{ "Event": { "published": true, "date": "2023-03-17", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-03-17", "timestamp": 1679097782, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "c25ad7d7-f596-4d3a-ade4-301df5ae667c", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "610075bb-c46c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1679020528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679020528, "uuid": "4ca8e772-f9d1-433c-a32d-dfaf1f5c2d85", "comment": "Malware payload (Loki)", "value": "645990a6af5bfefc3a844f0298725b84", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679020528, "uuid": "413ff9df-be5b-4db6-84d8-7eadf2ea5788", "comment": "Malware payload (Loki)", "value": "003862e8abc13385f61ae0668a6ad27cdd0e237b81af500c25e611f538c3b20e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679020528, "uuid": "4ecded15-38bd-4858-a46e-97e38038faa9", "comment": "Malware payload (Loki)", "value": "4ed55c32c7654aa747be7f5d618f41df54fe1b40", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679020528, "uuid": "73dc1ec2-424e-45f7-9ad8-16cae7af4921", "comment": "Malware payload (Loki)", "value": "1aeff03fae1e310f6d998b653a95dbf766ef653beedc6d9cbbf8128e7b0fd86c34facba8ad6a0bb092440cf5adb4dcc1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679020528, "uuid": "f6f96051-78f1-4b33-a76a-843d34408c6c", "value": "T1D1E4ACB12F69DA20F3F9C47530E47B1CF616FE7F0EE64915E52BBE90623BA886424111", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679020528, "uuid": "5bf95b7f-bcfa-43ae-9527-dee6525cdf0e", "value": "2f3102f07e26b726eba70d83959b07e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679020528, "uuid": "1b1f334d-a14e-47fb-b82b-8a966b7574d6", "value": "12288:3CrO6Aohl+4j801NDv6HDD9VQug+N6g8JUhkKG+esTCm:3CrRAoXZJ1Nj6HP9twgGU72m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679020528, "uuid": "7dbd2ad7-3059-4af8-8c76-254ec0568cad", "value": 682496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679020528, "uuid": "fe488dc3-6199-4e9b-aa20-adae61ac8f4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679020528, "uuid": "fdd4d4a0-4ed1-4ba0-b1d9-0b715c4aed18", "value": "003862E8ABC13385F61AE0668A6AD27CDD0E237B81AF5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d39ad37a-c4a5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1679045201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045201, "uuid": "5fb9fccc-a5f4-4b84-9372-547a208157b8", "comment": "Malware payload (Loki)", "value": "9d6eb2abb183ac8308078dd712115d6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045201, "uuid": "63e4e0b7-582c-459c-bcf2-3b294640716a", "comment": "Malware payload (Loki)", "value": "0040c8a0a4f5fdc9a18c894965f3d97ca4a92dc97b97c324f934a4978430bbeb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045201, "uuid": "235c14f4-5fb8-4c6a-a69e-f61f19765b53", "comment": "Malware payload (Loki)", "value": "2481f3ab73390143ff1472de84918399cc2c0f9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045201, "uuid": "8e54437b-d745-4052-bf0d-59c74fb960fa", "comment": "Malware payload (Loki)", "value": "ba1588cdc5a80eb9964e7b4042dc9c97f546f883854c41078a08501bc63623ce6cc96baf88936da2675e4e8eacf551ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045201, "uuid": "4ad6c3ab-140b-4ec5-b2c4-9f6b69183538", "value": "T158F40208F625DF22C67E9BFEA475202453F3991E9335E3989CCE64EA7A72F900540D4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045201, "uuid": "ab2baf5f-1f62-4aef-b651-560058762994", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045201, "uuid": "3844fef1-e9ba-4558-ac1a-b88566ba6271", "value": "12288:UzC/VpjkjXyuaqZDR1gMqNxOyjJH2qyRmCPuQJI7Kr1hjJ2ZREM1Ptj:bnjkj+iQMWxOUWq6mzQJVr1hjgDEMJF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679045201, "uuid": "4940c0b2-4858-4af0-a81b-c4d9c5d27d88", "value": 793600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679045201, "uuid": "a89c7fa8-95c3-405b-b8b0-a36556aa4fd0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045201, "uuid": "bf7eecf7-2eed-44f5-8eea-175c4ae6fa21", "value": "9d6eb2abb183ac8308078dd712115d6b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "380d05a0-c4a6-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1679045370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045370, "uuid": "e9e972a1-537f-4b62-ba2b-e967d39abfc4", "comment": "Malware payload (AsyncRAT)", "value": "e5b2d160f8ba238317a89cd4ed6660b5", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045370, "uuid": "466e61ee-18ae-421b-b1e3-afd369aa9f9d", "comment": "Malware payload (AsyncRAT)", "value": "0106b0d302d02505f7681a44f5390357e98d9d040a833b899cb74eee07303fe5", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045370, "uuid": "295b1dd1-ff74-4dca-ad02-5d57d9db9150", "comment": "Malware payload (AsyncRAT)", "value": "73f3664c8f979c5bb3f8ba2d67ed124222fc543c", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045370, "uuid": "b2abdf28-eb87-4c92-bf1f-30f8b8bd6107", "comment": "Malware payload (AsyncRAT)", "value": "6f387b139bb58499430bd2ec5f05ee3cdfc308edf05eb246a6c5161c10fb07331736a369c36c53d2ee5108bcfbc77f5e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045370, "uuid": "71bddb3c-3544-409d-853d-9a3e964c81e2", "value": "T1CDF6FBDC726072DFC857D472DEA82DA8EA5178BB931B4203902715ADEE4D89BDF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045370, "uuid": "6a9b895b-26f9-4883-9774-43c6abeb98cd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045370, "uuid": "6e342a61-c701-411f-b601-8da8f184d12b", "value": "196608:MUL256Bm4tT8ZJ2aDcUnFctD0PxzDgsuyFT8846RF:M620BmZkUFcmdgsuW4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679045370, "uuid": "8a8883f1-fffc-406d-b77e-2bf9f52729eb", "value": 15376384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679045370, "uuid": "3d07495c-6562-46c2-8af1-392785e6c89d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045370, "uuid": "a09e04ba-13a1-4047-ab24-3aa9a4ed5b35", "value": "SecuriteInfo.com.Variant.MSILPerseus.238084.15407.225", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06aeed4f-c4da-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stop)", "timestamp": 1679067621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679067621, "uuid": "19342fba-070c-43a7-9468-3c8a2e7f66c5", "comment": "Malware payload (Stop)", "value": "d22da84a2936b2445a8226030f58d3ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679067621, "uuid": "a4e204d1-fef6-4a14-8ba5-93194a68d4bd", "comment": "Malware payload (Stop)", "value": "01844df24424c980c2abd38f92ecba177cde40c8b809e4d89e20002945cd4168", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679067621, "uuid": "17c8a633-6626-4c07-bb09-bb05926a277c", "comment": "Malware payload (Stop)", "value": "1b3363473e2d81bec1522bda9e9d48db6bce6bed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679067621, "uuid": "ba539424-57d1-4c15-8e7b-9521ae2f6dda", "comment": "Malware payload (Stop)", "value": "70cac408799392fe59c6376e335c36de681af73458350a92a63f1e552f3177cb212ae08378fc18b0a2f0d35e1022efa6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679067621, "uuid": "124de8f2-065d-4f82-8e2b-7b948e38e071", "value": "T17D05DF4396A17C95EA268B73AF2FC2E8761DF510CF497BB52218DE2F04B1172D263712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679067621, "uuid": "d8421d53-1185-4ef1-8c0e-64d4a8980889", "value": "48e7bdebf7b90ec755513d967cfa38a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679067621, "uuid": "033868a4-d609-4e7a-9c4c-f88c2ed5ecf9", "value": "24576:jcD0tah8nxmZqWWiiuCK7KIlnBzBLnQ+R:ji066GqkpZfBDd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679067621, "uuid": "fd80c7ca-6482-4ec3-ab0e-ead950e8ec0f", "value": 813568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679067621, "uuid": "103e940d-8cbe-494a-bc47-27dbe27dc103", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679067621, "uuid": "a4110eae-3fc5-4fc6-9eb7-e25116e90999", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e929e81-c4a4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1679044441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044441, "uuid": "50cf5a14-2ff6-49fa-a67f-6a57bc24e236", "comment": "Malware payload (Gafgyt)", "value": "757e3005abef1b945ff3062d4a4c84e9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044441, "uuid": "e27f7c87-439b-4ed2-8acc-20650df3e666", "comment": "Malware payload (Gafgyt)", "value": "01f9ea3bf94bec3c4bb8cffc0f85a8d7e31d3fbda9a6f009765a4efc088bf5b4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044441, "uuid": "3a60a3b0-fbde-4728-bea4-a3d523797224", "comment": "Malware payload (Gafgyt)", "value": "31d75fb0223b9349eb02058bc91786feced03680", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044441, "uuid": "30e575dc-bc53-4598-9469-b8b758cfadbb", "comment": "Malware payload (Gafgyt)", "value": "b36a17768c51c7793636d073e11eaac60be2f5105d5371f0d1657551ad57339b4420cf6833b55f9992d105259ce32dd2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044441, "uuid": "45976af6-23e0-4b46-b8b4-e051db29ee45", "value": "T160E3866E3E21ABBEE16886310BF76F70C39529D636A19342E16CF7185EB124C1C5F760", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044441, "uuid": "3400627f-5f65-4e68-9045-d73952fb42fb", "value": "1536:mVNs7K797V+nv57gbj6l6T6B6v6N6/6AePe1ebeZe5bwClA2rKQA1dXAQTI/e0hu:vY01ZkXAQT4Nf9//ImlWs4zWfOodW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679044441, "uuid": "1ca9d640-35af-41bd-b14d-cdcce03672f4", "value": 152121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679044441, "uuid": "6ab935fa-0820-4110-8f17-2e987fad8e5f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044441, "uuid": "8eb9f2c8-116c-41cf-ab4c-dd1124474a3d", "value": "757e3005abef1b945ff3062d4a4c84e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52beea47-c4da-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stop)", "timestamp": 1679067748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679067748, "uuid": "1d433787-140b-40a8-b783-a57e9db72b6e", "comment": "Malware payload (Stop)", "value": "bf166c732fefece92ddfd0f1d5f7b58e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679067748, "uuid": "00521e5a-966d-4d5b-8c79-70f83747f702", "comment": "Malware payload (Stop)", "value": "02a2eca60cd96df0ef5f2f61914141f5027c32176e9c324df36dae275dc21d01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679067748, "uuid": "510706cc-9e51-4265-a570-33c4983a57a4", "comment": "Malware payload (Stop)", "value": "5a77a18395ced6e99af2c6a4679cc20dd4c88e44", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679067748, "uuid": "c94003ac-e836-4f51-ba68-4e610782a66d", "comment": "Malware payload (Stop)", "value": "14dafb6c0b44aaa808fb54792ae34436a73285fe9ff169a37f8e5dc535a752777146c7ae9599b1aaef3bf8d318ee55d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679067748, "uuid": "4b8bf36a-50ef-475c-a18b-8830e944672f", "value": "T1B205E0439AE17C49E526CB329F0FC6E8B71EF5518E897B6532089A1F04F2172D267F90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679067748, "uuid": "19158166-67dc-43dc-8547-14ea35506bf6", "value": "6e76b494f1a9946f83b6b72033f310be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679067748, "uuid": "9e7341ea-6ff8-4868-a435-ab31ce3840f6", "value": "24576:gwqs0lhp+sHqykcE7+q+wcFRu78Pl6Oz:gNs0lOsNOyaQg7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679067748, "uuid": "8cac078f-b5c3-4292-9514-4cc57fa89d6d", "value": 813568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679067748, "uuid": "53bb7a40-df42-4c9b-9683-6e5e05f35283", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679067748, "uuid": "0a9eb7c4-740f-4275-bc94-64c645af2591", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "253718e6-c51d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679096448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679096448, "uuid": "c7759a0d-8bd5-44ff-845a-b138565c2088", "comment": "Malware payload (Mirai)", "value": "0811ff0a0df305340aa081824a852d50", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679096448, "uuid": "dd374327-e137-498e-9b53-e4acd2ffe6c9", "comment": "Malware payload (Mirai)", "value": "02c3e4dc3a07f17d6df83420ddcf95a13e1d63a93cbb4aa76c4d0ec83acb7cf2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679096448, "uuid": "55673ff5-4697-49c6-b0fa-3f016ac0dda7", "comment": "Malware payload (Mirai)", "value": "db88b786b8a16d24a0bd799c6221326977d9513e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679096448, "uuid": "f2701941-0e05-46bc-9e91-fe1e14b633aa", "comment": "Malware payload (Mirai)", "value": "ed4de91f4c33eafc8e86b8bd4a3901685182944d4d0e400b68e7acba2a996cdb9278f1e608634c04fe7e3bc1cc7de34c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679096448, "uuid": "407cfa3c-5311-4d9b-98fb-95057813f0e5", "value": "T10FF2E15181341635DAF0BABAC08633CD28E6CAA7661D7E4F9403214AB9377E486392CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679096448, "uuid": "34fecaf4-5018-47e5-acf4-41374771e1e8", "value": "768:B8cWS2eVPg3cnwll5vb9xl4CwlW/PWX8CVcFOUMcylzEB+wtRgrqgzcXWv:xjPgaw5pxRSAWX8C4OUBylQ2rqgzcGv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679096448, "uuid": "063f6746-f629-418e-92fd-b043fcf65d31", "value": 35056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679096448, "uuid": "aa0536be-6ff3-4d88-89cd-e86e02a113ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679096448, "uuid": "cb6f2e44-c373-4ce8-8c31-58fe34f6a837", "value": "0811ff0a0df305340aa081824a852d50", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88467b48-c4c6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679059248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679059248, "uuid": "a10abbf0-a816-485c-98e8-8b78903e090b", "comment": "Malware payload (Mirai)", "value": "6d11e63c5bdca50f7183f73b259a1f3e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679059248, "uuid": "aed3387b-7710-4a7e-968b-f45debffc655", "comment": "Malware payload (Mirai)", "value": "03686d2e092a648fe7b22771d4c46cc1e213396a1f928b386077bc77b4575ff8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679059248, "uuid": "d7626f31-9d62-4d65-b500-788968c0a6c9", "comment": "Malware payload (Mirai)", "value": "c1c867cb314cc75380d485da400f7c92e40b234a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679059248, "uuid": "837355b3-5149-46a7-b8a2-db77e5baea20", "comment": "Malware payload (Mirai)", "value": "b6a11272d7f16cb9ac68c8a3829aec9a863a9cc3f7be7d2d7a19c2d7185a3d20be0b53ae1a93bd97d7646d53d233055a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679059248, "uuid": "ba961df0-f8d1-45e4-bc00-e1cfa592ea1d", "value": "T150C3852E7E22AFBEE268863107F35F70879521D237A19382F26CD6181E7128D1C5FB54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679059248, "uuid": "a8566507-7e6f-44ae-8f95-076208040c3c", "value": "3072:q6aBQjUWKVnJe6Jcmf2rmW+IFB1Dt1hR/:zFj6VJ1cFrmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679059248, "uuid": "8181ea1c-9ba9-4a76-96b7-889686c1de58", "value": 125943, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679059248, "uuid": "297a1bcd-2efe-4d41-81b7-b707c432b413", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679059248, "uuid": "3c83de0d-dd6c-4ada-aa4b-98ac3564ae55", "value": "6d11e63c5bdca50f7183f73b259a1f3e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "317d1474-c4a9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679046647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679046647, "uuid": "c3a350c4-26be-47a0-9eb8-c3fc286c1159", "comment": "Malware payload (Mirai)", "value": "5d922d45c1e78297ea294f7348382a57", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679046647, "uuid": "604b9288-9424-4712-9dfe-f7e4f443e336", "comment": "Malware payload (Mirai)", "value": "041757101f914c1c7efc22245af83932d93cb3a7138c4bbf2ad2523caefb3d85", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679046647, "uuid": "e227e329-7993-4b66-84fb-713bc7ae9929", "comment": "Malware payload (Mirai)", "value": "25897b21257b51fbd97c10e02503528d95138723", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679046647, "uuid": "25c48350-34e8-44d5-888b-1b2402c45065", "comment": "Malware payload (Mirai)", "value": "cfecc3704ad187128c5529a0746791760aae8209ecdffca95573b27512b19c27a47c1b3006d7d4608f65b085effbeaad", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679046647, "uuid": "8d6ec5d0-cef4-4f27-a5d1-94c873f9cce9", "value": "T182336C36E029DED0C6560134A4E88F751F13F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679046647, "uuid": "1b3a1064-7387-4ae1-b02e-3a0eca762a3e", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9Mm3CZQoV/bnmCozw:Oa4U7G7SvT6ftBpm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679046647, "uuid": "d80a9b87-4042-4d01-a4a0-30a7bcd5677a", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679046647, "uuid": "1a7e2955-2eac-49f8-86ba-d596a7a89665", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679046647, "uuid": "c1c4c931-b594-41d6-a2ff-f3d6be37ce14", "value": "5d922d45c1e78297ea294f7348382a57", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f46a29e9-c4eb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Kaiji)", "timestamp": 1679075321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679075321, "uuid": "31d66240-5235-44ee-a80d-bba1c5a7f630", "comment": "Malware payload (Kaiji)", "value": "9e0014ee7d2c125211cf16f661da42b7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679075321, "uuid": "2a2077fb-b7dd-4891-bda8-de40ae43cebf", "comment": "Malware payload (Kaiji)", "value": "0594136e357031978dc6e51bffcf41c7d85c7004be527b0777ca5623c8dc03d9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679075321, "uuid": "e312d35c-3ed8-4ab1-8c1e-cf12f9a2d3d9", "comment": "Malware payload (Kaiji)", "value": "fcec371f0d8afd73bcf8d39456a2677225c5d22c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679075321, "uuid": "d0db03c9-c746-4435-b6bb-f4fbb375e4b4", "comment": "Malware payload (Kaiji)", "value": "a23ff05c5a9bf9807e315dea1caf940eb51c27518350f6ad140be76f071e6e07ac2342cc06fda874da9b2ba4ba95f1e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679075321, "uuid": "747fb3ea-ba09-4e3e-9f4e-b6b538f86a3c", "value": "T156952847B89156A9C0AAE234CA664252B761BC991F3163D73F10B3F82F33BD45E39358", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679075321, "uuid": "276edb37-5253-47f6-b856-3af87d84bcf6", "value": "49152:XXPVKrbvGOQLeS7rb/TCvO90d7HjmAFd4A64nsfJrkaani38C4B+g2vUqHOErz1:tPXZz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679075321, "uuid": "bac0d1c8-9e97-45ae-b587-6d84b7c01cef", "value": 2011136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679075321, "uuid": "e9f08ecb-4980-4c4d-8221-3242994bc2ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679075321, "uuid": "060ea9b3-72eb-4a88-a259-cdde7e51181d", "value": "linux_amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3937fb51-c4a9-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1679046660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679046660, "uuid": "8d382695-840b-4095-91b3-0fbd79e56e02", "comment": "Malware payload (RemcosRAT)", "value": "badfd20331bbd073b8efe745d71b4797", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679046660, "uuid": "c0f2274e-5ff4-4b43-ab1f-ee3501e8a0ab", "comment": "Malware payload (RemcosRAT)", "value": "05b59ecf47b2421de0d6777fbd1498ac5b6c2fc0a8233838e3246195f452175e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679046660, "uuid": "6f11ca4b-6ea3-4088-9467-48c5d3630c8d", "comment": "Malware payload (RemcosRAT)", "value": "9b3b21beee2a7c690fb4876f964fa9c709bea816", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679046660, "uuid": "1a482a81-c825-4580-a683-96881a5568a7", "comment": "Malware payload (RemcosRAT)", "value": "6240e148962db8c519e474718323eff9ff93c91aa9451be85fa82949127db3cee8b99d9210ea1b1bfd6eac453ee52336", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679046660, "uuid": "5fb7c1e5-1ca9-4321-ab0d-f07562c5b343", "value": "T1DDB42309B388C536E8660634AF3B00749F6AEE260D64430F9FD1BA5DFC74512FA17B66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679046660, "uuid": "e94cc904-92dd-44c8-bdc9-fd74c2eaff9d", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679046660, "uuid": "af57d22a-7273-461a-b956-d1dc53116a3d", "value": "12288:OYfjeJp6VaEn7CCz6U0iibfBDmc55PrY8kxal:OYfjRRneU0iibfBbnY8kxal", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679046660, "uuid": "9f6da3ce-a9c7-45df-9ee2-36d900735d76", "value": 529147, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679046660, "uuid": "6d15e990-9f4b-4be7-a4d5-308e2ed29b1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679046660, "uuid": "6a188db3-4688-495a-b157-ac9770093936", "value": "badfd20331bbd073b8efe745d71b4797", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb685949-c495-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679038369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038369, "uuid": "154b48d3-5220-46e4-9b1f-0428569c582d", "comment": "Malware payload (Mirai)", "value": "f2404d83dea03580c179382b5ce48370", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038369, "uuid": "426e7902-eae4-49e1-90b6-b50366690cba", "comment": "Malware payload (Mirai)", "value": "06cda615a516fd3153d3738562bf0b11844788213efa0a4d938be0f307208431", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038369, "uuid": "1e0bc570-ad54-4780-a6f3-868644631469", "comment": "Malware payload (Mirai)", "value": "dfbb62acb4ada7ea6c2bef09c749908dc9fa83d7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038369, "uuid": "9b748f0b-9959-4ecb-9fb7-55439d87aa2f", "comment": "Malware payload (Mirai)", "value": "5e4dc40b5aa6cf7a7aaefd92a2e747b1e5c7441de30c4ff582505814f333b6cc5f2ff8629f335d33ee853af369244c48", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038369, "uuid": "e8b95fee-6e77-47be-a01f-87e8234367ea", "value": "T1C2A3F831A641C973D04305F212A7DB660D32FDBB1A6AAE56E32C3CB0DE360C5B565E9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038369, "uuid": "c59c4081-5431-4b93-b4a9-5a34c1a98ac1", "value": "3072:VK1z13U6HzHoXRtmTUhQog9EmmFVcqq0GnDZT:VK7DDeKlog9EmmFVcqq0GnDZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679038369, "uuid": "94fda2f9-af3e-4a23-999b-1aab4904acbc", "value": 100042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679038369, "uuid": "7e7e151f-0a97-4223-990f-6b30aec17784", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038369, "uuid": "b520c462-7e99-40a2-aa59-5b5ae4e8e4e7", "value": "f2404d83dea03580c179382b5ce48370", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d821f82-c497-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1679039017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679039017, "uuid": "aa8afe44-a17c-4d93-94b2-42d9ccce8f52", "comment": "Malware payload (SnakeKeylogger)", "value": "d3f898cdc110695fdd7dc7f8ec804d93", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679039017, "uuid": "98b8afdf-15a2-486a-a953-0905935ef57b", "comment": "Malware payload (SnakeKeylogger)", "value": "06f41ad3ae6d09b7b6b1db47996197ae7318a2326b4f4bd94d2c9495fb3ab270", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679039017, "uuid": "77ad79bd-6512-42ea-871c-bc6caa6fc541", "comment": "Malware payload (SnakeKeylogger)", "value": "036fc0a808637b22123a611da0e4caec9abe78d1", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679039017, "uuid": "aea473cf-0d8f-4956-8782-6fd05eb9975d", "comment": "Malware payload (SnakeKeylogger)", "value": "2a52460dd1570d578912e815926ff764297d150d3b801b5a30057f80671466058c33487dc25ebd097f0e946496112beb", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679039017, "uuid": "52a93676-2ec9-4e43-af6c-36adefb105e2", "value": "T1415423BB8EFE6024C70B9ABC952550F9832BED8871A848FF9455F5D7F1C898C864A061", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679039017, "uuid": "4143d436-bab7-4913-a2be-5e540ddb5f05", "value": "6144:aG0vXepVPI5AUmERzmaaNu1Kifxk27V+T9xqLNc1qaP75wAESDG0Xku6:b8eDI5AhHNxifxk27VC9xI+qEySDGl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679039017, "uuid": "386f6f7c-9e63-454e-9ccb-b492dcf6955e", "value": 290382, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679039017, "uuid": "4808ad61-60ab-4b6a-b40e-a2f1e08ff963", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679039017, "uuid": "6bf0c21f-51af-44ab-83fc-74207fd074a1", "value": "Rechung-R1663322504.