Malware payload (RedLineStealer)", "value": "860c180f8e614d3314b8f058d2e91a8d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637370642, "uuid": "a4676c6e-47d7-4c9e-b11d-5d808eb6bee1", "comment": "Malware payload (RedLineStealer)", "value": "e1917f133b3838845a0611ae4e9ac5db1479461c18644d1739f058c2adc4d9cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637370642, "uuid": "206fc6d5-7d50-48fe-87d7-c049181e47da", "comment": "Malware payload (RedLineStealer)", "value": "aee319eade0123403551a7a6e9fec06bd940dd2d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637370642, "uuid": "037aa797-4eec-4388-acd5-545b888d4928", "comment": "Malware payload (RedLineStealer)", "value": "cbc1649884a8f7ba742e7430a619d8cee3d7ae02e86774739f77e97a8a4f22c52a6a6e8a457ba183402d45b346dacc04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637370642, "uuid": "3a4a5341-eb5a-4abf-9b49-41bbeae3b4d3", "value": "T11E5633307B4341FAEEC262380EDC6FB73165D789AB2085871362993E6D6C4354A0BF79", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637370642, "uuid": "fd9a9eb7-68ed-4f3d-9118-f3c684f067c4", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637370642, "uuid": "e6f1975e-e440-4299-9d41-b8f90102b71f", "value": "196608:xILUCgvyrTvJNKmq9N58VvQgjxjP2h8ZGDq5:xEdgvoTgUXZdiW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637370642, "uuid": "9094c83e-337b-4500-b833-c1363f08e72c", "value": 6462024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637370642, "uuid": "ceab5430-cbf4-4aa6-9994-7d8334ce4345", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637370642, "uuid": "9950a92a-6185-4056-9b6a-f34e7aae22e2", "value": "E1917F133B3838845A0611AE4E9AC5DB1479461C18644.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d65564fd-4a16-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637422248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637422248, "uuid": "1d36bf94-b55f-42a3-a635-cdac02b5f063", "comment": "Malware payload (RedLineStealer)", "value": "a7b264cc1598d14b3e7a61bca67e5489", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637422248, "uuid": "2c982ef2-d7a1-4610-9a1e-03367434cbdf", "comment": "Malware payload (RedLineStealer)", "value": "e2193af798b2f5bcc674474c9d1f655ea69f209268722c96f2c5dcc3d030a0e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637422248, "uuid": "93187a78-bb77-4ca6-9c3c-be560d8c14f8", "comment": "Malware payload (RedLineStealer)", "value": "b58174cbbaf789df54f6aec419a2396d41354ee4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637422248, "uuid": "4b4699de-7046-4de9-a60d-64a1418f66cd", "comment": "Malware payload (RedLineStealer)", "value": "07ca7ce1f86464352735e0de30c277719371640c2341892ec705cb0476872c4d413b82cedb068a0ac54b1f7ce2e8e8a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637422248, "uuid": "e1de7136-51ab-4380-85a4-ff6b654b8864", "value": "T1A67401021E6CFA68D0D57F3397CB692507B75CE54A33C9EE2E089E092711D012E6777A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637422248, "uuid": "a34ead2a-aef5-449d-85f8-8607102d62ac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637422248, "uuid": "05143680-791b-49d3-961b-52882a8b9170", "value": "3072:CD09vEQUcM98b3EZn1MK41FPhdQcU27xLtbpJp6RxAAwSxgO63ikvQ6U7d26T4Hv:zhEtcMSUF1MDf9jbgxg33ik4Zl+35n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637422248, "uuid": "b27e783b-faeb-4e32-b16c-6c0963d9e108", "value": 363416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637422248, "uuid": "0e851036-410c-4596-abc3-81285a1b0527", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637422248, "uuid": "4567411b-71ac-4137-a412-6290a25cb763", "value": "a7b264cc1598d14b3e7a61bca67e5489.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de5c42b6-49d7-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637395203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637395203, "uuid": "73a07ef0-487d-45d4-99f1-63b916a4afb3", "comment": "Malware payload", "value": "7b7bb9dc106f9d61b2edd11314d4ff66", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637395203, "uuid": "263c2fbe-6031-43f9-b922-35c9535a06fc", "comment": "Malware payload", "value": "e475b7c7a75c53b5b325d2de86c69c6c92d8ddd0fee92ee69f8e3028c06e9fd9", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637395203, "uuid": "ce21f759-de1b-4d18-98e8-ee15cebc0f08", "comment": "Malware payload", "value": "88ac6bc43eef8f596f957e316a629964290b0c82", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637395203, "uuid": "07801368-a95e-45d5-8776-aead4be6b553", "comment": "Malware payload", "value": "96c91cf30d7e4bb3ffb859ea40a0a7a6ce0d48df45ba0dcc52d3412930510301517df32b2157d1b20e0d2cd21badf61f", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637395203, "uuid": "c319e9ff-78f5-4c8f-83e1-7d6571a85d58", "value": "T1F77304679515DB13E056C7F8BE4B1E296F0B074CA4C632EE20631D8F6E147725ACE42E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637395203, "uuid": "6a1a78ed-a3d3-488d-bddf-1f4d4fab9858", "value": "1536:iEzF2b/S89Wf/mHfjoemr/3lypPpHSNZetooifW09lZw7mv:gbm/eLHmj3lypVSNZetookW0Rww", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637395203, "uuid": "796ea2a2-3fc2-4d13-90d8-0b1195c275ad", "value": 74981, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637395203, "uuid": "22dcf667-b0a7-4082-a530-0e2267baca1e", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637395203, "uuid": "0281d201-4061-42ee-9bf5-b17b104d82f2", "value": "7b7bb9dc106f9d61b2edd11314d4ff66.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed183333-49eb-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1637403818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637403818, "uuid": "720ea9dd-b4b6-4238-90ec-433bb69a1809", "comment": "Malware payload (ArkeiStealer)", "value": "cccd1ff11e880394e1d3297faf57e748", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637403818, "uuid": "9cb77746-d57a-4123-99b4-994fa0a2a461", "comment": "Malware payload (ArkeiStealer)", "value": "e5c9526178cf112e26096bb27e7fd175dc85a733b1e70c710794d8bad3369cff", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637403818, "uuid": "6b282bc8-7635-4972-ab41-aa032420c386", "comment": "Malware payload (ArkeiStealer)", "value": "24dc1c800b2a0a22881e138632eb6babb7565b86", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637403818, "uuid": "162b4f6d-258e-40c0-8ab5-46a0810a79ae", "comment": "Malware payload (ArkeiStealer)", "value": "8af43015f8b4d778bb68df703d95208b9789188d5420f75b0bcac8a53f98d9f297acff904103c3b9db101c6b920a2ba5", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637403818, "uuid": "d8b18303-ab0f-477a-bca5-683923a6386e", "value": "T16924CE2037F2C472E4B7193098B18AE10A3B7972D675D45F27A8172E1EB02DC8E7A753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637403818, "uuid": "f0401a0a-f68e-4eff-b859-de0249ee2fb8", "value": "9f36e28e95ecac65660050c1a70ebbaa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637403818, "uuid": "3c62df9b-bf10-4f7c-8485-45d018895356", "value": "3072:G724Gp1UJ8WFTctczX7XhjQGcTVyYm2CuuGqX8zEmZaPYqo+:LUJ8WFTctEXtVcmr8IyIz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637403818, "uuid": "cbfa9836-de34-4e85-8f8a-bc436bca37ba", "value": 219136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637403818, "uuid": "7a1b3c6a-9498-4075-b024-df04524b2c87", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637403818, "uuid": "a25a92b3-c95a-4a13-8299-3eb48ea6d996", "value": "cccd1ff11e880394e1d3297faf57e748.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ceb87ad-4a47-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637442982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637442982, "uuid": "e3225156-9869-4869-9aac-32283bc887ce", "comment": "Malware payload", "value": "11d6257a8b9377b8790ada36e2b26289", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637442982, "uuid": "b734e730-ce1c-436c-b863-d6cd8400c635", "comment": "Malware payload", "value": "e6f8518ccc5ac3357264d08a4605351f3fd5cb5dcca0733b6ae3db2ce263c6cd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637442982, "uuid": "84fdb7fc-a2f9-4133-8f88-c7aa3f0995c6", "comment": "Malware