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcd65cc2-c4c6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1679059444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679059444, "uuid": "a4a6ac57-60cb-47a4-967d-492d91af1d5a", "comment": "Malware payload (Formbook)", "value": "3379797c78848d3b80d7bb330381ffec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679059444, "uuid": "ea1d8336-4be3-413b-a3b8-10bf77d68fae", "comment": "Malware payload (Formbook)", "value": "07843e27993206a92d9e0bfbb249332fcfedad068bec8f7f7f3f318654c7910c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679059444, "uuid": "50d0bbc2-fbe9-423a-8272-e01360a999b9", "comment": "Malware payload (Formbook)", "value": "8942398a618db4a5a5bf3379e34bf4ecb6e1dc44", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679059444, "uuid": "80ae4b64-8d7e-4839-bad5-5c8c1e37201f", "comment": "Malware payload (Formbook)", "value": "dafd4890f550cbe302a050fa2378dadb264ed28be2d5a26e7a9beb1f32f25cdba3236e1a9fa04e69a2ad1de22c8454d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679059444, "uuid": "97c02d91-0375-4eb5-9489-1ccd5888859e", "value": "T154259E3D3EAAB9D2F174F275EBE14222E7E39ED3B912DE4A15C3034C4602756788624D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679059444, "uuid": "3318a180-ead1-4a61-95b3-b2448bb1aef2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679059444, "uuid": "52843de0-8e96-4725-aac4-ea3e2c1adada", "value": "24576:pobVAYD998lRkBhd1lod8uukAdc6i4YzNbu:popAYD99yUv1lw81kAdti5hb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679059444, "uuid": "6eb9cab6-4931-4996-94c5-39fe6e64c305", "value": 993792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679059444, "uuid": "d4602bf6-145f-4c5d-a65f-ac6121962330", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679059444, "uuid": "9ee930bb-87e7-4236-b606-0b69053c3467", "value": "Proforma Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22448c09-c48f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1679035455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679035455, "uuid": "dc7395cd-26a2-45b8-a14e-3e6220b59c63", "comment": "Malware payload (Formbook)", "value": "ddb81f6cbec9f7c2a0c367eaff553c8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679035455, "uuid": "4c2b0dff-908b-45f9-afe1-3475395bb6fb", "comment": "Malware payload (Formbook)", "value": "07ea5734d5a27eec2e18629559643c25f87676c8f81f9abe12aebf742dead0d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679035455, "uuid": "29c2f2c5-3505-4469-a717-e8e1ebc8cc99", "comment": "Malware payload (Formbook)", "value": "8c757c2136176069a0627548629d27930d043b08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679035455, "uuid": "c305461b-54d2-4607-9567-75a9deab75d3", "comment": "Malware payload (Formbook)", "value": "e12c9c3ab7f39e6f2e7903accbfc728eb4f41cb914fe30e1d3b87cb9fe9c9475ec7d30045646ceca0fb53c665c48349c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679035455, "uuid": "a69d0227-8131-46fa-ac44-b899bfcf52ad", "value": "T1E005024DBAD96920CA3E0FB7E093306057B295274F82DB0E5DC616E62F3279BC484D97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679035455, "uuid": "5f01ce9f-6b19-42e8-bbb0-bce85f9e90d5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679035455, "uuid": "2a5e8e48-2298-4466-a25b-32ebf8d2cb31", "value": "12288:KUWz9DJCQwoL+zQDa6EEIctfFQBmElDaEKEvOidBs+XaH31UsTKcrExoDHQ:mJCQwc+zea6EEzSmElDtKEhBgBKZeQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679035455, "uuid": "7ead6521-a9cf-4e1c-b211-d1943e237880", "value": 840704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679035455, "uuid": "25d9205b-c560-471c-9ebc-ed5ffbb92b8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679035455, "uuid": "40d3238b-6e68-470f-a144-edc4fc010d20", "value": "Proforma Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f7b4f8d-c497-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1679038993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038993, "uuid": "e3766100-0fe6-41da-b416-437b53eea93e", "comment": "Malware payload (Heodo)", "value": "0521e14d911a7b66faa8abcc6bc4b671", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038993, "uuid": "74bf9445-6ac3-4598-b3c5-c00c68a618fd", "comment": "Malware payload (Heodo)", "value": "080672b68abf1f03ace8f820214e8fe1efd2b9d84e03f79658b0351e78c8aa1c", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038993, "uuid": "630f6486-3a68-4925-8bd6-a91a92e4b0f8", "comment": "Malware payload (Heodo)", "value": "9c2a790c2aa4e9a638869c36480c469e81caf901", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038993, "uuid": "19d62f5e-cc9b-4a04-b471-5bcccc011b5d", "comment": "Malware payload (Heodo)", "value": "6f88ec1f3b9f496e86b8211a80d8ebab0870175a1516b07f58958f55618305726006148b7fa6d87c123ddd629b01a447", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038993, "uuid": "0222cce0-2077-42ea-affc-92133d32a02b", "value": "T19DC32BF1A8025C0AE123C976B1FB661399D052ED42283B2BF87D507DD978A20D5DD8EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038993, "uuid": "c73a7f65-b1e5-4845-b873-8197b9c99cae", "value": "1536:RDBoTVdaeNtuXndCrJJmT4HVnteV4FrdMiYcx7bfCb6HPdnXJ:1BoC+tCYvSMVnte8ZP1Y6JZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679038993, "uuid": "8c7b3e5e-76b1-4de2-8e07-f681d6e549eb", "value": 120428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679038993, "uuid": "b6b8cc72-cf30-4839-8d74-30654f6d55e4", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038993, "uuid": "037bbe94-2421-480a-b127-f745395d6fa9", "value": "opastonline.com.one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fe799e8-c497-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1679038967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038967, "uuid": "59cf4fb4-18c3-4ef5-881d-95dd302b82f5", "comment": "Malware payload (Heodo)", "value": "4f69e6051723ee2f829d1e5f31463768", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038967, "uuid": "bca69e03-d3d6-4c1c-ae85-147714a62aa2", "comment": "Malware payload (Heodo)", "value": "085ac1d179a061584f0bee7670d97af843d4a267ca343a884e5a2f462e3da5c8", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038967, "uuid": "d0d35726-5303-461f-8331-569954328433", "comment": "Malware payload (Heodo)", "value": "812424b2c260ed959ee81c5eb8ac160ea61b31ec", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038967, "uuid": "a6496567-8e77-42c5-97b3-12852ce8902d", "comment": "Malware payload (Heodo)", "value": "9276bc407f0f491b3aa45059ef7ef9d7a1ed615e957f1a9b0ec116c46a6272feebd6272631ef03ce9bd147b6c87ce8cf", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038967, "uuid": "1c37ef7a-c4a0-4874-9f16-9984a31eb974", "value": "T129C32BF1A8025C0AE123C976B1FB661399D051ED42283B2BF87D507DD978A20D6DD8EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038967, "uuid": "ab7949b8-409a-416c-a9e6-20527ede602d", "value": "1536:RDBoTVdaeNtuXndCrJJmT4HVnteV4FrdMiYcx7bfCb6HPdnXj:1BoC+tCYvSMVnte8ZP1Y6JT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679038967, "uuid": "556055b1-0612-40ab-adaf-e6965dc60fbf", "value": 120428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679038967, "uuid": "dcf5abff-7f58-455e-9188-06f21d51ee20", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038967, "uuid": "1682e491-ac8a-40c9-84e2-5abff882d0cf", "value": "iMedPub LTD_6.one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bddf0f6d-c4aa-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679047312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679047312, "uuid": "a0be1338-0848-448c-900e-d401511cf7f6", "comment": "Malware payload (Mirai)", "value": "251689181e240e9badf5e25c63084066", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679047312, "uuid": "01d65953-25f3-4c2d-9ff9-00ef3e37fa83", "comment": "Malware payload (Mirai)", "value": "0890cae7b373a01e365e76446534ff5e7b845dee705a6d4ab65e68b9a34eab07", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679047312, "uuid": "53da84af-1a98-46a1-b896-d09b8c226b92", "comment": "Malware payload (Mirai)", "value": "929ca4bbab55882628cf320d2cc39c4f3e1e460e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679047312, "uuid": "5243add4-3732-4c45-81c0-7dc319a798be", "comment": "Malware payload (Mirai)", "value": "b0ccfeb7403b104d9114ec39d2b49be3c643674cde6b4dbd09025b0f6f39e4cdd0cadead84f601d95eb9f39d21ef5593", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679047312, "uuid": "474d59d7-2e1e-4e41-9c29-7ff330ed1648", "value": "T11DA3F872E643CAB2C4430AF201A7DA6B0D21BE6B0A7A5A85F31C7CB09F334C57655F59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679047312, "uuid": "79ede235-ba2b-42fa-b08e-118a5c7bda84", "value": "3072:wW8FUmgujld6Mkxm6AJ+4f0HmmFVcqq0GnDZT:wJFv4Lm6AJ+4f0HmmFVcqq0GnDZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679047312, "uuid": "edccc9dc-3a0c-4e73-81aa-e2c38989ac26", "value": 104138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679047312, "uuid": "c031b2a1-d0f9-450d-b1f7-496da48ba613", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679047312, "uuid": "ec984818-8d6f-433f-9517-3030269f04cb", "value": "251689181e240e9badf5e25c63084066", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "392976c0-c4f9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679081020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679081020, "uuid": "9d1578d7-5b04-443a-938f-80a7dcf871a0", "comment": "Malware payload (Mirai)", "value": "0491947fba3ff0b2020dd08c874b6167", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679081020, "uuid": "4f0b5d90-5797-4ebb-aa88-216da458107b", "comment": "Malware payload (Mirai)", "value": "08b6b4e5ff43013cd5e2fa6a042bfbfdaed2c2a08f425abb70f49c341b7bdc18", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679081020, "uuid": "9bd120a4-aa64-44d7-892e-b15b80646b1e", "comment": "Malware payload (Mirai)", "value": "cb8412b48dd11161df9092b235dffac14a0c97d3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679081020, "uuid": "ca269223-9a52-4abd-b534-863f0e8e31af", "comment": "Malware payload (Mirai)", "value": "661f2bbd915d07d6cd8e7721d697e0b2cc3dbd11874b0cfccd77a5b244bd6c2b206d93e7b2c5eec815e51e14b17e1d44", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679081020, "uuid": "127336b9-fafe-4290-a993-a2b650c89e9e", "value": "T1ECE2E19EA5A42DEADF8D4C3E22CC0579BBD7189713649F89272144C8A76D898F8DC03D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679081020, "uuid": "38f7759c-feaa-4292-88af-51bcbaf88947", "value": "384:X3fpCLrsjHIX69URc+hmnulY1qHprFKt6zhS45vDajssVwfA+9a39RWGVCz0Nv2v:nfpWcehzJFYKgULAssKfh9a3LW5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679081020, "uuid": "44cdba61-578f-4b04-8e2b-21bed3aa97b3", "value": 31960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679081020, "uuid": "d7f4944e-fbd8-49c0-a9bd-0bf87a09eed8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679081020, "uuid": "c89b65a6-dc0b-4c21-b856-4cb52504e7bc", "value": "0491947fba3ff0b2020dd08c874b6167", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59d92566-c4f6-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679079786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079786, "uuid": "9b2d347d-cd39-4520-8837-c7e46c19eb47", "comment": "Malware payload (RedLineStealer)", "value": "6177868d52d60dd6d7ecbcf27df92a83", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079786, "uuid": "aeac8abb-7cbb-4196-90dd-3ff26d0ba467", "comment": "Malware payload (RedLineStealer)", "value": "09b098f27500ac1e91b8ed2ea0e4d1d844cdbbd23f5b00bc97b3d555a570c3c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079786, "uuid": "323e7e04-8a36-4a36-8346-5d4eacf8f4c3", "comment": "Malware payload (RedLineStealer)", "value": "ba5ca1861d549c6aa83f3460d0f56856c9a35fc2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079786, "uuid": "a5268307-1c15-40c9-9afd-2a18ed9ec478", "comment": "Malware payload (RedLineStealer)", "value": "7bcd8553f8b315fdcfd4b32fa2e4e526a70c8a87f66eef79df67c72395ac203b8cabe9313774f7970331f4f87e2639e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079786, "uuid": "bf0b53ac-3575-4900-b0cc-8ab5c708c938", "value": "T14445010393A1BC59F5254B725E2FC6E4770EF9608F49776A32189A2F05F22B2C563F90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079786, "uuid": "091ab602-71d6-411b-9df5-7e2db55a2bf1", "value": "dd8a453761b33b24924afccf84a4abf5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079786, "uuid": "75f0bc43-9a55-48d5-95cb-1ed6f595d246", "value": "24576:ekcpCh/hx1VCKnXPGgP88lsB3UAQy2HrABIaJWQj+mFDT55+HnnL3H:ekcpCh71lPkB3UAZ2HUr4QjPRT54H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679079786, "uuid": "01390866-1c6c-4368-bdd2-d22bd4ba3ee9", "value": 1256960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679079786, "uuid": "c670f2a9-ed4f-4404-91f1-f05c616210da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079786, "uuid": "1419861c-8090-4d91-9b78-da9eff323855", "value": "6177868d52d60dd6d7ecbcf27df92a83.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "142ac93e-c4af-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679049175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679049175, "uuid": "0d287bae-948d-4e45-a882-a6f0ea7ea8c3", "comment": "Malware payload (Mirai)", "value": "dacdfb126fc1240fbd6ca447495335d0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679049175, "uuid": "baa5414d-0af8-4a26-8a52-0d29131e690b", "comment": "Malware payload (Mirai)", "value": "0a16895c0fcbdeabafad46cfc54ce9944bb860427393aa9e911c78c86ba16075", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679049175, "uuid": "ef04aaa7-2c24-4a85-9bf9-00e48f200b5d", "comment": "Malware payload (Mirai)", "value": "026322eca3d8b71767ea4ddfc8a6fb6e672d3edb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679049175, "uuid": "a4bd5955-a9f1-435f-bfc8-ececbdbf358d", "comment": "Malware payload (Mirai)", "value": "4d29122318f9ecc25418453d0e95c43b5cdaa88f4260f62d2c9694130dcf64602659014dba6b93a4b7350590037ff4f5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679049175, "uuid": "352cc9d3-bbae-4217-8b00-8eaa43c62685", "value": "T10BA2D075C1653C6EDEEADE724D587AC37EE82B0573D3CC6138621B51260BEA072616C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679049175, "uuid": "893a593f-e5df-4469-8e07-de469af2d406", "value": "384:bfHIVg3M1Q7TN8W7VgqDm2+sns0t0yo82Aeu7WY/Hkry24M4uVcqgw05VxJ+:TIZsLDm2+r0iyoms2K4uVcqgw094", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679049175, "uuid": "ef4d0bde-763b-43a7-9ffc-86a9d82ed7a0", "value": 21876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679049175, "uuid": "bd33f1a2-6d8f-4e98-890f-af49b67bac50", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679049175, "uuid": "2fa16052-8102-4b4d-809c-2a2d4f486dbd", "value": "dacdfb126fc1240fbd6ca447495335d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc7e0abf-c4a6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1679045646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045646, "uuid": "1dafdf3f-ac23-42ae-a106-69d522a014de", "comment": "Malware payload (Gafgyt)", "value": "6e400c9e9add1ffbc08ff46ef29a7fb1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045646, "uuid": "f05cf6cb-8409-481c-9c8d-c22b2c836399", "comment": "Malware payload (Gafgyt)", "value": "0a259ace9096875a0af84fd3f9225999892a1073225016d32b790c9d3b11ae4d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045646, "uuid": "1532f3bf-e214-46b5-a9d3-f85ab5e31483", "comment": "Malware payload (Gafgyt)", "value": "bf2e4fd45c06c106f2effa0e9d3ba809c4ed8a8e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045646, "uuid": "6de324c5-c5a8-481c-a744-7b09f579738c", "comment": "Malware payload (Gafgyt)", "value": "3fbaae64c20ea7645a721416597bb2cae27bb15bedc6564a815fa62a23a13b397c7f63e96b4a3bdbdecb1b7ecff9b8ab", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045646, "uuid": "d5dff76c-4d43-4ea1-9767-2c947253a4a6", "value": "T180931893B801EFB7F40EE67604D34B257270FB614E631A26731739A6AE362D43826F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045646, "uuid": "999a8a7d-42f5-45c3-ae19-5fb945fe4ecc", "value": "1536:6RLkV7W4SPSbLhgRG5Ze8WAAT9KyfES1eZmlK26cFw/xucXmzCyVqp42OnkiS:erSbLhp5MT9KyfESYZSQ//XmWyVqp9O4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679045646, "uuid": "a24fd05a-2b56-47ba-911c-d151655d1414", "value": 90894, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679045646, "uuid": "1b906562-144c-4909-bc02-cfbe3a92f2ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045646, "uuid": "bcdc2204-07e7-49b6-96ed-d217ce8bd049", "value": "6e400c9e9add1ffbc08ff46ef29a7fb1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "220d0f09-c4b0-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679049628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679049628, "uuid": "5344cfb8-36dd-4b7b-95d0-44abc7f8ca2d", "comment": "Malware payload (RedLineStealer)", "value": "dfd46f70d13e389b3ae88fe96d6cdfd0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679049628, "uuid": "bd327ed0-0e82-4675-82a4-45174303024c", "comment": "Malware payload (RedLineStealer)", "value": "0a80b539c3544cea4be2be916a2c1c86390264d941ba873eb43f90eba682f782", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679049628, "uuid": "ddfb9537-837d-46c0-877f-db8bed75d240", "comment": "Malware payload (RedLineStealer)", "value": "22e1b207813edf3806c94f4bf1417563cdb1c770", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679049628, "uuid": "40c275d3-259c-46d2-86bd-d29f6812f0b7", "comment": "Malware payload (RedLineStealer)", "value": "c914bdcd85a23fb7b664ee5cfc558d422be7fe7fd95dccfb4261796bebce442e9c9f80f9d77bd3b11e13ad9a767c4437", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679049628, "uuid": "355a50d2-abb2-4c4d-a1f9-9cdf87b8cb69", "value": "T1DA45F14356E13D60EA218B73AF2EC6E87A1DB621CF4D77BA1218DE5F14B01B2D1A3711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679049628, "uuid": "246a67be-83fd-476b-9e3a-3a5b780eb514", "value": "abe3ddf8623240e0db2d6ab65f42f1d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679049628, "uuid": "09f49b02-acc9-49de-b36a-3679ba014e52", "value": "24576:ay4nG+SGEpD14bS/xKYWa8eE/awROxODaSEIGzjn6IeY8y:ayRzmKxKla8eE/adxOdwj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679049628, "uuid": "a4149e3e-a4c4-4e84-91fd-10005d9a4b9d", "value": 1246208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679049628, "uuid": "c9743bcd-d0d5-488a-ae7c-4a8f06920a16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679049628, "uuid": "377c49d6-0245-49c1-9b3b-09abb7e194cb", "value": "dfd46f70d13e389b3ae88fe96d6cdfd0.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62dc01b8-c4a1-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1679043294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679043294, "uuid": "6ec2dbe8-bffc-464b-a9d1-e286534b0c03", "comment": "Malware payload (SnakeKeylogger)", "value": "11b5b208de7a85b46104a0597c5da7dc", "object_relation": "md5", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679043294, "uuid": "5eb422f4-60b6-4117-9baf-86e838c07aaf", "comment": "Malware payload (SnakeKeylogger)", "value": "0a80ba418f561098477e18cc42ddfc31796b2be3166ff6c99967b98388fe4826", "object_relation": "sha256", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679043294, "uuid": "f1453ba0-56be-4743-9554-5ad0d5cf9733", "comment": "Malware payload (SnakeKeylogger)", "value": "c578bc317e666159cbfc191cb4e50de2de03ab79", "object_relation": "sha1", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679043294, "uuid": "50631a63-7b5a-4dce-aa97-fce4463a22ac", "comment": "Malware payload (SnakeKeylogger)", "value": "cf626a7aa58dc91d1d2057ff568edc7944018fe11787ef6c4f68c7b6878606c9567c0b9db74fd6c8fe6b06b3cc026881", "object_relation": "sha3-384", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679043294, "uuid": "bc978b42-da44-4b5e-893d-3036cd9e1980", "value": "T1B694BFA0F620D0DADCB417F16C9FD9211AE76EECE4E0220F65A73259AD736D3051F24A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679043294, "uuid": "2c18f81d-6472-4928-b720-327170fb36df", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679043294, "uuid": "b0aaebe0-3feb-4f63-9553-0fcc3ab3d725", "value": "6144:16bAcJtT+SdoujpZM5DMJ+VGM1lMwJ1OPH7USLahNcfM9rQ09j3V/PySssz:2APSbyDMOJrOPH7UfnpCSD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679043294, "uuid": "31046f61-655c-4d72-a695-a03f6f9aa5d7", "value": 416280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679043294, "uuid": "77880336-0209-4a4d-aa7f-9a402687b793", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679043294, "uuid": "06e0e7bb-c315-4191-a49a-e10d13c561b7", "value": "Rechung-R1663322504.