payload", "value": "2c6e3b36940202442338cf5ab4fdd09bd5b5fddc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637442982, "uuid": "e5299a35-c17d-49b4-8143-d47aef084e58", "comment": "Malware payload", "value": "5703ba140dfc67b5fb6b532808bc7fb7ee2b2f9ec11a4681f0747681c3a40fd8bde2c8fcf18ba9ac6408f80a156c4f04", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637442982, "uuid": "6393ffab-77da-4440-bee3-6732366f8b0b", "value": "T14AD533882459389EF42F4BB13BAA7C4F195F79A123C00AD2155DD7E54EE092F8FA205F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637442982, "uuid": "1e7994fd-6738-458e-b7ac-506954a6b7b8", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637442982, "uuid": "00b8c344-c485-43a4-b44f-72b6aafa1c77", "value": "49152:nIx7+gw4C4VQymJE+0fKHZGT7nBH5h9eNtqxoPsITo+s/ShJchaf7a:E7+x9qmJb6uA7nBZho0R+XKhafW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637442982, "uuid": "82dc51b7-7104-4c20-9803-3ba928909067", "value": 2804480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637442982, "uuid": "104d5903-9b49-421d-8c86-3ddf50e1ad6c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637442982, "uuid": "82b0598d-974a-4601-8df3-4a8d93cdb02d", "value": "11d6257a8b9377b8790ada36e2b26289", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7525c56c-49de-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637398033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637398033, "uuid": "b64215a4-c819-480d-8315-c3f7d5da1adb", "comment": "Malware payload (Mirai)", "value": "84c6c0b37993a74154e92069b3f6ee83", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637398033, "uuid": "6ad784ca-f46b-4c33-b19b-5f4793da9414", "comment": "Malware payload (Mirai)", "value": "f064fb62d6dff9b28579b75ae9f1d5694ed64f944426aed41467b4703ce94664", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637398033, "uuid": "a941f232-5f46-491c-bba8-b77f687d95b5", "comment": "Malware payload (Mirai)", "value": "35dd1af94807aa22026cd97c02a1421a06420c77", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637398033, "uuid": "2f3f512e-081b-4c18-9168-3279557772d3", "comment": "Malware payload (Mirai)", "value": "3e21adea25eca0d4f15568067f63868abee5c7c32e24800ce432007254e4b0138feecd0d2281bb9c5af904c72ac1138d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637398033, "uuid": "7ffd3fd6-0501-41a7-9ae6-b5d58e5c18ff", "value": "T18BD37CC3FC509F7EFC47E7B6840B86057231E7E00AA24726B6536963B9640D92B17F4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637398033, "uuid": "6aab8281-6a19-47bc-b293-b5f6a2581381", "value": "3072:kNKCQCODnth6UCuc53z56wZyV7zdvekCM2:FtHnc5jRyVlvUM2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637398033, "uuid": "55c62970-a9f8-47ef-9d0e-7659312b3f7f", "value": 135220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637398033, "uuid": "4084795e-b6cf-479c-b356-f2c3a0b32110", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637398033, "uuid": "3d07b04d-0dbe-4a86-bce6-104bcd1f2da3", "value": "84c6c0b37993a74154e92069b3f6ee83", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e83430d6-4a28-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1637430009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637430009, "uuid": "9c47e0ed-1528-4b9f-aa62-d4269fe7b7a5", "comment": "Malware payload (RaccoonStealer)", "value": "a93ee3be032ac2a200af6f5673ecc492", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637430009, "uuid": "8e7f3b62-89de-4bf7-9640-388152f82433", "comment": "Malware payload (RaccoonStealer)", "value": "f106e2efb90c57289bbe57b3be618c063c1bc70f3eaabd2afa73e53c2168a54d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637430009, "uuid": "d303f4d1-a6ab-4a3e-bcb3-e3965ca60fc6", "comment": "Malware payload (RaccoonStealer)", "value": "a6fb35b4230ae92ae50a2f3a4e7f0ca7341e9f1c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637430009, "uuid": "4c450133-0e49-4b8a-9ebc-f7624d712365", "comment": "Malware payload (RaccoonStealer)", "value": "e1cdbf5b49957968ad704af89fd668311add38030ed45f7e9d0a085589ff033101135b74a3dc2f5520696f9f3428fa69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637430009, "uuid": "c2ac0cfb-3524-4e92-9f80-8e34a974c299", "value": "T17EA4012077A2C133E5D285341C71DA601A7B7CB25639889A37781A7E3F633D28E7A753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637430009, "uuid": "0d42a8c2-0441-4811-917e-86b092364304", "value": "d8d57c6d7c1f3570e93e87f831cb3f7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637430009, "uuid": "79cf36ef-b48f-4f1a-914f-14c63cf7901d", "value": "12288:C4r2vnD/TSzoIBeBji4SDnjRgXaioZionazs:C9D/TrIBqMDn9pZu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637430009, "uuid": "8b27f749-b8e2-47eb-ad40-df361eb76624", "value": 452096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637430009, "uuid": "ed2885c3-f204-4fc9-a348-ed16125b6fce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637430009, "uuid": "6783476c-dd41-4d81-9889-433ed642f882", "value": "a93ee3be032ac2a200af6f5673ecc492.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aa5ed98-49e7-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1637401828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637401828, "uuid": "36d9df35-af7e-43fc-be49-bf0d424065ab", "comment": "Malware payload (Smoke Loader)", "value": "e76590fc35a699216b686e4c33b7de88", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637401828, "uuid": "6a95bc4d-ab13-4e0b-9887-5a92cf985273", "comment": "Malware payload (Smoke Loader)", "value": "f197666c16c7341b304b7f8ed96d22c4803cc1d7b0b47c9ac86b445e5d64c7c2", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637401828, "uuid": "39785e86-0714-433c-89ab-cfb4048ea7e6", "comment": "Malware payload (Smoke Loader)", "value": "20aa5ab97fa202a13c9ec1fc0f55b078eaaf82f4", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637401828, "uuid": "53d78f4d-3faf-4edd-be33-30679fca6431", "comment": "Malware payload (Smoke Loader)", "value": "5b86339ff42ea5ff44b37e7a464dd8714eca4bb062fd6f31367b965ed8a45d609d81a4015e36725b1a990945eb195882", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637401828, "uuid": "28d9e320-cc0e-4032-aa80-5ea28689ab69", "value": "T19504AD1536E3C471E5E366306870B6611A7BF9727733CD8B27A4232E5EB02E08AB5753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637401828, "uuid": "c6c05965-8bf4-4c82-8c02-381373b73ad5", "value": "9f36e28e95ecac65660050c1a70ebbaa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637401828, "uuid": "572eaba8-1265-4d00-900c-a10bcffe3c05", "value": "3072:o7M4Kqw7Vg5AfRbbdlUYvQIp015ZAqXXz44nA4nhgn:pQAfRbbdGYIIpaXsyg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637401828, "uuid": "19581255-4f67-4d4f-bce9-72998cd0fc65", "value": 173568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637401828, "uuid": "17227171-0782-411b-8dbe-e3deccf6f5ac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637401828, "uuid": "eb99ac32-90cd-4547-a52a-f1e0f15f77fc", "value": "e76590fc35a699216b686e4c33b7de88.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d776056b-4994-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637366416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637366416, "uuid": "35224998-e5c5-464e-b778-7f07dedf7545", "comment": "Malware payload (Heodo)", "value": "56654ba7c0040b6da0de06da315023f2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637366416, "uuid": "38e877ff-3555-43b4-8ca2-830ba6ffce89", "comment": "Malware payload (Heodo)", "value": "f198844899c9328fb1672a414cb38ebdfbc8710b86152b1bf6c010f15b597074", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637366416, "uuid": "d8248073-f3d3-4262-adb0-e64e2d3015b1", "comment": "Malware payload (Heodo)", "value": "f561518d6f82bb4a6ec354adeae1ef32dc267647", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637366416, "uuid": "0953dcfd-7223-4079-83d4-294c7f5e9e06", "comment": "Malware payload (Heodo)", "value": "88b0c1db217813ab0e5a413592fc3e55446d2c47ed722cb70ee49358345db3a7667cb569409d01d07444397ce174e6ff", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637366416, "uuid": "ad143e1c-f2af-4e66-9c18-3b1efd7c5aee", "value": "T1FCA4CF11B6C29432E1BE05303978DB5608AD7D318FB4CAEBB7D82B2D4E741C19B35A76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637366416, "uuid": "20cd911a-405e-4834-97af-d0fc1a9786e8", "value": "d2a2f4c68a7903cc45764257f8ed7a2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637366416, "uuid": "b8398b71-bf1d-4106-a44f-ce54f238f322", "value": "12288:+AriSOG9c0jc5mDQxqf1R4iTQG8Ht3WZ6y1zTV3z1:vof4DQxMX4iTFUVWXpTVj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637366416, "uuid": "66f724b6-2b4e-417a-a0ae-13db14cf0780", "value": 481280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637366416, "uuid": "43a025cd-8efe-49f9-b9f3-5cc34e499a2c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637366416, "uuid": "23dd71ee-d693-4ebd-b79e-370459014d76", "value": "emotet_exe_e5_f198844899c9328fb1672a414cb38ebdfbc8710b86152b1bf6c010f15b597074_2021-11-20__000004.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "388553ce-49e8-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637402227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637402227, "uuid": "61239da3-96ff-4664-a3bc-e4dce2261850", "comment": "Malware payload", "value": "e46dad94d0f52c7a73bee38e5b7764d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637402227, "uuid": "ab8e1b2b-0a80-4a91-af29-9f60f0025029", "comment": "Malware payload", "value": "f2b2ee667bce70c913ddfeef396939cbd4cc9095395ad8aa1cf76f19d2914de3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637402227, "uuid": "748b9298-3a2d-4249-9352-b6c809f3da88", "comment": "Malware payload", "value": "9ef968ac6575d0f74297af4d0e78acd4890df2a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637402227, "uuid": "5677f7d7-79d4-47e2-bada-f9c690ce1045", "comment": "Malware payload", "value": "9a25bf9c8daf6eab22a40ae2f3df0477b0fd6e221e7b38716e5b47b495e2657b91790dccaa2976cdf06b497bbc148e03", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637402227, "uuid": "fc28addc-695a-4429-aef1-20ef618bd54a", "value": "T1D2D4FEC8331331BEC656C471AF7CDD7BA6E83466432A81D25463319DAD4CF87AA0D8AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637402227, "uuid": "64a7036c-cab9-4bc2-901c-7c7d5ca9afb3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637402227, "uuid": "4e8fe25d-7e39-425d-8a70-b99ab4e6ecf6", "value": "12288:BrmoORYxFnWh7VkWagQjWwxWo4uRYTQ3r6:BwYq82", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637402227, "uuid": "26882c9c-8973-4973-be3e-08fadfc8294f", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637402227, "uuid": "c7bd0a3a-d330-4e72-9ba8-e6930ed64778", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637402227, "uuid": "8c4cc5f7-2d16-45b4-85c5-85f1761505c6", "value": "e46dad94d0f52c7a73bee38e5b7764d5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46655dde-49d8-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1637395378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637395378, "uuid": "7facd212-20e9-4cf0-b490-87f55157eab8", "comment": "Malware payload (ArkeiStealer)", "value": "71a63fa7419177239910ef20940b5da1", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637395378, "uuid": "70b86447-1706-4223-aae7-67fd8cc44f50", "comment": "Malware payload (ArkeiStealer)", "value": "f41503e7b6f5ce811b27f8ff160b1b0d60a437d36c9db6327e254a910f405a4f", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637395378, "uuid": "c3739269-66f8-4d4a-b283-2aa3a99bf759", "comment": "Malware payload (ArkeiStealer)", "value": "8ed778a268852a39c3991b3f8aedec381b93944b", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637395378, "uuid": "bfd4810d-d823-474a-9d02-67aff5a34108", "comment": "Malware payload (ArkeiStealer)", "value": "a77bb574e38d936205f58637305f4651dc4868836e6e4b4aafebc42ecdb0f80adb8a2317fa98da4436f7896d7e880135", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637395378, "uuid": "070096b3-90f3-4d30-8a1d-3b81daf01bc0", "value": "T15624CF1937E0C072F4E3967C55B086BF19FAB8722775408B27681A2E5E713D34AB4B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637395378, "uuid": "ffd1e630-1a61-4437-9cb5-0ab5d04f55a5", "value": "d447c88e5ba79016e49c5de135738a35", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637395378, "uuid": "47831539-d78c-4084-a5f8-bb6e390e307a", "value": "3072:G1764Sp6XeG/MZN+mhsds0yatVLr8QVIYskWZP1AZjes/dCCOAYPiJ:Gm6XeIsgxds0DtxrfILkqPitN/BOAY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637395378, "uuid": "e6e25222-e5c6-445a-8206-cfab47ce31b3", "value": 209408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637395378, "uuid": "948790e7-265b-4bdd-9904-c16e74008c43", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637395378, "uuid": "da411f06-1faa-4123-a1e4-1b35531b6455", "value": "71a63fa7419177239910ef20940b5da1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaa9d84b-49ae-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1637377507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637377507, "uuid": "99f01714-21a8-4ce9-9dfa-2fecd346605d", "comment": "Malware payload (Gafgyt)", "value": "f279a2a2b55eee262b184c37cb3e4e85", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637377507, "uuid": "130e5b15-4fef-4c3e-8d66-ddc6bf2d5652", "comment": "Malware payload (Gafgyt)", "value": "f4adeb1599c88c59fd0d35b00f14eb37bc85a60405d7ca0163a6c9081a4ac3b3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637377507, "uuid": "a8cb05db-6bd7-4b04-aae6-8314568e4cfb", "comment": "Malware payload (Gafgyt)", "value": "c7e885fd113c41bbc56349440144bd2571e98387", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637377507, "uuid": "f2b75019-6039-4991-8042-27702d658e37", "comment": "Malware payload (Gafgyt)", "value": "eb7aba1b1dda9c967d89cf9bd7d341aeb32871bb2db06cde0d16a0583d70099062df10de5aafd81ef1f8381dd9e28279", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637377507, "uuid": "62a3cdf3-9d1f-4308-96ac-7acd8a63c7de", "value": "T105732949E552C6F7C4821BB1039BBAEE0766FD394E7A9E48F7083CB49B724D43929311", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637377507, "uuid": "b1c85955-dab0-4731-8513-cd51d7fd2ef1", "value": "1536:xbPm3lguLYiPvoVjRWSbXJ0rWlC/kPstVkYFSw2nQW83LZ5:03KwYiPvoVjRWSbLQ/kPstVkTw2QN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637377507, "uuid": "f0912450-a9c3-4567-a52c-3d8679185a76", "value": 75580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637377507, "uuid": "fdf4704c-a7bb-4923-bc51-52e5090947a4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637377507, "uuid": "f3921d50-1ef8-4180-b8cc-3242963115ef", "value": "f279a2a2b55eee262b184c37cb3e4e85", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a062d314-49ae-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1637377490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637377490, "uuid": "94a37cd2-e26e-4cb0-8d54-b340c46f5a20", "comment": "Malware payload (Gafgyt)", "value": "37de6eb58a08b250a254993e2d5f4b15", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637377490, "uuid": "b434ccd0-c993-4815-85c0-be0ff7741fa9", "comment": "Malware payload (Gafgyt)", "value": "f4ee3a75d5b6cbfe750a34973f48cda2e65532269a1f090fc8d53d17f653b780", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637377490, "uuid": "7bc69ee3-1556-4575-ac08-80e2b18e6b36", "comment": "Malware payload (Gafgyt)", "value": "8234037bbe8eeff17a07ec908e6b1880ed61587b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637377490, "uuid": "0441e547-b0ab-4917-b9ad-ae755fc9d968", "comment": "Malware payload (Gafgyt)", "value": "c82194c607e00a7422cd8da1ae9c358e9e468c870087db07e83703876795b5d721cb64ae8b564a7f266a5d1e6495d3bf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637377490, "uuid": "4edaa088-ab15-4d4c-a6e8-52c220a7f802", "value": "T18383284758A25FB7D04A6AB92D7B45B0075BAE510F0F1A9B626CB6B4033F8CDB40E724", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637377490, "uuid": "dd90eac6-160e-4134-b9aa-3d608cadf749", "value": "1536:bquvdjii2M359rbmNPUBkAiAKJp0rrvCOL7oCNceIHUJa:2uI8jbkHJgvCMoScP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637377490, "uuid": "ae1adf0c-8490-4cd6-a3f7-8109b95b99be", "value": 