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "128fd6a4-c4d2-11ed-88f6-42010a9c006e", "comment": "Malware payload (LaplasClipper)", "timestamp": 1679064205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679064205, "uuid": "e3995464-f804-4e7a-9eb6-48f51545c0e2", "comment": "Malware payload (LaplasClipper)", "value": "d433fee70e60de32de4608f07bed7d2a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679064205, "uuid": "b6606a40-18ed-4575-9e65-d43cb6e8cb8e", "comment": "Malware payload (LaplasClipper)", "value": "0a93f3cfdedbd88dce010e4a2e54dc8c2a2135e58f037b55a513ed8b1dc49cb7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679064205, "uuid": "4dab7b1b-06d9-495d-9eba-1300c3fb9970", "comment": "Malware payload (LaplasClipper)", "value": "8b84224c8319705317340392ad99bc529183a7db", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679064205, "uuid": "f17c28d1-63c5-4ea7-b1d4-5bd2c4d7d454", "comment": "Malware payload (LaplasClipper)", "value": "59c44899fdd60d8abef0e09f98ab53471e29c73b4c5e4cb4eda8008f87366f342adab5eab22151461ac5d14a4b0458a8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679064205, "uuid": "cd3d15b1-80cc-49fe-a426-5d52b69f85ae", "value": "T15585239346A06C20E59518322E3AF5F53A1FF850CEA9E7DD2605AA3F19F05A5DC733E0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679064205, "uuid": "8f76fd62-4356-41d0-b6cf-3124b92591ef", "value": "9bf03dbaa4f43e7b3f88544a0f4bef62", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679064205, "uuid": "61170c5f-2631-48d7-a046-b6e025b7ae30", "value": "24576:OGjR/w861Jx8ShKAhJ8PwNIe19bcOPnRQBgOGq0CsBNkj2aoQ5icqh:pY1Jx5vmkxJPnR8GTJNBHt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679064205, "uuid": "4c9ac119-84f3-43b1-8fa3-5e395802639d", "value": 1846784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679064205, "uuid": "5660830d-5cd2-4894-b77a-898a68ad4c9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679064205, "uuid": "21cb9ea6-e4a2-4c00-9bb3-4664d5a9dc27", "value": "d433fee70e60de32de4608f07bed7d2a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29230f20-c4b1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679050069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679050069, "uuid": "7f872d17-2ffb-4ed6-b563-8b1eac6e8bab", "comment": "Malware payload (Mirai)", "value": "1b0566b123056e64e38e5392d5c1f0b5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679050069, "uuid": "21445873-d064-4c02-95be-2d80e529eb61", "comment": "Malware payload (Mirai)", "value": "0ccdc27c29d4088f41878194f626061bacab5337fe2e0e472743ddf0dd8dc5b4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679050069, "uuid": "466fd1b6-f65d-4f25-88ec-a403574aa30e", "comment": "Malware payload (Mirai)", "value": "b46e59af3744343ed69c5ca70cee36a21421bc5f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679050069, "uuid": "d904e154-fb9d-4cb8-b319-0bab421b35af", "comment": "Malware payload (Mirai)", "value": "fbd8426bf7594c34b98aad95f3e1be18bd09aa3cb05ebef780c7187097434aab70a8a47ffa54ce2fbda274812be5e61b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679050069, "uuid": "8e7eca8a-1b91-4734-a0ea-6883d3d9d31c", "value": "T11D84D723C9154995D0615CF322673386AD0787BF8AE732D3DE2A5AB0BF6051F42BADC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679050069, "uuid": "fe540e5d-69c8-4f4c-a10c-2ed231a4cf2d", "value": "6144:33aMnaek06/GqwOYBwjoSRPdpM/9H5Evx5mvwwUCJDdNu:31naek06/GOEwjh/+/KbmvwPCJDdNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679050069, "uuid": "eb95825d-7ddd-4193-afd2-76b86107c945", "value": 397844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679050069, "uuid": "8cd2ef75-e8e2-4003-b470-fe1a9f9b860b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679050069, "uuid": "d2acb9f3-61fb-4c4c-aa69-3f994baa73de", "value": "1b0566b123056e64e38e5392d5c1f0b5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "711325b3-c46e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679021414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679021414, "uuid": "632dc6e0-d8ea-4092-aa86-0e5ec0bfad9d", "comment": "Malware payload (Mirai)", "value": "99b99dac4f61ac4cbd1fb5c6aa13bf0b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679021414, "uuid": "f8571984-72fe-4470-9d63-caa2c879ef12", "comment": "Malware payload (Mirai)", "value": "0cd6a246eb6933bf5ac8639d8972e2c80dcdb7723a15435a914cf6b5bd30af4c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679021414, "uuid": "490be6ea-9cfc-4288-825c-ff061014ce00", "comment": "Malware payload (Mirai)", "value": "def0deba7fdc95d47b4cc1845f8708bd1a1ac249", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679021414, "uuid": "5e04f068-e770-4429-a77c-8d3f9f627b3f", "comment": "Malware payload (Mirai)", "value": "6ef525f32d2e586a5a6e45e38a1662f6db8bb25d0903d9929d92f94ca143d2258abdc9bb8532452fe93e71dd1b21d018", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679021414, "uuid": "bc8f112b-f61b-4705-ad5d-094884b0ae76", "value": "T130532891BC819613C6D1127AFA6E02CD3B2613E8E2DF72179D225F2037C686B0D77E55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679021414, "uuid": "f87c8ae5-cdf1-43d1-818d-8fddcc43fd23", "value": "1536:/YToeNtVVO8Vt8NZ0fturPbZdepGfMvDho:/YTcrGturPbPWPDho", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679021414, "uuid": "bc215eee-63e2-45cb-a5ff-59e74c7455af", "value": 62780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679021414, "uuid": "1a2fcc6e-20d6-499f-b538-7b815a36229e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679021414, "uuid": "3b5dcbaa-076b-461f-ad40-744ad9255fe9", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95cc4fe0-c4a0-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679042950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679042950, "uuid": "b776d3cb-f05e-46f1-8a85-63f16be30593", "comment": "Malware payload (AgentTesla)", "value": "59a5037f67a25dfa09dc83fa907ae24a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679042950, "uuid": "981e95c5-b11b-4e25-abd4-6d31cddf2958", "comment": "Malware payload (AgentTesla)", "value": "0ceb251e48de6657b909bb6dd91375d10fb29f45ece1b05765677b778b063e78", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679042950, "uuid": "aeb4560b-d7ad-4722-a59c-8e18dc26ffa6", "comment": "Malware payload (AgentTesla)", "value": "42e89f9b33cbbdbff55e46250f970e9772dbfd36", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679042950, "uuid": "7216b620-7aa9-44bf-a81a-0e2e5e87c76e", "comment": "Malware payload (AgentTesla)", "value": "63a1f722eeda32b5c767b40a9d91c4667c5bf63c1bbb5fc68f7e0a00ec46b99079a521ee43b0c515773d52ac89c20ef9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679042950, "uuid": "e99b640a-6b59-4a62-ad3f-f9a17db5d8d9", "value": "T12624AE99751771DEC817C632C9995CA4AB70B3A79307C20BB04B239D998EB9BCF141E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679042950, "uuid": "37d9c240-39f2-4ff7-b5b1-40396ff3e5c0", "value": "6144:aLnY/svp9XNoOhacMSclLxEv7ediIVn4:aLnOsvppN5hv0xEvidd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679042950, "uuid": "24c30eb6-37d0-43cb-b1d5-f6673a95db06", "value": 221256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679042950, "uuid": "d1b2c6ad-f1b5-4460-84b1-8c01237e6c6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679042950, "uuid": "2249d3b0-6c8e-4804-b494-57dbd4079b55", "value": "e-dekont-20230316B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87952a33-c4a5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679045074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045074, "uuid": "396dfcc7-0c65-461e-9abd-3b352d6047a8", "comment": "Malware payload", "value": "ae120eba5b9a92de898ed5533151d400", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045074, "uuid": "2c14e324-dd07-4fbb-9fdf-bdd863b7f9ce", "comment": "Malware payload", "value": "0da6d8dc6efe319642bb82ff7c6f4837ad22a23013f641b9efb6427b931814d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045074, "uuid": "05594218-4a68-499e-9dd1-c6d3f1cd2490", "comment": "Malware payload", "value": "ff70aad5b2393c897b364479ca74f6f9a63ce903", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045074, "uuid": "b5bd1779-0c85-4834-a3d8-64fa9c83f303", "comment": "Malware payload", "value": "dbe3deec574aac8bb8b4928b1aca652046a5d2c67534a1bcebe001ac5871288626ee4f8377724c9099e23ca4cee12b4c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045074, "uuid": "2d37ef81-e93c-486e-804b-6e21e92c6d56", "value": "T112C1EF015FEE50DAF22707701BE773B71565E8B1552E61F830848A589F30BD0C862FB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045074, "uuid": "e5dd4889-0904-4512-88a9-f0d48c043c6c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045074, "uuid": "fff990e2-4cbb-4b71-97a1-89fbd713fd5f", "value": "96:Kkd2I579tlVCFQ9HRtaB7vk+dwh80/PGSz7Y3d3ojKrl:sIJ9tKFAxg9vka080/Pw3db", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679045074, "uuid": "dba4f423-630e-4e71-972c-1165e99fb45a", "value": 5632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679045074, "uuid": "c3df7cb8-11e9-4a6c-8010-e64ef945ec28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045074, "uuid": "32389fc0-e7a6-4b69-9a4a-c04fcf04c862", "value": "ae120eba5b9a92de898ed5533151d400.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20df2b1a-c4a4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1679044472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044472, "uuid": "f404acfe-8da2-4479-9981-67db9372fb1b", "comment": "Malware payload (Gafgyt)", "value": "95e1bc4ebef3664f84d1d98fced7c3b3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044472, "uuid": "c678b2df-1f12-42d5-9493-9cf184aec5a0", "comment": "Malware payload (Gafgyt)", "value": "0dfc1012ea24acafc0f79b83245bd0c86285952d2d876544df58044a1fbc2bb8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044472, "uuid": "406ff196-ff8c-467b-a2fe-71f5dfafc86f", "comment": "Malware payload (Gafgyt)", "value": "261e6651b4eaa784e72a545eca9708dcecce7e1f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044472, "uuid": "d5707f29-4b9e-4da2-9a84-d6d4403119f1", "comment": "Malware payload (Gafgyt)", "value": "e5a750d0822304a51f6afda14993c6451c32a7147ed19d394a9caee975fa304829731eb59b4313376dd1fa372d5a6755", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044472, "uuid": "5e140798-84f8-4fa1-9ec4-3bc31bc35816", "value": "T117C30A45F941875BC3D327BAE74E428C37355E2897DB33156A38BDB42BF2B982D29120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044472, "uuid": "8661539b-5e15-48b4-b145-b77b5053ac93", "value": "3072:hQrFRNfuLrGhEPOD0pg3gNlmBoHQuQekQnYW:IFzuaEGQpg3CmBoHQuQekQnYW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679044472, "uuid": "99a4d7cd-53b4-45e4-b94b-883c7feb85e7", "value": 120177, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679044472, "uuid": "cf05cfe2-2bf1-4956-94ee-340ec230e319", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044472, "uuid": "9480aed0-f2ae-431a-9596-cc182f3ba496", "value": "95e1bc4ebef3664f84d1d98fced7c3b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1fb8fb7-c46a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stop)", "timestamp": 1679019858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679019858, "uuid": "0918a184-6115-4cdd-8699-81eebe743149", "comment": "Malware payload (Stop)", "value": "c1a4483ec82e9830a35b4eecba6a1b40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679019858, "uuid": "af0b394e-feab-4697-8957-8cfaf3010a0f", "comment": "Malware payload (Stop)", "value": "0e43e010ea75b309f11c8f0d3b5469c3344f0424461c7e41633f06c816e52a9f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679019858, "uuid": "5449dc59-1624-4dfc-9d97-e17356b1ac66", "comment": "Malware payload (Stop)", "value": "56d86d4e8b2a3fb1ddaf470acde55f4f06f760fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679019858, "uuid": "eff5f3e9-1fc6-4af8-aabc-2ce592a8f7ea", "comment": "Malware payload (Stop)", "value": "71174543f24a891b2aa21f757101d13dd325bb2215e3723039ccf40780338eae5afb7ce3aa3dbfb1bd05c7f40b376ee4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679019858, "uuid": "269b8f63-7b2f-419c-80bc-96b0198a892d", "value": "T1EFE4122397F87C11F51647319E1ED2F9BA2EF5528E6DAF5B22484F2B09B00B2C16E750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679019858, "uuid": "06eb9a54-f5ff-42ff-945e-3e222790fe90", "value": "4b2faf5e2157c756cf2fd31d6cfd3d44", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679019858, "uuid": "05e3c4cc-8d93-45bf-9963-d3bc98efa411", "value": "12288:fqHhEhtYCt5oOonD15X43apBDsHNLAlwB5RfJtYvaTpfvyFcID:+OuC8XH481sNmmtY6pfKr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679019858, "uuid": "bc67dc0b-ff17-4f5f-87f5-5f46ab74bf23", "value": 698880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679019858, "uuid": "b670939c-e745-4b75-a39b-d23c6aea6b2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679019858, "uuid": "e34d6c87-a750-46d0-9436-06c0596f009f", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12f318b8-c516-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679093411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679093411, "uuid": "114d937a-d621-4b9f-aa2f-588b3604788d", "comment": "Malware payload (Mirai)", "value": "2e9e6f27f5c4356c3bf8a0a5af4beaf7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679093411, "uuid": "d568bf4f-190d-4a36-8eb4-dcbd087a77ac", "comment": "Malware payload (Mirai)", "value": "0f660da1a3f457de927861cdfe20f15bd8d2ba1dc7bb0b84cc869d1300459531", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679093411, "uuid": "035fd4b2-0d54-48f7-9b9f-3dafee28b972", "comment": "Malware payload (Mirai)", "value": "ad1662cceff57e3547ca559a60f575df6309b4eb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679093411, "uuid": "2dadf19f-e6be-41ee-a005-411701f3eb1b", "comment": "Malware payload (Mirai)", "value": "2f37d45cd64b4930b7470baf361a11be3b4fd75264f2be8de31aab675f32d6f394cca5ac3bd3790b087b92458ffe72c0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679093411, "uuid": "388c4a90-863d-467c-8455-b72283c40f89", "value": "T1F0E21991B8909A13CAD4137BF66E428D3B246798E2DF73179E123F503796C2F0D6B681", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679093411, "uuid": "da00901b-e393-4107-a61a-df1f68a60f4a", "value": "384:3pbsnBuWUwrzowmBbTG8egb+O8dZfMbaqTOPzEkoVB/Fks6J6XHaSWfpKAN/aB9X:32nBy0gWdgbbiZf+3Km/FkY690sRI1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679093411, "uuid": "bb3b3d55-ed34-423e-9f2b-9607b5babc56", "value": 31456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679093411, "uuid": "af21bee9-36fe-49d5-b393-f264e3df7924", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679093411, "uuid": "05fbddd8-2172-4d0b-af55-8b80f9006a92", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da2a2080-c4a3-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1679044353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044353, "uuid": "44278ba0-9944-4fbc-a53f-ce0d4f444ef1", "comment": "Malware payload (AsyncRAT)", "value": "1cf38074d1eec7ff196912f6b2d8c0c1", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044353, "uuid": "dbee1ca0-84bd-4cb9-baa8-def0047e16af", "comment": "Malware payload (AsyncRAT)", "value": "0f9616033c3e2c3df40e50ccf9cbe8ffb0954569acb29f9bfb5e18d7c431254d", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044353, "uuid": "9a7140ba-0532-4221-bb2d-e9c4f5bc6047", "comment": "Malware payload (AsyncRAT)", "value": "858c4fbf7be9b57538439ce6b9c69d92803d4719", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044353, "uuid": "d9a1da39-f230-4ae4-b2f4-45e6655a327d", "comment": "Malware payload (AsyncRAT)", "value": "76cd0bc2a4a440c84b74735914fa2c79ac0edc6d8a5528d741dff2caa3adaf36ee6dbb28be15485cd4d8c590035edfe9", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044353, "uuid": "16b910dc-14f2-46e7-8405-095a2d7e2b1a", "value": "T17293090B96947DEEE42B5BB36D5B9F4DA6B8B9136D0ACB052261474F10620CEF203DD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044353, "uuid": "60773e9b-1d59-4bba-8d67-7b8ec4d7f55d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044353, "uuid": "e1e7209c-bb7a-4dba-9f4c-063605a12837", "value": "1536:qgboTbL7aqSsvPCMjZHjmP8ibPFhFFbgoq1Pb3phQVvshbg+25gcp:qguf7aqSNeZHMVLbgoq1Pb3phQVvshb0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679044353, "uuid": "47541b30-478d-4264-9994-c10e54a4136b", "value": 89088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679044353, "uuid": "cd01f0c4-5426-43e4-a2f3-d0d77b6a0751", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044353, "uuid": "7c5f140a-e078-4b61-a08b-66a2d75cd745", "value": "1cf38074d1eec7ff196912f6b2d8c0c1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "964bb21f-c4e5-11ed-88f6-42010a9c006e", "comment": "Malware payload (NanoCore)", "timestamp": 1679072586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679072586, "uuid": "d9e13798-35ee-470b-9f83-15ead6c6488f", "comment": "Malware payload (NanoCore)", "value": "97c39ff05e019c1dd9e33567c8e864e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679072586, "uuid": "39c5e7f5-94fb-4ec4-89af-f5dd7133c5c2", "comment": "Malware payload (NanoCore)", "value": "0fe9e5ab7b3a291fe7ba1646079046ddf7022501189950a3958a2fae4dfb31d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679072586, "uuid": "e89d5024-5878-4d22-ada0-bd32290efe3c", "comment": "Malware payload (NanoCore)", "value": "ae3e502949d784bb17b35263cfd22220491862f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679072586, "uuid": "284222f8-3b2a-4ff7-8a2d-5fc18f2fc997", "comment": "Malware payload (NanoCore)", "value": "4fffeb10a38277d18626a260307efa068040d2de7b917bc891f0f6a38ca2617ffabc4d19102443ea2f8948e2309d21d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679072586, "uuid": "36fc3854-13fe-480e-a6a8-3de8f93f8536", "value": "T1A1150208F369DB22CA7E87FEB075212593F3994FA266F3495DCE24ED2672F500541A0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679072586, "uuid": "9b6f1bb4-fed6-46bc-b28a-ac5a7da8a9e0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679072586, "uuid": "04ac4383-188e-4deb-a79d-920b296784a3", "value": "24576:BJjkj+TDvEWdrAVqcTAsHxOiwwyWtZ/9/FUMw:BJjkYIxqcTABiwwyWtV9t5w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679072586, "uuid": "7bf542fa-27ba-4125-96db-796f4dfbde58", "value": 907776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679072586, "uuid": "23306bfc-6634-4c6d-834b-84e7e0ea111c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679072586, "uuid": "f2002e7b-bdbf-4217-9c52-a739fdfb1880", "value": "MY JICT E-INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7e344f8-c4c4-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679058442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679058442, "uuid": "bb7d0973-c8fe-4317-999c-ef0cb0c6dde0", "comment": "Malware payload (AgentTesla)", "value": "10c95a75830e4c5b0d24939f2783d8ee", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679058442, "uuid": "f9a0d4d1-5332-427d-96d5-d0a67be87b82", "comment": "Malware payload (AgentTesla)", "value": "100e4db8f177743e1659e2183aaa671c274d5d040da1cca723e8b409f12eca05", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679058442, "uuid": "698dd6bc-342d-4438-8903-1b457e1f85a8", "comment": "Malware payload (AgentTesla)", "value": "45c11547056a8d26e166fef0bed06aeebb7c827c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679058442, "uuid": "820dc5a7-b55f-4360-9bbb-625fbfa0ea71", "comment": "Malware payload (AgentTesla)", "value": "f8d2217dcb41ed1e8b2182c2f186dee90f99ae04dd0722660db71596fc780f5dc439c91a70527e244d40e19eabca4e95", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679058442, "uuid": "42d258e7-6382-40ee-b157-fe8a550b480c", "value": "T142050248B726EB21C73E47FEB172646583F3981E6236F2885DCF54DE2A32F511501A4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679058442, "uuid": "a0609d54-1eb7-4e7a-95e7-b0aa09898ee7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679058442, "uuid": "46198489-608a-4567-a265-bfdb2eb2bf56", "value": "24576:Qvjkj+E0UZham9yIpWCNEB9SMqP1V6EIMb6:QvjkkUym9Jp1EBw5V6AO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679058442, "uuid": "e9131664-881a-43bb-a3c3-e6586763c1b9", "value": 866816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679058442, "uuid": "78306211-2983-4edd-8fca-80644f4fecfe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679058442, "uuid": "7f81de76-4955-4986-92c3-9d7cb0badf65", "value": "PURCHASE CONTRACT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62d6aa0a-c497-11ed-88f6-42010a9c006e", "comment": "Malware payload (PureCrypter)", "timestamp": 1679038999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038999, "uuid": "084067a8-0400-4719-a487-9a2f0c55b6cc", "comment": "Malware payload (PureCrypter)", "value": "25bcdb9ab29b031bd66e300bfa4955eb", "object_relation": "md5", "Tag": [ { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038999, "uuid": "2232d0c7-8530-4d12-b4d8-4054bdab888a", "comment": "Malware payload (PureCrypter)", "value": "108086be0db84ea3c1be952a8b2dc9828b65efb21805f26f37c9c94825f8523b", "object_relation": "sha256", "Tag": [ { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038999, "uuid": "8c0af89b-8301-4e94-8093-e56d774692bd", "comment": "Malware payload (PureCrypter)", "value": "f6a2c26956ae244df21ecac6c81cd15f163a493f", "object_relation": "sha1", "Tag": [ { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038999, "uuid": "ca05ebbd-caf2-4f9d-aeca-c647fb005754", "comment": "Malware payload (PureCrypter)", "value": "2c3a9b9c241b0d5f79dbbef64fdbff34c0303334c4909450006a41a9767d51aac46a5ee9a3a3bf3a7e7f0aaba3287a76", "object_relation": "sha3-384", "Tag": [ { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038999, "uuid": "e7dc3f4b-31af-4c8f-9dd0-b6d4c8e3e8cf", "value": "T139A31287CA496716767923E0B4A63B44C8A9DDA1B4D466DC8730BC70C25B293DDFF08D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038999, "uuid": "cca12738-7635-4eed-b49b-aaca6a9aff1e", "value": "3072:eqlwC5VXyipfKnKgCj6N1XwmRXCeF7oXXF6f:eqlwC5VLCHCjWXwmN7es", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679038999, "uuid": "b85d4df5-32fc-45d4-8c97-6d3e39c43bd3", "value": 98897, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679038999, "uuid": "fa1744f2-2af9-4f3e-a7e6-fea05134ddc7", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038999, "uuid": "3def98c7-56d8-41cc-a6bd-560b1daf4bca", "value": "Product Inquiry #03_2023_1.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4676e4d-c4c6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1679059322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679059322, "uuid": "7e983f4b-e981-4cb5-bf53-477972131f86", "comment": "Malware payload (Gafgyt)", "value": "06a1644fd2106ff33690edc5c82f7228", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679059322, "uuid": "300a4090-307e-4149-abd4-8792645a773c", "comment": "Malware payload (Gafgyt)", "value": "1102ee576b553890d14a1484a9bf2b9c1335e74cc7f9e62435ee42c75d22bddc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679059322, "uuid": "0fa27c94-e490-4a55-b323-50ee459be013", "comment": "Malware payload (Gafgyt)", "value": "3c13a0dade68f9b592f4b2f0a618c693016a40f1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679059322, "uuid": "a53752f3-1690-4496-ab2a-1f4e38614b35", "comment": "Malware payload (Gafgyt)", "value": "969c8866083a4bb567e285b49b68bb4453f6366fe79a7ce3b325aa60909b16f1c745cb17a4c0eba8932c222ffedc1b30", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679059322, "uuid": "8696795c-52e6-4cf3-9926-abb9d5fea520", "value": "T10273B409EC51673BD3E23BBAF79942CE73381E842B873341962939F45BF4B995939120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679059322, "uuid": "bea20e33-900d-4fc5-9366-c9f1cd1e7478", "value": "1536:syOOdKecG+mW0BZKPcxiupuMmMpR3oU75dly8IE684tXwnD2YkQYijj+gJ6E0Osv:DKecG+mW0BZKPcxiupuMmMpR3oU75dlm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679059322, "uuid": "da0a3803-4401-4853-9b14-48cc2f039f70", "value": 79780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679059322, "uuid": "894b860b-1322-411b-935b-12ed6f24fede", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679059322, "uuid": "aea0a3ad-4562-44e8-bac8-eabe3f04e095", "value": "06a1644fd2106ff33690edc5c82f7228", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecf0ff6f-c4e8-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679074020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679074020, "uuid": "6f098806-1896-4c19-a00d-ec1e7cb70230", "comment": "Malware payload (RedLineStealer)", "value": "f6822d94bf0395a7226ce7922d711a5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679074020, "uuid": "6e98c655-08cb-4492-8cb5-c69b6c9c6ba5", "comment": "Malware payload (RedLineStealer)", "value": "110fa1a801402e53adb9b534a9494bfb1be063e96f5a37f227d330a43c04e3fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679074020, "uuid": "f5d74654-9c69-4f97-b464-b56755f024f8", "comment": "Malware payload (RedLineStealer)", "value": "d58f7a9bfae02c98643119a5230aa0a86f3b0297", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679074020, "uuid": "ce3cc294-7471-4e96-97e8-ccd1b14fd955", "comment": "Malware payload (RedLineStealer)", "value": "d2d7e1a7d8850ccaeb262e9cc2e9ab832652bbaf6014f9e1e251838716268976d11050422ea9483192f3bcb9e7612bcc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679074020, "uuid": "48f46aa4-f859-473f-b8e5-756e0018f2db", "value": "T1D2450153A2917C4CF9268B7A9F1FC6EC771EB6608E49776931189A1F04B21B3C163F90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679074020, "uuid": "650df943-99c0-46af-8911-f11fada2a1ac", "value": "6e76b494f1a9946f83b6b72033f310be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679074020, "uuid": "4c08196f-8ecf-4bfc-98e0-f07e4f85e304", "value": "24576:+uqnfwrbaCEihi1J5hMyHeFaH4pTOh9asj0bWcT9pyKBH:+/4rbF2MyHeFaiOh5cp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679074020, "uuid": "58b341b7-5f9f-4dd9-aa47-666516b825f7", "value": 1235968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679074020, "uuid": "247b011e-e261-45c6-896d-6a306377e149", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679074020, "uuid": "86ca8958-9987-4aa1-88fb-78107810a11d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02f5a270-c513-11ed-88f6-42010a9c006e", "comment": "Malware payload (BitRAT)", "timestamp": 1679092096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679092096, "uuid": "8f6be242-83ed-42bd-87a0-7e832c245cdb", "comment": "Malware payload (BitRAT)", "value": "86000b0a976dc4a377b2e5192fe30445", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679092096, "uuid": "1b29884d-bf45-4203-8db1-012f36108b6e", "comment": "Malware payload (BitRAT)", "value": "11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679092096, "uuid": "d7c79d2c-ea06-4042-8673-342754f3a84b", "comment": "Malware payload (BitRAT)", "value": "ad29b138883d7906f8d6e75f2e5f60e5285d4a56", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679092096, "uuid": "403caaac-3a7f-463c-a9f2-ad77336bdd38", "comment": "Malware payload (BitRAT)", "value": "e15ef9300fe984b50f1e118b90114eb8c89eacd5b43e91aad937700a3a6dba9a53a058c9d8b463ab0f564723efd69a91", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679092096, "uuid": "0af4ed72-5b2c-4458-9298-ca40960ce6af", "value": "T1A406235A3C28FA50F042F8BDA82447A25B0DCD7F9D759B1E3291B95479F6DA330893C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679092096, "uuid": "5817682c-885d-4d9d-bc8f-d38a3447cf60", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679092096, "uuid": "6dc07999-0d8d-4ee8-916d-476f8e7189b3", "value": "98304:nUyJF2oYGCLxnJ7rzdIzYsuvqqW07LslsPTU:nUbn5zSzYhqqW0ns8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679092096, "uuid": "498957ac-356c-4bb8-81fb-e4012d81eee9", "value": 3992576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679092096, "uuid": "dca2080b-6471-406f-a732-150fe2edd75a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679092096, "uuid": "cd37f548-8450-4379-8024-e4a122e95869", "value": "SecuriteInfo.com.Win32.RATX-gen.28471.2091", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "441fc562-c4f9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679081038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679081038, "uuid": "451986b8-b690-4022-8b41-0d059cc6d8fd", "comment": "Malware payload (Mirai)", "value": "630d2dab374a3302d4481677e7384eb3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679081038, "uuid": "378fc2d5-9e41-4f86-a55e-3df35c6d1d95", "comment": "Malware payload (Mirai)", "value": "1230eed6c363f25dfc0eca255e4e1f631d3123834998d305b1f179b042d03671", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679081038, "uuid": "48c6d9a5-3ca5-4a90-b7a5-dd66ebf38e78", "comment": "Malware payload (Mirai)", "value": "def74a8552099e8862c2fc7d8e9e7325c5a491df", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679081038, "uuid": "916d94a3-fdae-42e8-b8fc-d81f699435e3", "comment": "Malware payload (Mirai)", "value": "4272480aed45b1300e7817e4331be0864b54828af7c437f51b34b83a844f0a00d05a8ebc8c5e07e3be5594d17c193c12", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679081038, "uuid": "65572dce-9fcd-4653-b7b5-55534242e276", "value": "T1CAD2D0AD53042379CA6E90FC136647E13DB98F259093EEAAA1C5FAC1ED404F47D63AC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679081038, "uuid": "37924a47-df77-4e7f-9826-577ea23279e0", "value": "768:dyvYLznDEB2iC+sDqC6NtxsfzxPnNsGb9yaXIJgGlzDpbuR1JL:4YnnDEBI+smATfSVJuB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679081038, "uuid": "09ef517e-afdd-4c49-886a-358d9bf34254", "value": 30840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679081038, "uuid": "aba0b3e0-7d3c-4ec5-bc78-48842456aeb4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679081038, "uuid": "d8d87ed4-4ed6-4eaa-acbe-5fcb2d4dabf6", "value": "630d2dab374a3302d4481677e7384eb3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c172fca-c4a4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1679044464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044464, "uuid": "c8ebc96c-d544-4a52-856d-cc4a8d14b2ed", "comment": "Malware payload (Gafgyt)", "value": "2ab722c8e8114a9d12d6a266ae7470d3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044464, "uuid": "53397c76-4647-4163-b141-653068ba348f", "comment": "Malware payload (Gafgyt)", "value": "12e85fa33ce38ec2e0df4b6d75a608ac774b231d1399e5f1c2fa01f112dde32b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044464, "uuid": "f876b35e-adcc-4e61-81e1-930501f0dfcb", "comment": "Malware payload (Gafgyt)", "value": "b83520e3e5b6c28fb13cdd0f16782fecdf745919", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044464, "uuid": "daeecb6c-9540-42a7-b4be-92e9f63624bf", "comment": "Malware payload (Gafgyt)", "value": "9ad6a74fe78a4c9409a71385e6d613848e3cf8326a81dc39e4743855c984165b9ea10859cfffdbb2f9375c7518755672", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044464, "uuid": "cb12943f-0aa3-4abe-92b6-d7b629b52df3", "value": "T133B30692F900DFF2F40AE67604C34B2566B0BF660F536A66B21739A79E721C43867F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044464, "uuid": "8340b03e-22de-405e-a29f-8d9255061a1a", "value": "3072:gLWUEK1FSHGfs1QbEE6QyPwws/avcWVRm2pgYMx3IPtW:gDsGfs1QHyPHsSc2Rm2pgYMx3IPtW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679044464, "uuid": "5c88052c-3336-4dbb-8fe0-0cfce7a16d21", "value": 113759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679044464, "uuid": "82496756-90cd-4fb7-8c2d-8af7c54e0336", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044464, "uuid": "4f649938-3f64-4829-a160-bba495f3f381", "value": "2ab722c8e8114a9d12d6a266ae7470d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c8f69c8-c4be-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1679055685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679055685, "uuid": "ccbda57b-1def-4f05-a484-c15dac6327e1", "comment": "Malware payload (Gafgyt)", "value": "9aef69241cf3bbe78dc1746f13f387a7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679055685, "uuid": "aa9fe5a4-f4fc-4888-bbe5-650b49bb6277", "comment": "Malware payload (Gafgyt)", "value": "134eb8c5cc6e53f6a5754e97d34cfa46a4d2b1c9c37a4455769e43cc0309fee1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679055685, "uuid": "05262155-c898-4a8a-89ac-4b3e6cbcebf2", "comment": "Malware payload (Gafgyt)", "value": "3b594d9f58cb9106cc25cf385194761ddb15f635", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679055685, "uuid": "eea8723d-334d-49ae-bf2c-92fe2f3b3ca0", "comment": "Malware payload (Gafgyt)", "value": "8a5bc821c29a3db8d747ab1f8aca29a3473823eac704532d29847607293194d08f975eea4ce4cb57a2b4797e76134555", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679055685, "uuid": "fe9662ae-4e48-4fcd-a102-9cb140aa8753", "value": "T1EAE38366BB619EB7D80FCE7309A64501118CDD4642D93FAFB2A0E51CE76B84F08E3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679055685, "uuid": "82b02501-10a5-48a0-aee9-3b7c7da679f2", "value": "1536:bVeTpqCVvWRYx0O9vPBysZgvsgxqAz/0ufMytVhpLtaoLAImlP+s4zWfOodW:byvWmBx+sK/PflXgImlWs4zWfOodW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679055685, "uuid": "83dcb1eb-2775-4ea4-be7f-0d17e0c34cbd", "value": 152201, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679055685, "uuid": "d17d5ea4-78ba-47a3-b77b-f9b20d9b2758", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679055685, "uuid": "0f5327ff-a759-4548-8198-bb9434696124", "value": "9aef69241cf3bbe78dc1746f13f387a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbd358ce-c4a5-11ed-88f6-42010a9c006e", "comment": "Malware payload (ArechClient2)", "timestamp": 1679045215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045215, "uuid": "e3227bf1-aecf-4449-918c-481098211af5", "comment": "Malware payload (ArechClient2)", "value": "53e1934061876c52e6fa0c9243d32d9d", "object_relation": "md5", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045215, "uuid": "52e42199-a999-4752-8e18-5769ad2a8c93", "comment": "Malware payload (ArechClient2)", "value": "13b3d0cd06ec8bd22591a9811e01b7aab6c6b716aa2c7573395e23c8209eb986", "object_relation": "sha256", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045215, "uuid": "f83e95b2-0ce9-430b-9f20-cb4d71f646ef", "comment": "Malware payload (ArechClient2)", "value": "22613ac98dca65bb382c6725fa0b28ffa074e522", "object_relation": "sha1", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045215, "uuid": "1d330a65-c3f9-430e-bad1-8ecbe13e1835", "comment": "Malware payload (ArechClient2)", "value": "57cee33a44d2e686e28cf846b10e0595bb1d0a4d1d10071e02204bf05411d0be0a093ce8028bf635c0a6a6cf12ac890e", "object_relation": "sha3-384", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045215, "uuid": "25dc0b55-7fbe-4b22-bb48-a9d3727b1930", "value": "T1D4C1FC015FEF50DAF22707706BE6B3B71566F8B1452E62B874488A989F31BC08C21EB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045215, "uuid": "3d857dd4-5e24-40be-9ed4-13761a6eb3d1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045215, "uuid": "15490d87-d499-4cc3-b4ba-c76e43de522a", "value": "96:3l79hGCFQPyt8jvk+ZZAYrswBvk+ZRtntvngd3ojsgrl:3N9h1FYyYvkVYNBvkW/gdrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679045215, "uuid": "3e516e62-067b-4cf0-94e3-ebc1bdd313b6", "value": 5632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679045215, "uuid": "eee51e0d-c5e1-4f62-934c-2ea21eb2b230", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045215, "uuid": "f5de89e8-a6af-4b6c-b040-fa8de1b7f736", "value": "53e1934061876c52e6fa0c9243d32d9d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93f3741d-c4ac-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679048101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679048101, "uuid": "a644bbb9-1cb3-40f6-bca6-e9dd8b4d5ed2", "comment": "Malware payload (Mirai)", "value": "600d97f65214308a592d06b331d18db3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679048101, "uuid": "b48f1d26-b142-4fb5-bb32-db801cc4aeea", "comment": "Malware payload (Mirai)", "value": "15b01096fa9fcf7273155c2d6fbf150bf3133094796f8cc9a9a00f61b943698d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679048101, "uuid": "ef927027-eaca-424d-b39b-18aad78c1636", "comment": "Malware payload (Mirai)", "value": "af1807b33e4db39774fe23c1ebfa85efd9408855", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679048101, "uuid": "d7813b61-0dae-4a82-a0ec-2b03b6c48a05", "comment": "Malware payload (Mirai)", "value": "71bbc104f993baba8bb26485e00df2602ea78f9b262e263657e66d58ebb518d795d092a1b6d72d3a265df5a174b9bb07", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679048101, "uuid": "62a625f8-6010-4ba1-a861-7204a9fca8c2", "value": "T172C2E19DA31CFCA2DD718871C9BD6EC98FD69A7CD0AE3BA325515B3881C05D117C818B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679048101, "uuid": "ff6c6851-2498-4284-904a-eac34896bc08", "value": "768:YeFVPf1vHN6N4CMWbSXWUyMnsaHFFtQt9q3UEL3y:3PfZt9CMWbS/sYzLC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679048101, "uuid": "0f30ecce-b5dc-4993-9f23-d8b002fa817a", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679048101, "uuid": "75304bf4-e197-4d50-ac6e-ba1517ea233b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679048101, "uuid": "67c5cced-415a-4908-9d15-8a7aee86de2c", "value": "600d97f65214308a592d06b331d18db3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcd6bc6b-c4d5-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679065833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679065833, "uuid": "8effa11a-666a-4382-bcf2-f5f25355c7e8", "comment": "Malware payload (RedLineStealer)", "value": "2c07f4d8c844f0720444eccac83893db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679065833, "uuid": "6c2da47e-5547-4b87-b28b-46c951cda3d1", "comment": "Malware payload (RedLineStealer)", "value": "1629517494047e32a2660297ce222050c869f80f64b3210fa242c047eff6b7dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679065833, "uuid": "4d20746c-b02a-4aeb-8341-a0838aa559e5", "comment": "Malware payload (RedLineStealer)", "value": "fd769c5b76ca06c1dcff815c9314d0cce12b55ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679065833, "uuid": "2461c70d-9137-46b2-9c7b-8906209a29f9", "comment": "Malware payload (RedLineStealer)", "value": "702f36e5d4ad3f38af920122d76176f1561d5bbd8b24d75233d0bbb2fc88a0ffa8049c8e6b5f78d021ce87ae95fc386e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679065833, "uuid": "6015af8e-9fd8-49fc-a3d8-d8cfd3d2b67c", "value": "T1B1E41217A6EC8532E8B45BB065F603D30931BEA14B78C35B238F6D5A5D731E0A632727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679065833, "uuid": "f1094201-c328-4040-b682-3a5c27166d9e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679065833, "uuid": "99cff4c4-8156-4a77-a358-0572846e371f", "value": "12288:1Mryy90YpE//H57ftKBm+05hZeKkkcAXp4HDimudSn3VlqO6d+UClybTFr8:3yvGf5hK0T7kxGyHOmudSn3VlqOk228", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679065833, "uuid": "835f32e7-767b-4a86-a77f-b39233f207b3", "value": 705024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679065833, "uuid": "a2b6d9a6-4e1c-4ffe-8622-12a1e4062e5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679065833, "uuid": "2a925dd1-149f-4871-9585-c629508c05d7", "value": "2c07f4d8c844f0720444eccac83893db.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f34216f-c4a5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1679044899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044899, "uuid": "0aadef77-ccce-4a95-bf2f-5c68fa58a98d", "comment": "Malware payload (Rhadamanthys)", "value": "3b30a249b2a33e2b06598457f803aef7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044899, "uuid": "0fbf3158-cb1c-4801-8351-966521d86116", "comment": "Malware payload (Rhadamanthys)", "value": "16fccc8186abb349c26fe98bbd433749f5d5941d6718497a9c4d1bac5932b9a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044899, "uuid": "9251bbd8-d6c8-4875-b507-26ee622b4cc3", "comment": "Malware payload (Rhadamanthys)", "value": "990a9f82a4a6270be6bc24004edb326283cf83bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044899, "uuid": "1348f1d2-2954-4204-ad1a-3e9ab6515285", "comment": "Malware payload (Rhadamanthys)", "value": "8c188941ba6393e2ad52e44e7787dc70385b6c223c19cb923175915d362ea860856e57c79c2791742153af4f36a7cbbb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044899, "uuid": "f1581559-a836-446a-9975-ee4be6313e0a", "value": "T12134BF4383A47C75F9268A718E2FC6F47A1EF5138E799F5723189A2F08711A2C5AF350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044899, "uuid": "1f633d9d-b7ea-488d-9da1-c13a9bfb181a", "value": "4b2faf5e2157c756cf2fd31d6cfd3d44", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044899, "uuid": "7196cef5-ee15-486d-aff4-3c39cb570b36", "value": "6144:p7jVRQA1WmfhHsGPj5zpf1HP9Qq73khwfJ:p7jVRkmfhMyj5Vt9QG3k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679044899, "uuid": "c6f06e2d-8fac-4f42-b3b7-529ce45dc7e2", "value": 251904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679044899, "uuid": "d6ad4f9a-469e-45f4-bd88-16635445e2f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044899, "uuid": "8f76015a-b23f-4f6d-b653-8e43859ac5e7", "value": "3b30a249b2a33e2b06598457f803aef7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88082b99-c49e-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1679042068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679042068, "uuid": "986c708e-9b06-42ed-b935-8cab4a320ccc", "comment": "Malware payload (RemcosRAT)", "value": "7754818c90a0827f1d76e66f10c72767", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679042068, "uuid": "b6c259a5-43f6-4a22-83e8-72edeb339ad9", "comment": "Malware payload (RemcosRAT)", "value": "1743fecd6e24a264f7047381c32c65084aa22c24a805040d5a952911fd7d94c2", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679042068, "uuid": "eef929ad-ab5a-4854-ae6c-5f8084a96482", "comment": "Malware payload (RemcosRAT)", "value": "8bf440301277e557ccbaf3446e70fd1492985a8b", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679042068, "uuid": "51d30a70-cce2-417d-b7d9-0b209acf11d1", "comment": "Malware payload (RemcosRAT)", "value": "976ecc373d86039c2bbe5144f497a845360e595783d203e04b67eccf76a3821831c04410a508877bc95f96631b085fbe", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679042068, "uuid": "8782e192-ea2d-4a73-99c4-03d35f0d11d1", "value": "T1D845F12FA244DF4ED5068BB95E27F9D8520C7D54ABD4B18B3A51771F2F310A26AC32C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679042068, "uuid": "694f0bc6-44f2-4bb6-8eaa-37edc549cb70", "value": "24576:aLKYWQmmav30xGM8eM8PhhdCqX0dYGj4GoOSnKXuTI:aLKtQmmQ30AxEGoBnKeTI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679042068, "uuid": "57ff892c-21af-4f4c-9726-d43a3fce1457", "value": 1224192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679042068, "uuid": "1702d0f6-4d92-4f68-8cc1-3cbc4f45b86e", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679042068, "uuid": "81957f9b-3ae4-40b3-bf00-22cc1cd7dde4", "value": "16.03.2023 Sarob Trading SRL TOTAL ORDER.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52c44d42-c4f6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679079774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079774, "uuid": "2c975c97-2b44-413a-b058-b780a8795613", "comment": "Malware payload", "value": "ab16dccbf541b99fde32c1d601a66207", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079774, "uuid": "f027786f-9813-43ec-9813-2d9d4d5c6070", "comment": "Malware payload", "value": "177805d63cbd57fe57b8888c91258b98c3c1ae08ef5c70a79f4ef041b5336f9b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079774, "uuid": "cba4dd9b-729f-4967-ae54-6795e9236fd6", "comment": "Malware payload", "value": "c3a6d25b4b6876a6a6eb6544142eef93779e117f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079774, "uuid": "365958fd-54e3-4eb3-8a27-c7f56da701a7", "comment": "Malware payload", "value": "551fb53dd27355466dddbda14fdc209bf6bf87423602c918bd21b78986ecd6484e030fc4fbd167dcdc33a25ef2a49229", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079774, "uuid": "ad9b771b-4de8-412d-88a3-007bde5c87a0", "value": "T1429533729279415EE2A4EC389407FFF131F902432F15BDB9B9DE2AC224265E167B1C93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079774, "uuid": "6c6c202f-39c6-4466-bc32-2cafc8b2f9a9", "value": "49152:HH2/q3FAqZkpeZ6rEJ7UNXyer3fCrXtqvj9T:HH2/WIeZ6AREyAg4vR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679079774, "uuid": "ed02f9e0-01db-4ac3-a980-5c182e0e77da", "value": 1957427, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679079774, "uuid": "462b8674-386a-421a-a0da-d4ce77fd1fae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079774, "uuid": "48802648-7a5f-4061-ab7f-a1d208178da7", "value": "ab16dccbf541b99fde32c1d601a66207.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9d3ea04-c492-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679037024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679037024, "uuid": "501970db-f372-4afa-a9c5-c6e146765663", "comment": "Malware payload (RedLineStealer)", "value": "02a28c37fd718954b067cde7574670eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679037024, "uuid": "1c87fa73-a493-49f4-be1f-082b05a12444", "comment": "Malware payload (RedLineStealer)", "value": "17cd3ca10dac74d91fec42c4ba91f36da04085f6ea6c3a0142a47028dae7750e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679037024, "uuid": "ce878347-b811-4efc-8deb-4513b2b403c5", "comment": "Malware payload (RedLineStealer)", "value": "9d332432e700150601ff3afc7f40c99f929b77d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679037024, "uuid": "da649999-16a4-4fbc-8b79-bd21f04d41b8", "comment": "Malware payload (RedLineStealer)", "value": "1dad4a3aa180a50f28f28c89bf042043d94b44084622b8ee9ae32c29a3503f169743343d37bdc1b9e6b5dca0440b791a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679037024, "uuid": "7533b66f-acb7-4710-b8c8-4086543a0e85", "value": "T171E41207B7E88032C5F5A77019F342930A317F515E39C2A72A4A6E1E1D727B4A1727BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679037024, "uuid": "5e7a3efa-89dd-4d9f-807b-c973cddaed19", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679037024, "uuid": "967051fe-44c9-4bce-bfb5-75c3517e3e38", "value": "12288:RMr0y90TuT+wtOTHoBAvVGUhErI+LMzlbOyDMq+EPSD:9ycste18huqD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679037024, "uuid": "cbc45495-f1bb-4f35-91d5-89c77f1fb3a5", "value": 671232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679037024, "uuid": "3375c94d-5e26-4be5-95d6-9a37bda79c19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679037024, "uuid": "ece377ce-2d30-4d0e-afcf-ab087d9e0a37", "value": "02a28c37fd718954b067cde7574670eb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48dbbd0b-c4f9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679081046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679081046, "uuid": "9b74597d-b3b5-4ea5-98c0-3967e920377d", "comment": "Malware payload (Mirai)", "value": "d52f0eae5f1e7010fd74727e1649cbbe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679081046, "uuid": "e0eacc46-5d88-4447-8653-d03c21ec109a", "comment": "Malware payload (Mirai)", "value": "17ff071ce7bd58a2db3a41285e5fa6fa8d8793c639e70122c2f09e4ba7a98cf3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679081046, "uuid": "a09da48e-5bd9-4159-9477-a633ef76b05e", "comment": "Malware payload (Mirai)", "value": "4c33165d84a086559053b974d4edb6f91daf28d1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679081046, "uuid": "4c0e8aba-480d-4280-9ddb-aff14a7891cc", "comment": "Malware payload (Mirai)", "value": "bbc01090c504171b9835b36ad18c8144be8deafde045349c7114d8c859bd859ae611812bb72ac39540e6149728b661d4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679081046, "uuid": "f61e3f2f-85b6-4831-b93b-d4d46ec9c345", "value": "T105332A8A64112E6DE9DA5CB981764F0ADE541210B093171FB3BBFEC33933364FE66449", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679081046, "uuid": "8064d43c-5823-4fb5-861f-058a7d7ac7d1", "value": "768:0aOTrZQlDVoueg2me2nPQCHEM/ArPwqLWH02TCmhPol7gSu9+f1prN4nS0ezi1:0alDoRg2mew4ChAVLB2Y7gSyg1ppWB1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679081046, "uuid": "588b1959-494b-426b-be67-3547549f7954", "value": 52820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679081046, "uuid": "7c975bd5-33c5-46d4-9d1e-980e0a4e1af2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679081046, "uuid": "bd813aca-25c5-45bb-a7f6-d3f07b90eb71", "value": "d52f0eae5f1e7010fd74727e1649cbbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b9c85ee-c4df-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1679069884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679069884, "uuid": "ecda9782-d2dd-4c02-9981-50a3cdbcf1a7", "comment": "Malware payload (Formbook)", "value": "a69fb4fbd836032cf9878635b031d476", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679069884, "uuid": "2983e24d-e5c7-4f82-8f40-103aca0aa6a3", "comment": "Malware payload (Formbook)", "value": "180284f76be1f524875609de4bb4e02cb30a969a438bd871198830ec393afe0f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679069884, "uuid": "ae4c8f96-20fa-40ef-85d9-a2a7435a4345", "comment": "Malware payload (Formbook)", "value": "891f1a8599c3102b7781330adbd9b54b30c21fc7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679069884, "uuid": "a4732e29-cccf-4c34-9cfc-f1488e3842ea", "comment": "Malware payload (Formbook)", "value": "6efc99adf5dc43238d43d52b3cdc1bd744d517174693e50a6ae4f2760b2684bb905f125fe924da4b7c88b74d478f7715", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679069884, "uuid": "fb33531a-8324-434c-aaae-65036e10d1cb", "value": "T155150249F722DB52CA7E87FEB076246483F3981F532AE38C5CCE64EA2B62F511505907", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679069884, "uuid": "ad6b7c51-d717-483b-a552-c72a6cd0bd54", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679069884, "uuid": "65f83dac-6c48-416c-b941-455e05c1b6c9", "value": "24576:dcjkj++arDYsU1IH4XcYClKsToSpMcSWXMhv:dcjk7s/kcYgRlchv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679069884, "uuid": "c66057ba-d17d-42f3-bb55-9bf11f31fb18", "value": 887808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679069884, "uuid": "90749990-3124-4847-995a-b1a32a34eceb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679069884, "uuid": "3806ac66-0a82-420c-ad44-c8e1a1397c4b", "value": "Inquiry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d3cb0ec-c493-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stealc)", "timestamp": 1679037325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679037325, "uuid": "755a2db9-032c-47d0-96f6-1a1fbd8b16ab", "comment": "Malware payload (Stealc)", "value": "08e4ba8f2c34d08e58a96a84534231a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679037325, "uuid": "baad0cdb-bb2a-4e81-8453-dd1cf6529cae", "comment": "Malware payload (Stealc)", "value": "1874bd8d8d8d0fff60cf8eacb676474af67139205d2611f1e39752db3e0864d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679037325, "uuid": "e4887110-11e9-4f6c-8495-03b955abf358", "comment": "Malware payload (Stealc)", "value": "1fbab1508287a24d9c6d502c3fa8c75e25706260", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679037325, "uuid": "fddaa46f-32bf-4545-91fa-4f9e53793763", "comment": "Malware payload (Stealc)", "value": "94bc2d88f074f2171870f3d88886f3019cccbb3dd2fb86b15d1c132b01cb7d227cbf9de90f75b7698e6ec677dd7d0541", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679037325, "uuid": "7cf57cac-bc70-43c7-89d9-a4a52735b3b3", "value": "T15964084397E17D50EA268B73AE1EC6E8761EB560CF4A77B63218DE2F04B1172C163712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679037325, "uuid": "36905a4d-7237-4de6-8b7b-ba2147c5c6e1", "value": "abe3ddf8623240e0db2d6ab65f42f1d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679037325, "uuid": "70f6e257-134d-46bf-b9df-28b62f9b08e5", "value": "3072:V+pYzEfL3KXnjo9UBnifZL5ID5/cvKRg6j7IDpTqqI3rGqT3K:VCYzEfLaXnjwMiF5It/dg6j7eGGk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679037325, "uuid": "203066a0-3f90-4367-95b8-97141dfe1b5b", "value": 307200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679037325, "uuid": "da6d068e-dab1-43ff-8d94-7f909db7fe43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679037325, "uuid": "bda68fea-6bf6-4247-bdb5-de7d913645b9", "value": "08e4ba8f2c34d08e58a96a84534231a5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a4c941e-c4af-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679049212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679049212, "uuid": "c12e19d2-9ce5-48a4-bc71-48640592771f", "comment": "Malware payload (Mirai)", "value": "8dbbbbf320b6da2a8c257c9f27e425c7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679049212, "uuid": "56baa8e6-92e2-43eb-b851-eb73e3181528", "comment": "Malware payload (Mirai)", "value": "18d464ad97889dee8a98b64d68386153834e26cafd87ee580b2fc98a3a746b5a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679049212, "uuid": "b529cb17-90ab-4434-ac21-c858d8c67052", "comment": "Malware payload (Mirai)", "value": "bc7294ba66083a54163cc00addae1c00f1d82f74", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679049212, "uuid": "e29bc1b4-7464-42f1-830e-368d460705ff", "comment": "Malware payload (Mirai)", "value": "c5ef47a124d03126127c57c003d95e58ecdcab9c736a25e9d4bf10b748b44cb285fa9144b8259e3f81f813a30a4aee4b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679049212, "uuid": "0a22cf89-1f24-4573-b68c-609a402c91d6", "value": "T160C2E13062FE1CB283500672E7785AC9BE534F7DF5F92890114187FB3982D4529EA9C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679049212, "uuid": "7e049d6e-d966-4933-a360-cefe87d799c5", "value": "384:ESt/koxisa34beDtZwuaCBsk+G9lLSsLYSTFs9u8OtqlrNEMYhymdGUop5hi:ESsoTAZ3alkXLvFh8nNEvs3UozY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679049212, "uuid": "e20261cd-0ddf-41a4-8ba8-482b242fc12c", "value": 28176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679049212, "uuid": "c6bdd8a8-6c02-4546-89b4-472350d63898", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679049212, "uuid": "8d0c6f6c-f47f-40ed-9f15-f58b65828c7a", "value": "8dbbbbf320b6da2a8c257c9f27e425c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d3e357a-c4a6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1679045486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045486, "uuid": "e9e4fad9-8bd2-4ff6-93a2-db8fdfac52ea", "comment": "Malware payload (Gafgyt)", "value": "5da2e8e007fd9164fd847b19ac6ddf0a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045486, "uuid": "2dca9a1d-823b-444f-9c96-9797218dadc9", "comment": "Malware payload (Gafgyt)", "value": "19259177c00fc681f92d5fac4b80e1f402f9c9f112052d7b8cd13125ac14972b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045486, "uuid": "79f53d05-a450-4180-9af5-287f381f0e55", "comment": "Malware payload (Gafgyt)", "value": "561ea23eb65bdc80ed0c78c5ac900972d43a7a66", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045486, "uuid": "219e5531-52bb-4fa9-9a42-cc1fcaab6086", "comment": "Malware payload (Gafgyt)", "value": "a63f603201f5eaeb4e74627d7c28bb4aa20073cedc6124a950ebae262f78a15f1d7a388948345faa01c9652c48561e1b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045486, "uuid": "afcdc13b-140b-4b3d-b66a-d4949212c071", "value": "T1DC33F151F282DB934DB2DC38E88D488F520531A856DF1270A91D9F6D9DE70C8E7FA41B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045486, "uuid": "df319be1-56f0-43fb-a6fa-c066dfe2b2f3", "value": "768:BZfaL0/J4LU9WOU/+mqgI67RPaQxBRFZYvB+MzS/IG/nq3U7kugPYM1lcGt0Uh8m:B5PblO+HlGRNZYv8Zkua9HltTl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679045486, "uuid": "eec4793b-f802-4794-b1fc-f3bc3685402d", "value": 50308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679045486, "uuid": "05165b12-3c1c-41f5-b2d3-1e6720db87fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045486, "uuid": "5e6b6d46-5899-4bf1-9d6a-e6a19e5f1b43", "value": "5da2e8e007fd9164fd847b19ac6ddf0a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5bf5de6-c4e2-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1679071350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679071350, "uuid": "ebcc419e-b3d9-4a75-a5f6-f03bc567a1f3", "comment": "Malware payload (SnakeKeylogger)", "value": "0c40e1ed40a4f8e8e72b336d0e2125eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679071350, "uuid": "dcee5635-41f7-47f1-8e7d-4a2481bb09f0", "comment": "Malware payload (SnakeKeylogger)", "value": "1a18b9f3e62ae832d9015d69de364ea6fabc4964c0a263672b7875157c7a4af9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679071350, "uuid": "b7823fbc-4133-4a02-b408-473b06236518", "comment": "Malware payload (SnakeKeylogger)", "value": "9eb21fe85f113c03eb2d5fda803e65fccbc5e7ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679071350, "uuid": "f2dae189-76f5-4b12-a7d5-785a29d45ef0", "comment": "Malware payload (SnakeKeylogger)", "value": "680fb27588db089b3e7702ad1118a6cda6118ce6bc90ba2bb0f152478071fa2fa97c1f7e12cba86081567347e71a72a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679071350, "uuid": "d839bbf1-f5aa-4f2f-8986-37e8a75bbe05", "value": "T1FA3539AC72A0B1EFD897C472DEE82CA4FB90747B531B5613902719AD9A0D987DF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679071350, "uuid": "182d92b5-d0a3-4143-a923-a214f51542cb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679071350, "uuid": "e9ae38b7-251c-428f-87a8-82aa2663f54b", "value": "24576:Y4ClPahy1vyp9wIHZ/KNsGfCtDndHNvHI4ph+8NC82oYbw:QlPahycpu9N3qpdHNvzv++C82oY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679071350, "uuid": "b1d6f800-e13d-456e-abd7-0a2a9d37be09", "value": 1161216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679071350, "uuid": "b5155f32-407a-430a-a644-9e8cef356b37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679071350, "uuid": "a5f0ef76-0447-4ce6-a58f-fa6b056b53de", "value": "0c40e1ed40a4f8e8e72b336d0e2125eb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34bfdb36-c4f9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679081012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679081012, "uuid": "9dced258-509a-475d-b465-69a87c206cef", "comment": "Malware payload (Mirai)", "value": "7087b147f313ef14a71d3d8edf5a0750", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679081012, "uuid": "f55a0d1a-0548-494e-b7ae-f7a94ff8b9ba", "comment": "Malware payload (Mirai)", "value": "1a87445c3f347c8a639a688aaa798d8bf6f7e66c05da31079db523f42175e8a3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679081012, "uuid": "6ed376eb-7cbc-4294-8307-0b931d98d57d", "comment": "Malware payload (Mirai)", "value": "4c94356f9842ff7a356bf742606cfe72ec6f5070", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679081012, "uuid": "2f9b584d-8323-4c97-ac70-c6be387f6048", "comment": "Malware payload (Mirai)", "value": "be971104759a788d5cc2ff5b137457e976be5a8ad5f219f7f39a156cccaaebfaf4595cbe889250036f4bb67b4dfd69ba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679081012, "uuid": "cb25f79e-c738-406a-ae60-cac9a440b953", "value": "T1D7F2E0224327D532CDB5DABAAD3182E4292B47F4F5BF71646794C28D9881F03C5FE14A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679081012, "uuid": "b2546d71-62d9-4a01-ae66-0d9217f24c8c", "value": "768:aYVgAxkU1RHz5poClGL1aMnXha7WBNoWhSxHjKrQSe9q3UELCT:aYyAxdRH9zILLBBrodjcTLk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679081012, "uuid": "3d353829-43b3-4d56-9520-e7c840cccd02", "value": 34484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679081012, "uuid": "f2d40254-5a81-4a63-885f-f97ec72adaa4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679081012, "uuid": "cc4afda0-d8ed-4f7c-aa1d-d410534a3461", "value": "7087b147f313ef14a71d3d8edf5a0750", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0e78a20-c4e2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679071369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679071369, "uuid": "aa0e1c08-a1d3-4a14-8f04-780484aef2f4", "comment": "Malware payload (Smoke Loader)", "value": "1ec4811e3e49423273f174a796df10f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679071369, "uuid": "835373d2-fb8f-4cd7-8a91-a734294ed8fb", "comment": "Malware payload (Smoke Loader)", "value": "1ab7a51b9a0cadfa15ac2ac17b3f02181082cf33837e8d9e74faed52b6324689", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679071369, "uuid": "c54fcb4e-ce8a-44b8-9083-61e094a7fd9e", "comment": "Malware payload (Smoke Loader)", "value": "0619748930b0b78b83efe2b0decc406a572f8651", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679071369, "uuid": "d6e143b9-222a-4b12-858e-fd6707e43aee", "comment": "Malware payload (Smoke Loader)", "value": "081e0018ae28b32f6606d5cab225f7a46f16efef719908803500c134123bf0ea95e0fda1b446e11f9f18be949cb3386d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679071369, "uuid": "495afa93-a486-41e7-91c5-62af8e270c35", "value": "T132642A4396E17C40F6268B73AE2EC6EA762DB550CF49B7B52218DE2F04B0172C763712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679071369, "uuid": "ad0c299d-4d7e-483d-8491-26b82367c681", "value": "abe3ddf8623240e0db2d6ab65f42f1d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679071369, "uuid": "c8050f31-dd43-4fd4-8bcd-76cb03a3b79a", "value": "3072:X+cx5EpLNoGdqpWfoaZ6/ahi5kbneWwqeA8S/W9LwtSLm+DpTq2I3wK:X3x5EpLKG8owaA/V+qqeATe9Lwt0mYZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679071369, "uuid": "1e8892b8-a0ac-4e94-9c61-4d6e89d86542", "value": 307712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679071369, "uuid": "9e43d69a-f9e0-413a-a800-83edc24a74f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679071369, "uuid": "19277ffc-90ee-4477-a3e1-770401e14e1b", "value": "1ec4811e3e49423273f174a796df10f7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b9d70ce-c470-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1679022102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679022102, "uuid": "7d820320-8c8e-4f1e-a4a2-87f57e2bca9a", "comment": "Malware payload (Amadey)", "value": "f13cdeb0040e750e2cbe18d61e1b832f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679022102, "uuid": "7a0e9dfd-3599-4182-97f5-62158b326a79", "comment": "Malware payload (Amadey)", "value": "1b42bd858071965be6f685c1f41963d1ffdb84a3b9ab14fd107a950de79fe8d6", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679022102, "uuid": "9d071c2d-ab54-4bd9-9ffe-d22b94938abc", "comment": "Malware payload (Amadey)", "value": "1cbb262716921b3ffb03809987dda3e327641319", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679022102, "uuid": "c1ae6dbd-0b95-467d-b21d-c697aeb12549", "comment": "Malware payload (Amadey)", "value": "cc181392b30100d7b2fae062cd313cdd2dd9d9fbb556b8c46e0f5016ae3da7aa56a9c1f37384f3dee17a71bb9bc90302", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679022102, "uuid": "27c02334-5423-4cc6-a84e-d4929c940393", "value": "T19B45020393E1FC88EA2A8B72DE1EC6F8765EF5518F49376632285E1F4571176C1A3B80", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679022102, "uuid": "e0eecbb2-141a-4be1-8c82-f022d401f0e8", "value": "02bcb533fc6eab16fabdf3b7ff49a9d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679022102, "uuid": "c327f048-ce42-42d6-8f8e-d33bfb21c452", "value": "24576:o8ohR8bPifxEqc0/cCB4NZxNBF4dkU3eQPXaI95:+RDEZUXB4PdF4RbPXaI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679022102, "uuid": "0376716f-d43c-4125-9398-20c568ed29fd", "value": 1246720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679022102, "uuid": "d824b226-745d-4881-be8b-f9a8c13117be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679022102, "uuid": "fb6b940b-9484-455e-8cca-752d8e668eb3", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "391791bb-c4c6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679059115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679059115, "uuid": "0a2a9f86-9ac8-483f-b2e1-b513301e88e6", "comment": "Malware payload (Smoke Loader)", "value": "ed00264900153279e587afd1f30133a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679059115, "uuid": "8b43b92b-b578-4c4f-b873-873b073ecb40", "comment": "Malware payload (Smoke Loader)", "value": "1b47e6ab6638a2d79d7a5f80627f4e96a7169b8083c6d69fb8f32ee6efcc2aa5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679059115, "uuid": "304d2ae9-e0f7-40aa-a175-6e1cc4c4a3c1", "comment": "Malware payload (Smoke Loader)", "value": "8bb7adb48b7890cd19305ab714e6734521e7a093", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679059115, "uuid": "8bd26986-1a7d-4f34-881f-aa68c7d13582", "comment": "Malware payload (Smoke Loader)", "value": "db00702afe18f004a74d46238093ce935b519e0a1bd2a81c294e5c52543bf27c6afe55e82281fd54fccda8444a4286e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679059115, "uuid": "9aca7252-1b1e-43a2-b0a8-2e58632de0b9", "value": "T16054184397E17C41EA268B33AE1EC6E8761DB661CF6D77B62218DE1F04B2172C163712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679059115, "uuid": "37556d94-2fd7-4694-a021-e92113125401", "value": "800c211657980cdb5c72386d0a0450fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679059115, "uuid": "9f2faaa7-dc77-4f8b-9ae2-17073588a106", "value": "3072:H9PwCL0rWO12Ean+bh8zyXBlTxPjwOKvq1Rc6LWOI36pc9N:9wCL0KO12NWhoMBPpzwas", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679059115, "uuid": "ae98613b-c34b-46a2-a0bb-edc565fcf3be", "value": 303616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679059115, "uuid": "256ae287-792d-4d90-9029-7d52c092ce7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679059115, "uuid": "eef6caae-6984-4d3d-8e07-bf579eff4744", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58ac8fc4-c497-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1679038982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038982, "uuid": "ca147ab5-88d3-4501-835c-707e62404570", "comment": "Malware payload (Heodo)", "value": "238f7e8cd973a386b61348ab2629a912", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038982, "uuid": "9305597a-b2e4-4d10-bb47-6506f28e16ce", "comment": "Malware payload (Heodo)", "value": "1c3a7f886a544fc56e91b7232402a1d86282165e2699b7bf36e2b1781cb2adc2", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038982, "uuid": "fe135f49-354c-4075-8fb2-1a2e2cfbd470", "comment": "Malware payload (Heodo)", "value": "f87f164125c9506a16ca21cb03104f6a04321592", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038982, "uuid": "a8b8c474-d6aa-46ea-b788-1604583f69ec", "comment": "Malware payload (Heodo)", "value": "c7c0bd09032ec2c82a69bd9f7b40ef5ed92de0af68dc4d14aa1cb3c7242aae39fed612f44a58c0be5bc9c57af0ef9bbd", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038982, "uuid": "ef6f7896-0428-402f-920d-617a16fd0e66", "value": "T12AC33BF1A8025C0AE123C976B1FB661399D051ED42283B2BF87D507DD978A20D5DD8EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038982, "uuid": "1bade1b4-6ea0-436a-ac7a-80b79da276b1", "value": "1536:RDBoTVdaeNtuXndCrJJmT4HVnteV4FrdMiYcx7bfCb6HPdnXW:1BoC+tCYvSMVnte8ZP1Y6Jm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679038982, "uuid": "82f717f9-7d9a-4beb-ad36-52747c8b8225", "value": 120428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679038982, "uuid": "442bf346-075e-49f8-b6d0-ed1a94fd7afe", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038982, "uuid": "1cd10a78-6491-456b-99f5-fc77d5c7a3da", "value": "OMICS Online_1.one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c9f725d-c46f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679021889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679021889, "uuid": "c604b236-f610-4766-9e10-bdde51b6b45e", "comment": "Malware payload (RedLineStealer)", "value": "ffb8057f284c864292c39811c0455303", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679021889, "uuid": "5829a890-15a4-458f-9ab0-654872ce6965", "comment": "Malware payload (RedLineStealer)", "value": "1c61ca7dcb7fb936889a3a1404e23c3ce507b0394e68896224e0ecd67f906956", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679021889, "uuid": "7f20ba8c-5d2a-450d-a42f-ed7838601f71", "comment": "Malware payload (RedLineStealer)", "value": "098cdbf8da63c3f4fcf78a8466ec6888806a7c18", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679021889, "uuid": "fbcf848d-61e7-4827-92da-bd23ae94462c", "comment": "Malware payload (RedLineStealer)", "value": "dee571d8666a96f396b0404ebda679e95df8351efd83de6ab900e6b54bdefdaf992aec8cbdcd91485e69ccdb01958181", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679021889, "uuid": "c8d9f8ca-19bf-4829-9d64-74ec71b05fcc", "value": "T17F45020393E1FC88EA2A8B72DE1EC6F8765EF5518F49376632285E1F4571176C1A3B80", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679021889, "uuid": "4088793e-e5ff-49ca-87ef-14f7409bbbad", "value": "02bcb533fc6eab16fabdf3b7ff49a9d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679021889, "uuid": "e45581e7-ceaf-4469-b41d-cc4a5f20d2d0", "value": "24576:e8ohR8bPifxEqc0/cCB4NZxNBF4dkU3eQPXaI95:4RDEZUXB4PdF4RbPXaI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679021889, "uuid": "20a53c87-acf9-495c-bdbf-181a7aecc131", "value": 1246720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679021889, "uuid": "05e8dc96-afb8-4451-8b75-662371f04f88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679021889, "uuid": "3aafd5fb-0ef7-4858-972d-76f604e60d1c", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "537237a5-c4b4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stealc)", "timestamp": 1679051429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679051429, "uuid": "4a5d9c7d-33d6-43c5-ac02-eade96f0e152", "comment": "Malware payload (Stealc)", "value": "05787ebc019958fca129355c370b3e9d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679051429, "uuid": "1eef060d-2718-430c-a37b-572e7873e710", "comment": "Malware payload (Stealc)", "value": "1c712527b7dbb47545b9bff829f3285dc63c77d85f969d0a0c4581b449d167ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679051429, "uuid": "ac08985c-39a4-4882-b8de-5c7b0a0b4285", "comment": "Malware payload (Stealc)", "value": "4b170c7d895f40ba930dfe722889f0067fc9e863", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679051429, "uuid": "f58015fc-f892-4911-8e3c-7d9a1c78e375", "comment": "Malware payload (Stealc)", "value": "49e4bc7df0b2d12eb3767f80c544c87996145aa3a096044b41442e2898feb28a23fba8c06e6959e7aa786be9d2abd363", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679051429, "uuid": "fd452d66-c42f-4063-b59e-63ba91a5cb89", "value": "T13C168416F313E962C18A4677330FD6A09A613F355826C86BF6C2F74B3A101AD5EDAF50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679051429, "uuid": "aaec3dbc-820f-4c63-ae7c-411f0390b441", "value": "c851bc519d202341332f968ad8e7733b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679051429, "uuid": "9350df00-e722-414e-b5c3-d6fb684473bc", "value": "98304:+NjJ+0e9jv4BKLjD5+Gcwu148YLA60HmhWpZJr+KqX9hXxE563mHcHoYhY+tb0lz:0kDhLjkG9Q+3g1j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679051429, "uuid": "22114c10-da1b-4665-8fd5-f98289c31a33", "value": 4109032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679051429, "uuid": "913a3ad4-e343-415c-ba33-41f22b2da558", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679051429, "uuid": "65fd3703-115f-41ce-99dd-bbb3d5a7e092", "value": "05787ebc019958fca129355c370b3e9d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28c03515-c4a9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679046633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679046633, "uuid": "07303eb6-f86e-4a4a-a5a7-efedf492b4d1", "comment": "Malware payload (Mirai)", "value": "18134aec963ac2aaa5a6e21ccacff3a6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679046633, "uuid": "74e63e3b-ea08-4dea-8242-3b23bc065199", "comment": "Malware payload (Mirai)", "value": "1ca90f552992418a5abf061a837d932f490e8822d713d60dda7f5b41de65d78b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679046633, "uuid": "35ffcb36-a02e-4e97-a38c-ec4cceb8efa6", "comment": "Malware payload (Mirai)", "value": "994700879ccc73643596d19d01f43440ec5761ac", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679046633, "uuid": "c34f2dd0-a0ef-4f28-a3ee-fa02014855af", "comment": "Malware payload (Mirai)", "value": "06d61aa00b92d7bfbef351d66771cd56723519592aae7786c2713a337fce81ce1ee67fa13b2b0063d432cadd60793977", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679046633, "uuid": "8257c9ac-e5d1-4989-af0f-6ede2ba5ea93", "value": "T12AB2D19DF04C2946CEEE5C7DB48F07D2AE55A1FD71A7460E27218CC03736257684A1FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679046633, "uuid": "066bb94e-13a7-4e96-b689-a7e259ddca40", "value": "384:bw+wxJwgaMXncCn0Vph7oZsEvcgofZfo+kUdxKr90AiH3TH6RWGVCz0NvOg:bLgJwgaM3cCK1oPfofZAkxKrW7DHGWe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679046633, "uuid": "ef1b40f5-6b8f-4a70-84cd-d77f0154c0d9", "value": 24928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679046633, "uuid": "4948ee47-6d57-4e11-8f7b-5b09d2a97566", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679046633, "uuid": "0823c49a-8ed1-4e0d-bbc0-020ebefc1e31", "value": "18134aec963ac2aaa5a6e21ccacff3a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6949d1d5-c4e4-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679072081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679072081, "uuid": "b9c062e6-1834-4e86-ad1b-70f06cfbfbb8", "comment": "Malware payload (AgentTesla)", "value": "dc1a0e96e6fbd074ce9e7fce4fea4aa7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679072081, "uuid": "05b66e0e-90c7-4b46-8908-114d395eff8f", "comment": "Malware payload (AgentTesla)", "value": "1cdb6737f8c9bd9e1631e59e2fd023c3863497bd8ce912b6d3abfb8ba6376be3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679072081, "uuid": "233f6de8-0ae8-4cdd-85fd-aac4519849fd", "comment": "Malware payload (AgentTesla)", "value": "e662fd59a762e0417d65731806dc3454f6c8f13c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679072081, "uuid": "7eb975a9-835a-4c46-9836-7fddf28a008f", "comment": "Malware payload (AgentTesla)", "value": "761584cba5842b1643e86e5fc356bce46aeb93097b065f7747cdd9da763587ea775ff13c0ec67f728fccd03aa6542fd2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679072081, "uuid": "72c79993-23d2-4fb3-b48e-44465a44d0cd", "value": "T110A46852F4B2FC28EE295E3E8C4F5A410DFD0EC5B4D6462BA440F6C24A766B6C45BE0D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679072081, "uuid": "6e1a2773-2b3e-4276-ab95-655f7ecccba4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679072081, "uuid": "c8c70213-f87f-4558-944d-9b7a5b9ce7fd", "value": "6144:2szno/RDE6QYXUCxzK0b99RtteJa3NZX:BoJDJQYXZzProkdZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679072081, "uuid": "f9ef4fd0-966e-4a1d-8c1b-4771d9f747a6", "value": 450560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679072081, "uuid": "a2f6866c-e2db-4a2d-9e0c-dacbd24120b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679072081, "uuid": "5057753b-aa99-4efd-9987-e988f861b098", "value": "Bestellung_(PO4703392)_doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d9492bf-c46d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679020978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679020978, "uuid": "f22ebe1d-e04a-45ec-81e7-2e161e9461d5", "comment": "Malware payload (Mirai)", "value": "637a8dfd0957f5a6fcc316f8336cf2fd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679020978, "uuid": "f76b3cae-4513-4595-871e-36d66299b903", "comment": "Malware payload (Mirai)", "value": "1d1a9cc60f9d7a17a5d450ff7897df4a9c977b0fe87bbc5669c27e5262dc6f3a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679020978, "uuid": "0b2c5033-8a6d-4a2e-aa74-252016e53051", "comment": "Malware payload (Mirai)", "value": "000c1bc83139b4d6d478d42d9ede6de6ee9b449a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679020978, "uuid": "02e1f47a-a7e5-4517-99e2-e0384e08064d", "comment": "Malware payload (Mirai)", "value": "7226bf97ae1268543a564048b7d1d128766715ebd9f5a54e647bc0945bbf239f8f217b03bac543b55d7d7f5ee0371f20", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679020978, "uuid": "a81ff17b-ae07-43f3-9b1c-153c7d87d7f5", "value": "T115B2D0CD608C244ACCAE3C7D6B8E9B230D4491D1B3DFAF1663558E09A76E54EB4CC175", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679020978, "uuid": "54e1d27e-3b65-487a-ae2c-b99588973c87", "value": "768:oCrQlS07dEv0UXqUhvQE+CXImrHhv29LodQZqEWvG:/QlS07FUXqIYSXjVMzqM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679020978, "uuid": "6ed641a8-4fe9-4580-abff-972bfc6c8e16", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679020978, "uuid": "4017cf43-d414-4422-bb75-e6ad58fd7a8b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679020978, "uuid": "d7e30d8e-e4d3-45ce-8027-7a7abcbd8ea8", "value": "637a8dfd0957f5a6fcc316f8336cf2fd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35e88b0a-c4e5-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679072424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679072424, "uuid": "1c206360-88d4-48e3-bc5e-9e6418c2ba73", "comment": "Malware payload (RedLineStealer)", "value": "94310980f2d17ca37d66a0ad36792efd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679072424, "uuid": "5672d769-2a88-40fa-b8f3-8e235b11c931", "comment": "Malware payload (RedLineStealer)", "value": "1d430c6c2ff0fe3461375292d8198cdc07e07a1bcbed0d71f1ecc9d77c5ab756", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679072424, "uuid": "552d23d9-d35c-4c8a-9e37-980c0aaf5b3e", "comment": "Malware payload (RedLineStealer)", "value": "73c6f94e042ada8d6398e777ba3cf209fc700334", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679072424, "uuid": "ae04d526-3c63-4f9e-96f7-734e0cde831a", "comment": "Malware payload (RedLineStealer)", "value": "09512a778f6c8d9be4f457113d566e30b9857c652aff18a538c4ad45e9a56e5751a09aa7fc88278785004a5f6586ec37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679072424, "uuid": "0e8c4153-8081-4a2f-b635-ea4ef490f731", "value": "T1E9752302BAC6C4B2D12109320E2DB755327CBD305F24DABFB3D16E2CEA79191E625B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679072424, "uuid": "8f90e548-dfed-4300-b7af-a54abfa511fe", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679072424, "uuid": "b00fa53f-d8ff-4460-a2af-70382f8dfaf9", "value": "24576:0NA3R5drX/WdlTCA39djGqxUrQnaYTlqBFYXh64VheguM85XOKJWj9UAihki42w:V5OdlGSvjvex721CfkRrV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679072424, "uuid": "ed5568e9-b529-446a-b4b6-0ca97e3b10a9", "value": 1678238, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679072424, "uuid": "69e3a5c3-58ff-4ff8-bdff-483cf5be27cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679072424, "uuid": "804b6747-9285-4e2e-8245-019b1815659a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d963cc7-c4db-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679068303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679068303, "uuid": "3e41d92e-9fe2-4dfa-a575-6a5124453754", "comment": "Malware payload (Smoke Loader)", "value": "964bf3aac49e71be8770c1ec17f56424", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679068303, "uuid": "237ef8c7-4ba9-46b1-ac8d-98f3582c243d", "comment": "Malware payload (Smoke Loader)", "value": "1e5ff338bce07c1978e6c826b2f530c4fd445a9a5db9a891d49907b95e560087", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679068303, "uuid": "bbd2a4c7-781f-46ac-89a2-58a783e3abdd", "comment": "Malware payload (Smoke Loader)", "value": "e3957332dea744e3f59bdc27f1ce0fa54cda811c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679068303, "uuid": "7a32837a-8e99-4334-95e4-7d96893b4d88", "comment": "Malware payload (Smoke Loader)", "value": "c3facedf57cae9f6efd0f0798f988af6b9029ecd184cea8d570ba478b00bd8ba1283ee35ba123dbf94678ad3f38bb20a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679068303, "uuid": "7217132c-71e3-46bf-93c5-18b8ada010c1", "value": "T1B354194392B17C48E9264B729E1FC6E8775DFA518F8977693218AA1F04F2372C163F90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679068303, "uuid": "0238552b-2d68-4cf6-9a57-fdaf77a04986", "value": "6e76b494f1a9946f83b6b72033f310be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679068303, "uuid": "9ef6970a-6205-4fec-8445-61b01f851fc1", "value": "3072:6UEOZwILyrWcV3IHdvjjaHBi8mgE8TXwuyYvxGxZ4PNmnI4ytft2HnuM:75wILyKcV3IHpjWhi8xZ0vZoMOGHnu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679068303, "uuid": "3e821b76-c46e-464b-9b03-e056f9b1aaeb", "value": 302592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679068303, "uuid": "f7f405e2-2012-4157-9c3e-674d07024b27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679068303, "uuid": "f16c0b92-f330-4b72-a6e2-bed6ea79b2b9", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6716962-c4a6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1679045582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045582, "uuid": "5b4c7b67-675a-484b-bd2b-deba261d3d37", "comment": "Malware payload (Gafgyt)", "value": "ad31dd7445131adc79f7d9020cb4f753", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045582, "uuid": "09b48f13-e8a3-40cd-b853-c1e815a36aa2", "comment": "Malware payload (Gafgyt)", "value": "1ed5e45d792507b2a4ca729715b4c193c8e2f5f781ac368c18ea673f22a9e93d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045582, "uuid": "16834a6f-d685-4adf-9227-ce14af0a01e4", "comment": "Malware payload (Gafgyt)", "value": "cc1d6ab041ab23de09c12740fff8b09e5d4683bf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045582, "uuid": "1f36da6a-a103-4b49-8539-2f812b761bd4", "comment": "Malware payload (Gafgyt)", "value": "9e9ec479d576e81398d749733b7e44eddec99a2164fba8df820a861056405f1184fe49416dac08f6c5ac32bba632c1bf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045582, "uuid": "ad45779b-5f2c-4d9d-84f1-d08b270012c0", "value": "T1FDC30A45F941875BC3D327BAE74E428C37355E2897DB33156A38BDB42BF2B982D29120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045582, "uuid": "e4dc0a5f-0adf-483b-9128-da29e5a3995a", "value": "3072:hQrFRNfuLrGhEPOD0eg3gNlmBoHQuQekQnYW:IFzuaEGQeg3CmBoHQuQekQnYW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679045582, "uuid": "9e137fcd-11d3-422e-8be0-288686be3857", "value": 120177, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679045582, "uuid": "8cc85b69-fc77-4317-b3a3-349a6e071391", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045582, "uuid": "38f8d8c9-c414-4f68-9992-8681f827d641", "value": "ad31dd7445131adc79f7d9020cb4f753", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4817c722-c49e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1679041961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679041961, "uuid": "49537a68-1e5e-491c-8f6c-1141b3346cd1", "comment": "Malware payload (Gafgyt)", "value": "bb5969a09c19af8d3169f7d8f7948111", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679041961, "uuid": "4cbced3e-5fde-4a48-b07f-100c4086d7c9", "comment": "Malware payload (Gafgyt)", "value": "1ef200cefbefc1d51d5d30c24cdf94b4beb8bbd7b8d303ed1e180a2baa502348", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679041961, "uuid": "5c0f17f4-0500-4a46-99ec-b67575301587", "comment": "Malware payload (Gafgyt)", "value": "2a84eb89160e24d5aa0020592802e893aeccf1cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679041961, "uuid": "6e469273-a569-4bd5-979c-9238692ff9e1", "comment": "Malware payload (Gafgyt)", "value": "6c3f7a745730e5ba9f127c21d0bd4010cf481c626a9362faf95b09d695733498a2b3805f1c694745e23d0b5f3c21eab3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679041961, "uuid": "6496e1db-7e7e-4909-9db2-2b562e6642b1", "value": "T142834C2766A2C63BC0C756F81BDB95229413F8391B33720A73E87DE92F169D86E5D301", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679041961, "uuid": "e78a1dd6-fedc-46c6-9ff1-983247e7c0da", "value": "1536:B74oud+AJrSbKhakxnkc6yw83lJ1F2y2qDRMfdmw+ZWOT42oF54S:Rg+AJrSEtkc6yBlJay3odmvZWOT9oF5L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679041961, "uuid": "8c64e046-763c-41c9-a0a8-16d8504db7a3", "value": 85622, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679041961, "uuid": "1b8a9b7f-15b5-4f7e-982d-401e4b6b07f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679041961, "uuid": "1f1332d8-1fb2-4ec3-a399-3d3efd1b0895", "value": "Demon.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0013e19-c4a3-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679044336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044336, "uuid": "4ebb2c8b-c9f0-4ed4-b4a0-2aa1a28d0015", "comment": "Malware payload (RedLineStealer)", "value": "f52e4c3fd0f05d9eb3423fd33d236529", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044336, "uuid": "d3a09820-2791-46db-8f93-ced4e74fae20", "comment": "Malware payload (RedLineStealer)", "value": "1fb81e56fb8aa02491a6706f4d97facafd9d362899593715ca369ad1489cd44f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044336, "uuid": "0c95aea4-4744-426a-9efb-03fa57f7c74b", "comment": "Malware payload (RedLineStealer)", "value": "f8f52a79fc266e4afc19611a68d217d5862ce6ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044336, "uuid": "2f9c84a9-6228-4eca-a229-41a151d63b85", "comment": "Malware payload (RedLineStealer)", "value": "a53f420ec179d3cfea0b52db7ea1e2abab04e5f1c92019211ba4c076c4483a6dcd467c264339af1c3b499124efca592b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044336, "uuid": "c992c412-c2fe-4bd6-be25-4ac191c23e2a", "value": "T104847D0397E17D50EA268B73AE1FC6E8761DF6618F1A77B52218DE2F04B11B2D163702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044336, "uuid": "85823c77-8586-4405-b950-aa4b3ae0e853", "value": "abe3ddf8623240e0db2d6ab65f42f1d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044336, "uuid": "afca6036-64b8-45f1-a119-a6532ce059ce", "value": "6144:v4siRiLeltGekvHZ1rq8brdpl383LTd1lDh/Qn1:vPiRiSzGZv50KrF83F1lDh/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679044336, "uuid": "d40f5f77-4d76-4e87-9913-3d4db6c16bbb", "value": 406016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679044336, "uuid": "4876fbda-24d3-4e6b-9f44-0b3e565af798", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044336, "uuid": "b778d326-3560-4b8a-8992-09032057636f", "value": "f52e4c3fd0f05d9eb3423fd33d236529.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68d3f5ca-c4a5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1679045022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045022, "uuid": "930b63f4-e4b1-487e-ba97-117361900c95", "comment": "Malware payload (Rhadamanthys)", "value": "c089e14461f32d62bb3d668a9b4d74d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045022, "uuid": "43f5f5f5-a156-449f-bf46-238e062866c5", "comment": "Malware payload (Rhadamanthys)", "value": "20961f62913589b49b94b752bf24dea490fd3b420ee095b427f57cf4b5213bfa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045022, "uuid": "4db360cb-fbb7-4e32-a82a-f92135f23eb1", "comment": "Malware payload (Rhadamanthys)", "value": "e5ada992ea1e9eb6f472a90884a937aea87add6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045022, "uuid": "db26f379-ec6d-4042-8818-13cd0e97cb87", "comment": "Malware payload (Rhadamanthys)", "value": "169b6cee9ae382587dc0e67e75838c9d2e204f52513448e4c5917471aef8176438d17404f8769d9ccfe4110ffefb32b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045022, "uuid": "b5fc7f9f-50fc-438a-a075-fa67f0a7b60e", "value": "T19A34CF0393E47C64F4138A714E2EC1F4766EF5638E7AAF6F22185A2F08B11A2C56F751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045022, "uuid": "58ab92c8-2396-4498-8b9a-ac7278798c61", "value": "3391dcebdf72207e22a1ac369ab55c39", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045022, "uuid": "ae6dd543-f127-47a3-a1a0-fd5e937e447e", "value": "6144:n4CVBg0nRp9QlF0lsoA90JTDD+BRr7usiqOZLZHryShpJ:n4CVBl/U0yorcoBb5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679045022, "uuid": "f0a48ac4-b0de-4766-b7f8-3aababf6e824", "value": 252416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679045022, "uuid": "6a5159d8-b89a-4eed-84d7-400ba3cb4286", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045022, "uuid": "614480bd-d6b7-409f-801a-3538277e79a0", "value": "c089e14461f32d62bb3d668a9b4d74d6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f378dc5a-c4ae-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679049120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679049120, "uuid": "09261cfa-9d48-4d94-a93c-faf826a8d9ee", "comment": "Malware payload (Mirai)", "value": "5052c3b249193d3829e355ca631c8a4e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679049120, "uuid": "643ad73c-627f-4f3e-919e-cd796d88649d", "comment": "Malware payload (Mirai)", "value": "20ce3046b841b270e8affd969b6dd02d798fd69b9c454b1a432a43cc1383a30d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679049120, "uuid": "14ff8c8c-ca3b-4c15-82b0-7cc6731b0969", "comment": "Malware payload (Mirai)", "value": "587fb4c3b669a8b3f51342e5344f268245169dd4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679049120, "uuid": "6c167c9f-1aa0-41f6-aab9-528121e8b138", "comment": "Malware payload (Mirai)", "value": "447082f072c6ee7258706213482d527b6e7149607cee57e4177d1ee973734c36170a2f61e0e71717017560a75111f12c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679049120, "uuid": "f50cbb5c-cbaf-40df-8ecb-34b2a069f1b6", "value": "T131343A45E9818E13C4D5277AFAAF018E3332A7A5D3DBB2028D146FB437C7A5E0D63A45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679049120, "uuid": "5d640ff3-a7b2-4424-99ca-7e80602c172c", "value": "6144:yh9YK3jidg+aHlkWxpFxobrfsoCG59ZAu9mrsplDKZUUQBKXAVannX+F8JyvqkwH:yhmK3jidg+aHlkWxpFxobrfsoNV9mrsM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679049120, "uuid": "b1d599f0-03ef-4103-821f-ed3159b771d4", "value": 244280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679049120, "uuid": "59b82dfd-2069-47ab-b273-82529406685b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679049120, "uuid": "bda76f71-466c-416e-a3b1-73028278b5d5", "value": "5052c3b249193d3829e355ca631c8a4e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cf6c71c-c497-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1679038962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038962, "uuid": "acfdd35f-c99d-451b-9b73-f0efff414469", "comment": "Malware payload (Heodo)", "value": "3f500cc3841341b20de9888d223af2de", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038962, "uuid": "1426a34c-4e3d-4d79-b7e3-16b329a50c01", "comment": "Malware payload (Heodo)", "value": "20f56516b723a3d24a246867fd9ae1d0874e0d16547f59faaccc5d432b808ef8", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038962, "uuid": "602e3d06-67dc-41a7-a8e9-6ba4b65a4cbb", "comment": "Malware payload (Heodo)", "value": "59b2523e6501909be960f6e4a161e64642ac786b", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038962, "uuid": "64c08b6d-dae2-4ece-b467-d75fd28c72a0", "comment": "Malware payload (Heodo)", "value": "0f9451dcbf206dd9ba98fdabb9bfb12f368fbc0a9723b6f17d920f808e0edf8dad363fb3bb04f26ac9ede3a28e337ed3", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038962, "uuid": "7f2ded11-9504-4ed8-a3b5-36559dbbf7cd", "value": "T161C33BF1A8025C0AE123C976B1FB661399D052ED42283B2BF87D507DD978A20D5DD8EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038962, "uuid": "6120a43b-8c15-4bbe-8eca-80b63b5ffed4", "value": "1536:RDBoTVdaeNtuXndCrJJmT4HVnteV4FrdMiYcx7bfCb6HPdnXa:1BoC+tCYvSMVnte8ZP1Y6Jq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679038962, "uuid": "be227e82-1dfe-4390-9404-d9beb985546a", "value": 120428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679038962, "uuid": "2a04dedb-313b-47c2-b368-43d72bf85e70", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038962, "uuid": "8babe1e8-e50e-4a09-8d14-45ac44d29595", "value": "iMedPub LTD_2.one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a67e3f4f-c4c6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679059299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679059299, "uuid": "6640b7b6-f74f-4b9c-ab39-36f6630ec175", "comment": "Malware payload (Mirai)", "value": "571d950f05663d9033e18efc084b4466", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679059299, "uuid": "e3d2fb3a-9af6-433f-82ad-84a46ca4d206", "comment": "Malware payload (Mirai)", "value": "220c3d5fe831f66a16330c28519979fb8b7b0948f30170799ce8231f6139e5f7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679059299, "uuid": "c3d9d54e-040f-4eb5-8e28-cb1a31d4177d", "comment": "Malware payload (Mirai)", "value": "e620dc2f4130c703f177da49eaf36e12630c0136", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679059299, "uuid": "e7254aab-eb21-4329-b79f-d1958844931f", "comment": "Malware payload (Mirai)", "value": "03ddeb849833203c97af9f307dbed0c3f0e4f6b105ce00dd1a81bef03bea53153976c1dfdf810d096a1650be2a9ee6ed", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679059299, "uuid": "82419f73-adf5-4733-a864-63ef8db61425", "value": "T174834B41F743C6B3C88307B2029BAE665931BDAA1E2A9F4AF31D3DF46B128C47116F55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679059299, "uuid": "670df98d-ec24-4061-8b52-435733d6af28", "value": "1536:6b5buJU4d3J6lreO5rYhWD8Bx9Q/hcVmF+wVOz+sXcfW7k:wbuJU4ZJ6liOK04j9Q/hcVmEwVOz+ucx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679059299, "uuid": "3be585b2-5c53-4ff2-8255-899345f6f543", "value": 84996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679059299, "uuid": "5e72a56b-6062-4a09-8609-8e09585cf600", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679059299, "uuid": "90d8f130-cc2f-486d-a165-75b8c5af76d7", "value": "571d950f05663d9033e18efc084b4466", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "608085d0-c4be-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1679055746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679055746, "uuid": "58779db8-c1b6-4b2f-9b66-e77d6322e4e7", "comment": "Malware payload (Gafgyt)", "value": "9f86639bd12893fcac350603aa67d438", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679055746, "uuid": "a95e8b97-f002-46b6-b4d8-266018590e29", "comment": "Malware payload (Gafgyt)", "value": "22195433e641256010dbd5bbf4e5ab9608ce4820f5e45e8154e966718870db1c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679055746, "uuid": "e00ed2a1-66fc-444f-8ca7-502715cdc7d8", "comment": "Malware payload (Gafgyt)", "value": "d5d7c2d9ddfe14e61f2444795768a37eb280a343", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679055746, "uuid": "94895e4f-6977-4171-af39-3f7c5bc948f2", "comment": "Malware payload (Gafgyt)", "value": "6d2964730300b5b79150e05a0725167a009004b13e51f5ec05b74cc0a215eea480545f2afa552eace3bb5663fd0c917f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679055746, "uuid": "0a51e57e-f6d5-462f-8c20-d5226639f7ea", "value": "T1B8B328436B1C0B87C49B9AB01DA737F18B69BD7112A351C9A90BFEC04733AB81527F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679055746, "uuid": "9d2555ef-bc5f-4c5b-a58d-018ea0675461", "value": "3072:WD3l+XQzPeV91310pWudJKakpNDtm2pgYMidIP1W:WD3l+XQzPe713CpWCJypxtm2pgYMidIQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679055746, "uuid": "7df750f3-cf35-4d87-a2a0-7e9123eda4d5", "value": 113194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679055746, "uuid": "581b4ab1-b51e-4a26-861a-0f55060a56d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679055746, "uuid": "8962b1dc-adad-4093-9e1b-c9d49c196e4e", "value": "9f86639bd12893fcac350603aa67d438", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d88e8ec-c4ac-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679048063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679048063, "uuid": "4a0f9f7b-a92b-4ce4-893b-dcbda4f68632", "comment": "Malware payload (Mirai)", "value": "fef169bcc7ba567e3a515596ff5d1786", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679048063, "uuid": "65c089c0-1777-4f27-be2b-f73b9f8d6ddb", "comment": "Malware payload (Mirai)", "value": "232e66267afbf302bc7d8c5a742083e762bb23e25a17f701005e78188341a56c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679048063, "uuid": "9d0d7e0d-61b7-4a0d-a26a-7251d91f31e9", "comment": "Malware payload (Mirai)", "value": "c948fd7e20bc74901395c3468e6a01b866ef38d5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679048063, "uuid": "1c267b36-bcf6-456a-89d4-7a3f07653113", "comment": "Malware payload (Mirai)", "value": "0454f8aa321a40501943db4a0215b2212a6688e6d56eb85e0ce210c902b9658ab36c43974f35bd511cc6204c57332f9d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679048063, "uuid": "3a990150-4b6f-4004-a730-ffe6f6a4b631", "value": "T1BAF31941AC829A26C6D623BBFA7F008E331567E9D2DA7217CC201F1177CA91F0D67B95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679048063, "uuid": "cbbb4b01-4eb3-4236-89c0-6ab592b2be2a", "value": "3072:lHgRBjUcPTnxzHzaOjXJfNtLQtVzwgMUkTdfesJpI:lHgRBj9PTnVJFBQtlaUkTdmszI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679048063, "uuid": "bb84a398-f33f-4c8d-ae72-db4024a83676", "value": 165184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679048063, "uuid": "87cea9a3-4285-4a71-a8e2-78cdc170792f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679048063, "uuid": "538d2880-bb07-4c38-86a8-22b0d827ade3", "value": "fef169bcc7ba567e3a515596ff5d1786", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9635970-c4aa-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679047385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679047385, "uuid": "9741585b-f8fb-4b60-9153-e61ba57cfe73", "comment": "Malware payload (Mirai)", "value": "3ae1c7f6573292787248ffb45672d943", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679047385, "uuid": "c9b77704-326e-436a-9762-1ed9250c7849", "comment": "Malware payload (Mirai)", "value": "233f2c97f185b439e4013042312ef0f73d5b154d2538e5d920f3f875fd976208", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679047385, "uuid": "ae3c7cfe-4a58-4c45-b4df-344ebc003d5e", "comment": "Malware payload (Mirai)", "value": "363b7a9384d90c69ea1ad7a06b246a715533626f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679047385, "uuid": "d6a20116-ba47-4bd3-be64-205a197c9c8a", "comment": "Malware payload (Mirai)", "value": "5b8db8df119e14c103f96586ba2462dd0a7c54f771747424cbd5690abea885186c2ff1c0cb6f3c8a43a34ee2691089b6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679047385, "uuid": "f52c8031-4bdf-4737-aa52-4a50e25249c2", "value": "T1F4F32885B8819A21C6C523BBF92E008E331267F9E2DEB253CD105F6477CA91F0D77A95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679047385, "uuid": "6283819c-49a4-4369-9342-997586466623", "value": "3072:1IC6v0KJLlSj7RZ7yzX+ztSJGaiBy/5jtruvoxen/U9mrsplDKZUJQBKXAVan6X1:1IC6v0clSj737yzX+ztSJGaP5ZKvoxez", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679047385, "uuid": "0176e206-009e-4daf-8841-a3de3c509e40", "value": 170312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679047385, "uuid": "8d604924-58ca-4c62-8d1f-7a771575969b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679047385, "uuid": "0469326a-0ab2-4486-bc99-2a33fa37cfc8", "value": "3ae1c7f6573292787248ffb45672d943", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33889a20-c4a5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1679044933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044933, "uuid": "882a25e3-c982-437d-ad92-16bcfb489cc2", "comment": "Malware payload (Rhadamanthys)", "value": "6ecca3e7b17f581db1aad6dae5d9aa50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044933, "uuid": "8ba8d1c3-5016-4560-bc2d-c16f5ecbe10d", "comment": "Malware payload (Rhadamanthys)", "value": "23877a233e06072abb29e61801e071780c35bf7c9c46fa0b37faa3da7ac936de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044933, "uuid": "57e602e7-3bda-4528-9601-c671323b04f8", "comment": "Malware payload (Rhadamanthys)", "value": "20bf3b434d7816fa51988703e6f53e2e9a7a8bec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044933, "uuid": "5bb58056-cde3-4617-8256-7abc782a7d58", "comment": "Malware payload (Rhadamanthys)", "value": "1c1f3ad04beaf4f0bd1f4fda1570d86df64249b00f843707c98e5416749fff0ed46ff659e2ce9d8a945f02e91bd9b96a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044933, "uuid": "31361457-53c3-4c78-a882-6041dad0d4bf", "value": "T1B534C00393F06855F4228A325F1EF2F47A1FF4119EABEBD623445A2F18B05B2D6627D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044933, "uuid": "bc375137-82ac-4f3d-a369-699e19fa2963", "value": "6149c9f35229403fdda7d9d88d405383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044933, "uuid": "3709def1-a9b5-4d31-a2eb-e4aea3a8469a", "value": "6144:YhT7QooSjuaKWZ8zK+0qmXPWkiGt9NcVItpXm:YhT7QzSjqWqe+x7kt9NjX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679044933, "uuid": "a56d9be4-455c-40c6-b211-4e9702c0660c", "value": 252928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679044933, "uuid": "0b076d86-8d8a-44ef-803e-46d0ebfa43da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044933, "uuid": "5a3f3168-8189-45d0-976a-1d461e6c0182", "value": "6ecca3e7b17f581db1aad6dae5d9aa50.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb94e0cf-c472-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stop)", "timestamp": 1679023337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679023337, "uuid": "89b376e0-e637-4342-8e5b-f7be96b6e607", "comment": "Malware payload (Stop)", "value": "c2e2ae02e5befcd25c49e0bb034da31d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679023337, "uuid": "fdd84e84-988c-48fe-8847-3843a68fec39", "comment": "Malware payload (Stop)", "value": "23954824513cf2158577a1800118aabb54c45d1c088f71d7cdd841fbe6362d24", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679023337, "uuid": "dfc0ef92-0fa8-4eac-94e4-27d56b379f87", "comment": "Malware payload (Stop)", "value": "f723baf5b1edc743922b230150007f0f0ffa8e01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679023337, "uuid": "fb19a082-0e8e-48cf-a955-b773ce57f166", "comment": "Malware payload (Stop)", "value": "ed2b30ee39bfa29cbc78b72c80aa558a073be8ed70cb8194493a14b214dfe87363a14bb6ce120bb087ae0e4d65785f4b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679023337, "uuid": "56599562-7d36-42e2-b8f8-3321054289fd", "value": "T10EE4120383F4B8A0F555CA714E2F86E4775EF563CE69AF6B32089A5F08B1261D5AF310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679023337, "uuid": "0ea962c8-a085-4a9f-9951-6addd5dc6c1b", "value": "4b2faf5e2157c756cf2fd31d6cfd3d44", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679023337, "uuid": "28b88066-5b0d-4176-a5f8-55c54c1e944f", "value": "12288:FwhrKDXWAI6LnzOEiM0JWlKvjS0AokW6LgVW1mzGBJM2w4GpwribRWa:bzISnqhM0VbAokWkkW1xJM2w4GaeW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679023337, "uuid": "46f75e00-4c68-46c5-9d8c-13d55fcf4710", "value": 699392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679023337, "uuid": "63d06fcd-eb56-474e-b5e3-bac5fd5b38bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679023337, "uuid": "969bf2ea-5588-4f5d-b83a-a98abf6784c9", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "512201b4-c4f6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1679079772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079772, "uuid": "4aa834e0-cc31-46d5-b3a1-15a19c6de454", "comment": "Malware payload (Rhadamanthys)", "value": "2665574e54a70ab457d570ed4c2605a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079772, "uuid": "1717eac7-0564-44ba-a28d-f9d7c3c97a50", "comment": "Malware payload (Rhadamanthys)", "value": "23a34d5cd145e663015d364f485b8ee77aca233982ec4f7023f617b4ecf1cb03", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079772, "uuid": "aaa2ad3b-1afc-4da1-b562-03660f346544", "comment": "Malware payload (Rhadamanthys)", "value": "28efd8059b52bcf198c1ca2cbe9539a332b6c88f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079772, "uuid": "d2fc8cf6-66fa-4369-8194-576ed7bcd061", "comment": "Malware payload (Rhadamanthys)", "value": "03350fd7e95223748c0b3a5cd26ddd8de26df3594c0fc58fc905cba9de178dbd937084ae7985dc231e739882dfe34deb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079772, "uuid": "3a036be9-c0fe-4a5a-aae7-6e9c46426f76", "value": "T115745B4393A17C48E9264B72DE1FC2E8779DF6618E8977693218AB1F04F2172D163F90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079772, "uuid": "dac1822f-4550-481d-a53e-c4b4d74e95c6", "value": "6e76b494f1a9946f83b6b72033f310be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079772, "uuid": "2251f451-18ee-4050-a0fe-2f10fefb660a", "value": "6144:lpJ7Lo3bC9wVRuaWi7uS/ywC0P1zw/J3Z0vwkHu8dtd9u:nJ7Gb+wVRuoyE63Z0vw0tnu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679079772, "uuid": "c32c9008-0743-45df-adab-ba95f9154585", "value": 367616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679079772, "uuid": "a6f749d2-b72d-4aba-886c-c6a0c5ea34e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079772, "uuid": "4006ca41-5c55-444b-b972-2e02a457c8e6", "value": "2665574e54a70ab457d570ed4c2605a2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "180cfeb2-c4c5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stealc)", "timestamp": 1679058630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679058630, "uuid": "265a6e71-fb5b-4e3a-b906-4c70724dd8d8", "comment": "Malware payload (Stealc)", "value": "e1b6ac741d81250e1374a828beeaf9fd", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679058630, "uuid": "54b07448-32f8-4c91-b771-f93228ca13d6", "comment": "Malware payload (Stealc)", "value": "23f0440bae78c2d40ebdf75a4127857fd531ea167e7525271330e966e24fa13a", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679058630, "uuid": "a2813cf9-a8f9-4db0-bedd-6f915044d692", "comment": "Malware payload (Stealc)", "value": "2b901307b4262f2b27461dd532a79582218a80e9", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679058630, "uuid": "8762c43a-fd7a-418b-984e-32d0f71315c8", "comment": "Malware payload (Stealc)", "value": "bf35f27d4d2e0edbae79adafcff4d69817850954107775bf510a6585aecc65cdfa7f4d983bb0193fc785ab15e4735a85", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679058630, "uuid": "13bd5013-5e4e-40b6-b40d-17d59c9d2de4", "value": "T1C00613913340C326EA6BC8305E57839D9659ECA4EA207C47E2A4F7DF463ABC35EE5710", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679058630, "uuid": "0d805b64-731f-499a-986e-fe2edf53b149", "value": "49152:LpUPlOPlQRNDP9nqI5KKs2p8iYu9ap7QqKHKG+n2H6h1Ug:LpTt4NDVPKB2vinG8n2Hs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679058630, "uuid": "3be0dead-ab0a-4970-81b7-de0e997d8aec", "value": 3832000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679058630, "uuid": "3872cc60-20f8-4552-baca-f4ddc6a1083a", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679058630, "uuid": "cf4a8ea1-cb9b-4c0d-8e09-3892b6c41e4a", "value": "e1b6ac741d81250e1374a828beeaf9fd.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ba67ec1-c46f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679021834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679021834, "uuid": "e44352d7-34a1-4d3b-9bd8-84fbdbd73124", "comment": "Malware payload (RedLineStealer)", "value": "f7e469503c0699679d8d960684826bf3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679021834, "uuid": "4e1e5ffc-a2e1-4ee8-9dba-d5fdbd2b86d3", "comment": "Malware payload (RedLineStealer)", "value": "25d21e4fc131a2fc482ad5257402e435f9679e6037797884e5d1ab13a8890d0a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679021834, "uuid": "ba8c7796-50cc-4945-9eeb-303253f97474", "comment": "Malware payload (RedLineStealer)", "value": "385d3213b1362cdef07145314571191890e73ed2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679021834, "uuid": "fd37fef9-597d-4fbd-a730-a39e060590f6", "comment": "Malware payload (RedLineStealer)", "value": "ae369c2b089bf2a943cdd354468d6f58c0d063653fd465ad4cd6794c67678ce7053588099677f9d93adbe101173c1691", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679021834, "uuid": "92d8b908-8a2e-4f8f-a5f7-0a379c76973d", "value": "T13425120242E17C60E4658BB55E1AF2F8FB1BF5014E66E3E37328AB6F19725A2C5533D0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679021834, "uuid": "77bdc208-c635-4507-9686-e96602a13a2a", "value": "6149c9f35229403fdda7d9d88d405383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679021834, "uuid": "2109fb04-e9b6-43e6-8144-9b09db8a1d5b", "value": "24576:qtpqPLoJS2nPsuAVc2PStfnxdwZNYfrMXoIemTNFB3iLUI46B:tLssPa2InxyLYkoI5NriLUI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679021834, "uuid": "8b3b5a71-a45b-42b8-bd98-e0d956318971", "value": 1053696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679021834, "uuid": "457452f1-2535-48b0-9d62-7de9f53dfda6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679021834, "uuid": "6ab5a282-f05e-4e56-9333-4c6441731256", "value": "f7e469503c0699679d8d960684826bf3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b012ec3-c497-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1679038986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038986, "uuid": "c743affe-0c94-4b6c-a193-15b53e54937a", "comment": "Malware payload (Heodo)", "value": "c131b1fea492f58602b23cdecbfe9c7f", "object_relation": "md5", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038986, "uuid": "714c6cea-3ca7-4eea-8fe0-253f52050daa", "comment": "Malware payload (Heodo)", "value": "25de741b008fc4b54b83f84918ea265c75fede0bcfab142746eca3c61bddce20", "object_relation": "sha256", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038986, "uuid": "3e437912-38e3-47f4-83ed-1aac6c162659", "comment": "Malware payload (Heodo)", "value": "b3a182240e6f91df28f46fb8edf050dd7e11c4b7", "object_relation": "sha1", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038986, "uuid": "1a4cc037-62a0-47f1-a521-3ca88e3ca734", "comment": "Malware payload (Heodo)", "value": "5e873712551c53484b254baf9404711163639e23c130e3e760ec19ed08245c7b89d2fd9bccdbef6c74727ca4292b3782", "object_relation": "sha3-384", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038986, "uuid": "08cb3dc5-5430-4065-9a6f-e48bb26d2e08", "value": "T164E41254BAFF7915F5006F72428745A1C3A8B6D704EF2AA18754B41EB4A73AFFB07408", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038986, "uuid": "ea81785d-2e3e-4603-97c1-93a2e74a24b5", "value": "3072:SIFb4Wmkqke+cEeqH9vH+i2s1Vj8JxuLVpMs75XLKZv/:SOykqk6Lw+i2s1Vjkxuxp/Qv/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679038986, "uuid": "2a3dc1ba-db53-467c-b599-d0a239cf364f", "value": 714608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679038986, "uuid": "5977ece7-abe3-4914-96e1-ae64bc347985", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038986, "uuid": "70d1b8bd-51cd-4278-a7ad-02ef408316ed", "value": "OMICS Online.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddd48b21-c4d5-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679065834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679065834, "uuid": "9af3d6fb-137c-4f38-a7a9-6fa72556eef0", "comment": "Malware payload (RedLineStealer)", "value": "0191cb1f788338484c31712a343f0b52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679065834, "uuid": "f76ac47b-d9ab-4286-aaa4-3020c8fc5f64", "comment": "Malware payload (RedLineStealer)", "value": "263d1a091eafd115e0f9f2e408df14b7ce5e1f06c3ad66e01819d2f7a9a539cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679065834, "uuid": "7e6891b6-a9d1-4ef7-ac18-e3555dd0a75c", "comment": "Malware payload (RedLineStealer)", "value": "f78ef09e96fa492639253bb10d0153f0f27053a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679065834, "uuid": "c4eb2544-3661-4db9-8d4c-f7fa900595a7", "comment": "Malware payload (RedLineStealer)", "value": "ac64ab78b07ac728dcff1a15b548a33814436fbd6ebb6e130782db989e440091cda1612bf3c38b90a2c89283f433156c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679065834, "uuid": "1a238498-c6a8-4d73-8e11-ece155a8ef6e", "value": "T1DC04C41437BCCD11E5BA5A3F6961A05087BFE8026842F25B76C367CD0E32B50F957AA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679065834, "uuid": "4e86b1cb-de64-4db0-b48b-ad0e960c0d26", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679065834, "uuid": "ccd234a0-1d2a-4ca6-a6fb-e4e9b29d13ff", "value": "3072:nxqZWpZaPkOQ3xxW3l0weBFFuh/jxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOi:xqZwxxW1Cuh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679065834, "uuid": "0b903d28-4406-4d51-a0c4-225e7b57e8ae", "value": 179200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679065834, "uuid": "ef811a4d-89af-468e-bdfd-6b8086410af3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679065834, "uuid": "8426dda3-a96b-4f26-bfc5-f4eb7ce68fc8", "value": "263d1a091eafd115e0f9f2e408df14b7ce5e1f06c3ad6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1e06e09-c4f1-11ed-88f6-42010a9c006e", "comment": "Malware payload (IcedID)", "timestamp": 1679077867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679077867, "uuid": "7223136d-78e3-474d-9c86-ceaf0dd97b9e", "comment": "Malware payload (IcedID)", "value": "2ed4c52849a4936601057af9fdd3b761", "object_relation": "md5", "Tag": [ { "name": "946873669", "colour": "#13ED14", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679077867, "uuid": "48970d5f-11ad-4d8c-9aef-96215f65474d", "comment": "Malware payload (IcedID)", "value": "26509fa876a07966824bed8e5b0a6e0626b37d68355871fac49b2fa636d7fe6e", "object_relation": "sha256", "Tag": [ { "name": "946873669", "colour": "#13ED14", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679077867, "uuid": "572bce3a-4254-47bf-a44f-6ef8a941c7fd", "comment": "Malware payload (IcedID)", "value": "329195d5123e5d1b087dccd408cb7a7b2cf78b62", "object_relation": "sha1", "Tag": [ { "name": "946873669", "colour": "#13ED14", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679077867, "uuid": "0dbe93ff-57bc-4e2b-a86a-f5faef7724cc", "comment": "Malware payload (IcedID)", "value": "95e1d192e564bbc33b5735b71c51118e09c8a2a1fd6494e2236da47c992d69873d2190f46797dcafd132599f67504f32", "object_relation": "sha3-384", "Tag": [ { "name": "946873669", "colour": "#13ED14", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679077867, "uuid": "726cd4fa-24f4-4452-a193-06d7ce25f214", "value": "T1B29312895078BA7CDC33413987C651A4A2CBF1DBB8D1A8A73FEC5C2992834D0877B592", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679077867, "uuid": "3f9ca1b4-4b4e-4215-a512-32513e0213f3", "value": "1536:E9/61mTBPnwaXEpbg0vn0l7GF5MCI1MDAKJDojPI1flNBOheDXLG8lqrYm4:8/61mFnr8MurIiDAKJDQiqheDC4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679077867, "uuid": "dba844eb-9ff0-43df-8a77-50af2d76d2cf", "value": 93108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679077867, "uuid": "0e70dc28-d02d-4080-b47e-00e8fe38ade8", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679077867, "uuid": "e90aa342-4675-4b51-9645-442bbdd9be19", "value": "JlCfqHageWaCS_2OWwpuBiazfWg1WHH6xJsvpjbX-m4.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16793ac2-c4a5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679044884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044884, "uuid": "0bd99c02-7e51-425b-8bd1-338ac07f64d2", "comment": "Malware payload", "value": "28e5fceaa9878bfbe967639cf2a2fb9b", "object_relation": "md5", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044884, "uuid": "39305c67-3d52-4395-a6e0-cae800cbd87e", "comment": "Malware payload", "value": "26b113ba29b037034ee34a7f0fea81f6d5452950e0d26058d9b96946d78570c5", "object_relation": "sha256", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044884, "uuid": "238c4d92-00b0-46ff-856a-e30fe148b2e5", "comment": "Malware payload", "value": "b9ad129f15e565201d860a04e0e26cce97a254e8", "object_relation": "sha1", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044884, "uuid": "ea57d311-8e8a-4eba-a3ad-5bd562bc27ba", "comment": "Malware payload", "value": "efbb95025870e4ca0674efc8463fca204f958891c1ce6a983d0c2ae43226646db067e5fb3251720f7828c404de126d6d", "object_relation": "sha3-384", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044884, "uuid": "47e20741-ab76-4e09-8da3-be94c943177d", "value": "T1BC13DEDC0154226ED3A361A1AF19F0847A2FFA2818F184E475DFD7BDA1BF5ECC522522", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044884, "uuid": "156338e8-c7bc-4f5e-a989-82d4e5a44b1b", "value": "384:qsgKf+AFKwE1zybDEFE7E5O+l3i6rGsexJqjn8nhCqYhAjDx4nMNLSJ0b:qsgKfWm7Er1jn8l/NLSJ0b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679044884, "uuid": "707e2eb3-4aa4-418f-96a5-1135a82a5903", "value": 43147, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679044884, "uuid": "dbfc69fc-5162-4a31-96e4-547484a04225", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044884, "uuid": "8f011902-449d-4d94-b471-908b8ac2a71f", "value": "28e5fceaa9878bfbe967639cf2a2fb9b.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8088dcc8-c47b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Chaos)", "timestamp": 1679027023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679027023, "uuid": "020e7b1a-497a-40b1-9bd0-0ed59c8c557d", "comment": "Malware payload (Chaos)", "value": "099629a70f18e084d27ecb67e363a13b", "object_relation": "md5", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679027023, "uuid": "8c8df100-60d2-4e0c-91b0-a64abb79b672", "comment": "Malware payload (Chaos)", "value": "26d297c0f3512054f4858e75b78829cf1ceda056ff8458d81ab7003ab1f08a2b", "object_relation": "sha256", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679027023, "uuid": "8e7beb46-32c1-45ff-9618-4ff28430c76c", "comment": "Malware payload (Chaos)", "value": "dd50b0e6471e231e6db6a1c0dc79dc9cd8b04463", "object_relation": "sha1", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679027023, "uuid": "66bcc352-78b1-4016-b04c-da3ae83b8bfa", "comment": "Malware payload (Chaos)", "value": "f4a9c6e87ca85c9ac6ed0ba2e45410bbb1500b35a17f84526de26d8a3b5aa5168b97be11d10a0bf840b80cbbc7abdd55", "object_relation": "sha3-384", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679027023, "uuid": "a3230183-f343-4515-8918-87d3d69193fb", "value": "T1E534CE342EFA502AF1B3EE7D9BE4759A955EB7A33707885D20B1038A0723943DDC153A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679027023, "uuid": "a5fe795d-0ae9-496b-a8c6-ad15298c49ac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679027023, "uuid": "196e7cf7-0d9d-4eba-b03b-b5c13c338583", "value": "3072:woI7Yyr9kL9z3+wdSe1WcBRjpW5VFMNBDf5qIS/QWqGiUEJhREVUAISsdWBYf7DU:iXr9kLhxhdsVFGEeRJk8nrKfQZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679027023, "uuid": "13b1c32d-47da-42f8-9c1f-c3a2e773e795", "value": 244224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679027023, "uuid": "f6a8d85b-64fe-47e2-91e8-1dfab7d0e361", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679027023, "uuid": "cac33602-3187-45ba-8996-3f41dbe8b8fb", "value": "2023-03-16_099629a70f18e084d27ecb67e363a13b_wannacry", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65f9a001-c471-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1679022683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679022683, "uuid": "d27904cb-3158-4793-a387-c8074a893276", "comment": "Malware payload (Rhadamanthys)", "value": "22a5f724e2b82988bece52bf323fdd3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679022683, "uuid": "f9ec0a37-8b7f-446c-b10f-a149c5484ea5", "comment": "Malware payload (Rhadamanthys)", "value": "2818d3958cd90df32cb5c771f355a28a0ff47a436afa30c0205ca2a12a4224d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679022683, "uuid": "30eb9fee-bbbc-4f49-a7d0-2e5605e46068", "comment": "Malware payload (Rhadamanthys)", "value": "18d3af37b159bbd0ba647092efbd3cdd34066db7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679022683, "uuid": "ffbe29a0-26af-4de9-bddc-fb26e283cfff", "comment": "Malware payload (Rhadamanthys)", "value": "67df4bf49319abdae02f11b815e0309b5d1902701b4fd3528b62e31b1453ca619fe61273e6c0117a812428a30dd64a9c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679022683, "uuid": "bf687fdf-ad65-4fbb-b1ac-ce965fb6b6a7", "value": "T15734C05343A57C61F5268B718F2FC1F8761EF8238E6AAF5B2318AA2F0470162D16F751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679022683, "uuid": "afc19eb2-8fd1-4fc4-a99c-fd607800943a", "value": "3391dcebdf72207e22a1ac369ab55c39", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679022683, "uuid": "26449aeb-7a98-44b2-84c1-8ffea19a7d17", "value": "3072:YfT9jI7V6ru/k+65lgeJkXU83zgp9uqgiajp8NEzeQ47T1sucHqwD8gqEQjnxm8g:E9MjkNgIkXUAs7VMQECVJR0dugihAJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679022683, "uuid": "cfec1292-26c1-4d32-8c9e-e651d2e60cf4", "value": 252416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679022683, "uuid": "39129d60-98e1-43ca-ad53-c8e7037ff1c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679022683, "uuid": "aa52ade8-72de-440c-8484-a8523310264c", "value": "sample.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68b23352-c4c6-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679059195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679059195, "uuid": "2889f30e-e4eb-4e6a-9c85-79dfafe662b7", "comment": "Malware payload (AgentTesla)", "value": "c5f36652ea367c1f5dd50769537e9290", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679059195, "uuid": "0ac86455-2d7c-4482-908c-9ebc72191804", "comment": "Malware payload (AgentTesla)", "value": "2827af0c48b241b4fdd781434343b08ecd0f2f843048e0bcf16b0c546ae0c3ac", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679059195, "uuid": "1488b62c-0b01-4be4-97c8-76fef8c1bfce", "comment": "Malware payload (AgentTesla)", "value": "c33ab04bed24d74816f1b8041cca8709a51f68ba", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679059195, "uuid": "6ecdd51a-faff-49df-89b8-dc4fb1d8a199", "comment": "Malware payload (AgentTesla)", "value": "dcdafb120d81158cef85ec3c87445f9fc528dc497f5f7daa8c8cbdab004b032d3fb7043b8b334a7006c796e8327ef9bd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679059195, "uuid": "9e9735ad-5846-4fc3-a020-9f664877aaee", "value": "T1ED05018DBAF46A14CB3E0BB7D4A3206483B286574F41D70E6DCA56A22F327D7C584C67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679059195, "uuid": "a3579806-0297-4845-aced-05a96a3542a5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679059195, "uuid": "f0ba3305-6064-4e98-886c-037678679c1f", "value": "24576:82EQwccYWk5spRgeIeSbLkGF6iMI8HXlz3Q:T/5MRgeINfk9iMXHV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679059195, "uuid": "c5c7e70c-7dfc-49d3-8e43-ea314c410319", "value": 815104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679059195, "uuid": "f4dbb464-c98b-4d42-8c8d-4956e1fa9b73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679059195, "uuid": "b6e8b7e4-d463-4ad5-bc5b-ca061170dab8", "value": "Swift EUR 17,970.25.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73eed89c-c46d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1679020989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679020989, "uuid": "ed56908f-3023-464b-a643-734a33483d05", "comment": "Malware payload (Formbook)", "value": "f35d8958edaab270d6c621bb96e395fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679020989, "uuid": "a9cb06c8-6271-4269-b4fd-9cf2af74d925", "comment": "Malware payload (Formbook)", "value": "2898cb7724546579022e85a86b222cc4caf739ea4b325a50f24512e4145f2f92", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679020989, "uuid": "2016760c-218f-4adb-98db-99b122987df3", "comment": "Malware payload (Formbook)", "value": "194f85bfcfae0f3c0ce55af40266c3fbed0ac245", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679020989, "uuid": "4c2ead08-ed7a-487b-9ba2-bfe9b41457f0", "comment": "Malware payload (Formbook)", "value": "7f28108f7f94fa7bef9f87339dfeacfb926dc67ef3592b0c783295fad0033f426e07a5888ecafaa3e4cb781798a6f306", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679020989, "uuid": "a08e0942-e6c0-415e-865c-763a03027c15", "value": "T1A6A412AA36F4463BEB30CAB41893150C9FA2B9397E49498ABF59703EF4CD317197650C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679020989, "uuid": "4973fd60-4628-4026-aa67-6737ff320f6f", "value": "12288:M9podLzMGtJXh2W0skbWd/2fvfwqk0Z4XE75VmiGU1:CpodLQgXhxYbVfvfwo9d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679020989, "uuid": "cd65f3df-6e26-4ce1-b5a1-eaa25fd053dd", "value": 471552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679020989, "uuid": "ef3e1119-d5c3-49a0-9902-bc9c102f58c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679020989, "uuid": "09cac17a-0d40-419b-84b2-5ed57f5074fc", "value": "f35d8958edaab270d6c621bb96e395fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed5eb3dd-c4aa-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679047392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679047392, "uuid": "da7ca29c-18da-434c-bf35-06c49473e861", "comment": "Malware payload (Mirai)", "value": "a4ffccaa12311c31692819054bf2e616", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679047392, "uuid": "1f17fe8f-8c2a-4d0c-b692-21dfe21a2564", "comment": "Malware payload (Mirai)", "value": "28b83cdde5c8da6d3c9249ad75a328b843675a56e0f1764ce5281b2ebfdd29a4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679047392, "uuid": "66ce9b8b-b522-46a6-8e9e-4bf4adf27cb9", "comment": "Malware payload (Mirai)", "value": "40a9ae98091e044435d423f3d992444c51245da9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679047392, "uuid": "f49e4ccb-ff7a-4aa9-8419-03a4f4e9a36c", "comment": "Malware payload (Mirai)", "value": "ea590e2439efcca73e27f9ab2c131388942ada60e0e7df520a2b6948f2e26d9481a88430064f76edbbd97a5099faad58", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679047392, "uuid": "41eaf3ba-68a0-46d1-9b7d-c125ede266b2", "value": "T1E7C2DF40F1418E05DFEA29F13D50CADABBE06F1FAA628E8126A553C25F1D2638306DCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679047392, "uuid": "de133a11-b88a-4623-8e61-ea6e137c9880", "value": "768:tVdafO76jpmNJJKehmA7trpfIX9KeA7P7Qvh4uVcqgw09b:Vam+AnKehPRa9aS4u+qgw09b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679047392, "uuid": "216e8ebb-6ee7-4e14-8991-5dc609c5bad5", "value": 27048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679047392, "uuid": "3037dd5f-9a81-47b7-9525-b880fd1f2325", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679047392, "uuid": "9254978f-0ef8-4267-bb24-e510bcc1b879", "value": "a4ffccaa12311c31692819054bf2e616", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5c684ba-c4e5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vidar)", "timestamp": 1679072746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679072746, "uuid": "60b0a1a9-4d30-477d-bffa-0609697d373c", "comment": "Malware payload (Vidar)", "value": "be957d1e2a534e3574f011706a3be620", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679072746, "uuid": "3a059434-2c72-4d4a-b1f9-e8fe650ca135", "comment": "Malware payload (Vidar)", "value": "28fab96c64901dfb70531dae3aefa8d1413fa1ed9cab275c00a3fb2d195aced3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679072746, "uuid": "c0ddf828-4ad1-4ee0-845f-9401c482b6a7", "comment": "Malware payload (Vidar)", "value": "f5a3499a5af43d0c770b59ce388f3d3457005e34", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679072746, "uuid": "f48624a7-58b2-4965-bffd-3b8673de09b3", "comment": "Malware payload (Vidar)", "value": "585281569cf76b7f63e2d0c5a04d715a9e2be01c16dd673ffcc70561f9ee79450affde9556af1b14fdd940134e3b357c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679072746, "uuid": "0b39f394-6710-4127-b63f-4eb5051fc7ea", "value": "T11125AC43B7781499CC26A0735C77CA2C030869CEE75B77657EB5B39B91A0AF6C9C2348", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679072746, "uuid": "603c5c7b-9757-4950-a32f-672ab08e1db7", "value": "12288:tdqrlb4AG/MtyC8fK7CUli/JPyfg2HATsw8y/2+ymB+XrsMfgmK4bQVxAwufFFb1:ChbfYMP25/JpYDyvQr7KMQVKtzwA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679072746, "uuid": "da56e097-0e0e-46b0-a0d1-0ba42fdc2a86", "value": 1056768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679072746, "uuid": "0d7b87ba-af47-4b01-a2a1-ae1477648ede", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679072746, "uuid": "7fd2ad1d-6ec8-4dc9-a438-f3005dda4e1f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fa46745-c4f4-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679078991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679078991, "uuid": "91890d23-96b6-4da3-bcc7-cb9113835e18", "comment": "Malware payload", "value": "562348e8dbd71f796420599713c73c02", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679078991, "uuid": "65abb914-6a10-4d0c-add0-1827810da1e8", "comment": "Malware payload", "value": "28fff67a5ec01a9ccd4c5101cdfeaa2a714d90322b39a5b5be4cb48e4ff78ea2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679078991, "uuid": "4f12f35e-4498-4559-9417-49da9d6936b5", "comment": "Malware payload", "value": "b21c5a26d2a3d7bb06d946397540de919e7acd64", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679078991, "uuid": "ce6d80b3-7d49-4f58-9bbe-2c21fd945129", "comment": "Malware payload", "value": "89e84e7cec8598658d476f6d231f3a9068fbbd0a227e990a698e4444d0c357ddc72f36495db1473e512bfc5657db2f91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679078991, "uuid": "c7962376-ded2-45cc-968c-c1f175ebd88b", "value": "T1A5E39220B1CB8631D4621D328DF6765CB738A6200F2B4BDB335C29785E6429CF6F9997", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679078991, "uuid": "cfe0bbe6-07a1-4201-bd8e-dbd1834a67be", "value": "31eba92d0073ffa8bbcfdb9711b34088", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679078991, "uuid": "c2542f36-f970-4f3f-8c02-610dbf80ce72", "value": "3072:OBkoDOa0GfjuYQWOd1nfS9KlTHSsq+dzplmKzBfcnhHKMISCVN/Q:/Vq+pluMMCn/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679078991, "uuid": "d219526c-d1aa-4706-a477-fdd3acd8145a", "value": 147968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679078991, "uuid": "f585da57-f48f-4715-ae54-8ec29a6daf3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679078991, "uuid": "673a633e-86cd-483e-9c06-cb79529cda27", "value": "562348e8dbd71f796420599713c73c02.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab289822-c4ac-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679048140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679048140, "uuid": "fb450ed3-2e1b-46c5-ab53-244ffe003f11", "comment": "Malware payload (Mirai)", "value": "1a56f3e70ae0f8a1c842712a15eca93c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679048140, "uuid": "9ef3db1f-0ad0-449e-a812-a23d48588b02", "comment": "Malware payload (Mirai)", "value": "294874aba7828aaf9b6fe25603d3f3f542cdb7b0500eede473eefaf70877936d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679048140, "uuid": "f6e2316c-ddd1-4949-9e58-33cbb1de6e45", "comment": "Malware payload (Mirai)", "value": "9fdf9843a40343b6ab5770812e4426c2050456e5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679048140, "uuid": "a8043fae-1745-4567-9c18-3bce779cfbe0", "comment": "Malware payload (Mirai)", "value": "22aae4b6861395f87ed37c42a3438ba2ac1b04dfad2423d6b6875d873b6678cb61ec0364b511a0cf6703c8131a410e1d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679048140, "uuid": "f98f3565-4bf8-4c72-8622-4f2a0eff15bd", "value": "T128536DC6B4119E7DF5CBE7BE44220D0EB821626150931B27BB6FFC83BD721A48956E07", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679048140, "uuid": "5f2e50b4-f7cc-4c54-8736-73023ec554c4", "value": "1536:kPqRg0FZTbSX5xZLepSGossFpxhOx2X/ZOqc/yA8W:p5ofF8I9cKE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679048140, "uuid": "3536aa2b-e83d-40bb-a898-8c796e3a5ed4", "value": 66508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679048140, "uuid": "4e3629c5-7261-4e63-8b65-a5f5eda1c160", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679048140, "uuid": "947d443e-dfce-461e-adeb-1038238e3c98", "value": "1a56f3e70ae0f8a1c842712a15eca93c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc829662-c4d1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679064168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679064168, "uuid": "14b4d45f-2cb7-47fb-98b8-7a1f72da819f", "comment": "Malware payload (Mirai)", "value": "19ea5957d11df17cc47ee2fdc3ba802d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679064168, "uuid": "e77fe8f1-480f-472e-a70f-53b62e39685b", "comment": "Malware payload (Mirai)", "value": "297acb6eec5c7078b0aed5962c634f90e9465b19fc1d162519c3fe8992e43a02", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679064168, "uuid": "25eb6b49-a9b2-44e1-b843-28cf000dff96", "comment": "Malware payload (Mirai)", "value": "f88cf1e2d970795e055e56d7fa67b8ba29d08829", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679064168, "uuid": "be1239e8-7675-41dc-bd2c-96c5a466cb82", "comment": "Malware payload (Mirai)", "value": "73e66764a8912d5ed4e03fedfc4b5012b488e9bff89335cf00d8addba2cff514438386e159a7fe7f774f6f5285003e99", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679064168, "uuid": "0bcbffb2-76de-48a3-bafc-72d5324f8191", "value": "T1EAA2D025E349AEF4DFAF9CA493C2C2C276F546C76786C8E340EEAF016506042B788D5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679064168, "uuid": "4f4e2627-30ec-492c-af7c-dfa94555caeb", "value": "384:9/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C57M4uVcqgw05VxJx:9RxsSVsMD6xiJJE5zRWNa4uVcqgw093", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679064168, "uuid": "ffb8bdaf-a36b-4cb6-b271-98e694afda82", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679064168, "uuid": "9ac70ca7-eb95-4585-8d37-bddb0a2aee88", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679064168, "uuid": "ce2a6e0b-a81d-46cf-acdf-fcb4a7445457", "value": "19ea5957d11df17cc47ee2fdc3ba802d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "629202f6-c4a6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1679045441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045441, "uuid": "11674ed6-02cd-49a3-98be-74801a0454a5", "comment": "Malware payload (Gafgyt)", "value": "3d68d30a2f8f68bbfa17379d9ef57830", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045441, "uuid": "bd46e4d2-f5f3-422b-9775-1ae465e40c04", "comment": "Malware payload (Gafgyt)", "value": "2b4e40a6d82b975f570fb227ab10c523dc6ee6fe82896260293f2274dbff472b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045441, "uuid": "21fb02e3-54b3-43b8-ae5b-ecfb1e065b41", "comment": "Malware payload (Gafgyt)", "value": "777d4611ed63584a432dda56858aadc47898ce08", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045441, "uuid": "1cafa03c-4814-472e-b1ea-2284b9097328", "comment": "Malware payload (Gafgyt)", "value": "da8234f78937d9ea0dc88ab455b0dd7846a018a0db19c34508c6b122a6c55d69f4f495fb93fe67f42d4834e11f1146a3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045441, "uuid": "adbabe16-7bda-4fb6-b686-97119b4e6ff6", "value": "T1DFB32801D5508B67C2D2237AFB9F825D37336B6897DB33115A24BBB42BC2B9D1E39121", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045441, "uuid": "d98850e3-b2b4-4ae8-a679-546cef2c116c", "value": "3072:03QlaDprXal5gFJDndNdHy7tPVumAQOqzXczN:03QGNXaqJDnKumAQOqzczN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679045441, "uuid": "5d579bd3-7efc-430e-b25a-2551a51773e0", "value": 111640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679045441, "uuid": "024932ec-e226-48bd-8724-46b6e1771649", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045441, "uuid": "00080722-c89a-4a79-8fda-9d6ee8631e54", "value": "3d68d30a2f8f68bbfa17379d9ef57830", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "879cda62-c4ac-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679048080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679048080, "uuid": "8b2f544c-54ce-4081-90c7-e65e297b365c", "comment": "Malware payload (Mirai)", "value": "e4bf7524c6d1d8db7c5bb7248d587acf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679048080, "uuid": "97491ab3-3ec1-434e-8652-fd48c11beb2e", "comment": "Malware payload (Mirai)", "value": "2b80c34e37e8354ac2d209d5eff76bbc5bbb00b48ca58f2858391eec29228c45", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679048080, "uuid": "85e1461f-5af7-4d0f-9fa0-289c67b27601", "comment": "Malware payload (Mirai)", "value": "9d639ec4231cdea54a2566b095ba42b07bf3c540", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679048080, "uuid": "687240fd-6e28-4f3e-9781-5b21e6a3654a", "comment": "Malware payload (Mirai)", "value": "9f9e5256bb6a5981c2d9e918c5856ae12b0df1c68e36a15eee421371c30b263394e12e47053cc3b13525187306969361", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679048080, "uuid": "2672091e-283a-4def-be74-abe17a714a6d", "value": "T143C2D085BA71F463CC302C7AEDA74D8E14915A38F2FF6177A60108189FC158FA9E56D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679048080, "uuid": "cfcda4ee-e9c7-4d10-ad6a-2613c5fe0676", "value": "768:DMKyhegCCMqfuUtc2ftze4P8uw5+MRpIFPMqR+M9CQ9q3UELun:oKy4qfu4Xw5NRpIFNRT8ZL6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679048080, "uuid": "fdf4575b-43c1-417e-a998-4214f00863ff", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679048080, "uuid": "19226b96-1a8b-445d-bcfa-ba753c9a7a48", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679048080, "uuid": "ead84635-9e35-4b41-823c-88aef25a1771", "value": "e4bf7524c6d1d8db7c5bb7248d587acf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56c71807-c497-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1679038979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038979, "uuid": "a9d620a1-1885-47d3-9d68-c01755962700", "comment": "Malware payload (Heodo)", "value": "5e5f9e4e0a1fa534737476dacbe48348", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038979, "uuid": "c5853234-cc30-4b3e-a28b-fbad876e67b1", "comment": "Malware payload (Heodo)", "value