82844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637377490, "uuid": "ce3f8d74-0f5a-437f-9035-ef46ccf3e726", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637377490, "uuid": "8bca4a60-d85b-43b2-8260-6350c915dfed", "value": "37de6eb58a08b250a254993e2d5f4b15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47c2f71e-4a1d-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637425016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637425016, "uuid": "13d482da-418b-4ab8-aece-adc38000f170", "comment": "Malware payload (RedLineStealer)", "value": "9d167e4c50acfb5c9be0f4e61aad0e85", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637425016, "uuid": "698ddb36-d936-4702-98b2-74a33e3e6835", "comment": "Malware payload (RedLineStealer)", "value": "f87c97ea459e7bd55c5c66d55b95d701be4e161d43edf1931ada0520d6286069", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637425016, "uuid": "c356bd63-07e8-48ad-883d-ee7453b16f74", "comment": "Malware payload (RedLineStealer)", "value": "3a12111ac96cd476d56f611306bab8fc4be4ad3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637425016, "uuid": "3b3e0873-69e2-4b4d-bcac-d6dfdb890225", "comment": "Malware payload (RedLineStealer)", "value": "9b8fe126b33007101c68bdd1e20399ca482e3cc743634f069b8351a95c4370995b8a78c739be5be1276ed1fdf3550f97", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637425016, "uuid": "778ca745-4180-493a-879c-a84c4d5a58ed", "value": "T1EB842428647FC05940E3EEA62DDCA8FBD99A95E3640C743701B4A33B8B51B84DE4F479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637425016, "uuid": "2a52d342-252b-43d1-97d5-9da1466d5b67", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637425016, "uuid": "0b2b9f65-0eac-420f-a9e2-36334e804467", "value": "6144:QNmR0YuxjqXTKJM/RJLHQejmEbkiGq6XrosvCol2v0m2r0mlkc6dX4QT84:sEIiN6XrosvColM0m2r0Skc6dX4QT8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637425016, "uuid": "3a09ec69-77e7-4cff-9c75-7a94b912e456", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637425016, "uuid": "65daf93c-d100-42e0-a197-8fb4ab096500", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637425016, "uuid": "6b6b29ee-6912-46e5-8ff1-3906d9ec9791", "value": "FortniteCheatV2.5_ByOneTapHacks.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "770b68a2-4a41-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1637440557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637440557, "uuid": "52ec2174-585c-4941-b0f9-1f776de0c627", "comment": "Malware payload (Loki)", "value": "2ae5473d26a235b7ab3ee2d632514d60", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637440557, "uuid": "a93b61ca-55ef-4def-998b-0c58eeed7df8", "comment": "Malware payload (Loki)", "value": "fadae8a98643b8305b18d587f3cc16534eacd884e84753c92e1e64c3336d91c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637440557, "uuid": "98179e95-5f68-413e-b581-f0f0289489aa", "comment": "Malware payload (Loki)", "value": "40cbf4bffbe3a0c691aaac5e51ab93764958e5b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637440557, "uuid": "d97e5656-69ad-436f-a835-328170bfcaef", "comment": "Malware payload (Loki)", "value": "6fb1dcf6e221da24397ae42461de302e832cf82ec156b5aec5dd962635c375c3a2fe439bedff27688fffcac6b01d1e1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637440557, "uuid": "dfe7338d-701d-4f1a-a6bb-ff56c347ef2c", "value": "T1D8744C91D289EC57F04758F2847EC83068A7A75CC9A8441D228E7B2D55F335221AFFAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637440557, "uuid": "10f7e298-dee6-497a-a542-9a7e67e19c54", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637440557, "uuid": "93d9a3f2-70b4-4138-b04a-1ced2ca86c83", "value": "3072:7m2CthMHk2YOOOOOuOOOOOOqYOOOOO8GOOOOOOKMooMJMoMFYYYYYYYYYYYYYYNb:Ct+HgjobF4Equ0HQlLU6j7DkZ9ZWnn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637440557, "uuid": "342eeac7-c7d6-45c8-9cc4-d04a809c4058", "value": 359690, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637440557, "uuid": "11ce3eab-fe68-438b-8032-e17a451b237a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637440557, "uuid": "e17c58cd-ccb6-4fb9-93c4-1c1b25d0ba65", "value": "FADAE8A98643B8305B18D587F3CC16534EACD884E8475.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be9b7552-4a0f-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637419202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637419202, "uuid": "0f22fe27-465c-4d83-a999-377d94cf7d1b", "comment": "Malware payload (RedLineStealer)", "value": "7041a89242de7b71e195536f5cd99d41", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637419202, "uuid": "27dc1551-db8f-4ead-b592-5f2aa2e58d4d", "comment": "Malware payload (RedLineStealer)", "value": "fc08e1ff5342399ad8d51ece728aa533544321998464a2ee5bbdcde48291941b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637419202, "uuid": "958939bd-80b9-4404-857c-b2599210845a", "comment": "Malware payload (RedLineStealer)", "value": "ede4c0bbac25c783fd486fe40e3c8a20f5416223", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637419202, "uuid": "a6cbece3-d2e1-4eb7-8bf8-177f05f0b55d", "comment": "Malware payload (RedLineStealer)", "value": "d91fea5ce722b3b5c5a793e5b7df688e180d2ed30d16d2bc88df4ac42788911bd28faf526fe4d7d3d3ca346d2cb9b30c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637419202, "uuid": "cd87978f-2637-4dd2-9ca7-b20d62819297", "value": "T1C2D533D2BFC02855D54C413EDA6E8AF36204B323FAD07D18FF288605AE1B55AFD496E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637419202, "uuid": "e41a5c07-cab3-40ad-a171-556ae2e3dc2c", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637419202, "uuid": "0257d13f-5edc-4d3a-b2ac-b242d19a00a6", "value": "49152:F3d7FDZYxYDpr+U4RGu1M6k4smQbpejZWAc4h6tQo1:56YDpr+U5Ms7bpejZWJO4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637419202, "uuid": "cc81bd02-82c4-4ff9-a6b2-9aeb17386acf", "value": 2793984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637419202, "uuid": "7b267a86-d65b-4274-ac15-4a769213b97d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637419202, "uuid": "f5e04b11-7ffc-42b8-a915-977ebba7b0e4", "value": "7041a89242de7b71e195536f5cd99d41", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "616bf64b-49e8-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1637402295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637402295, "uuid": "ae9ec6c1-29a5-4049-93f7-093b03a0d60f", "comment": "Malware payload (ArkeiStealer)", "value": "bb63c0a03b35135d0d3eb1280fd5cada", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637402295, "uuid": "e4ac90a9-819e-4633-97e3-4ab05f29713a", "comment": "Malware payload (ArkeiStealer)", "value": "fdbb8d6ed0d4fcf8626da27bc3fbbac0951b1edcb8cac083e017c660ba2c5225", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637402295, "uuid": "a3b97f50-37a4-4766-a61c-789c3af200bd", "comment": "Malware payload (ArkeiStealer)", "value": "08ef56f406a37616e75f3b87b691897ba9e91262", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637402295, "uuid": "1518b28c-9310-48d7-85e8-aef9f7ef2433", "comment": "Malware payload (ArkeiStealer)", "value": "21df4b7771fcc3e655a58c1068baccfd4bcfb9a6685cbccafaa25e08bd3c8aad642ffabebf9ebe59575c6c7d1876b277", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637402295, "uuid": "e058052c-2b02-4195-944e-7f5f7c71b9cc", "value": "T10824CFE533E1C0B7E5E3157029B29AB2197BB8731F71808E276C272D6E703D086A5767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637402295, "uuid": "3af71ac5-3334-4185-814f-27db896a8b76", "value": "d447c88e5ba79016e49c5de135738a35", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637402295, "uuid": "f5f9d12f-bff2-4458-a6dd-fc94e068ddd8", "value": "6144:vm6XeIsRXFz9aQcLfTBkRXyCi/StpLesNe46e+:vmYeIspFIPBkpXLqsv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637402295, "uuid": "e16a5000-85f2-47e4-a792-6c703bc93cdf", "value": 209408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637402295, "uuid": "3b434bd8-d7d0-4241-ab54-62159c7fe7db", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637402295, "uuid": "3cc1895f-5e75-4a40-a04b-2e4cc0e454b7", "value": "bb63c0a03b35135d0d3eb1280fd5cada.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }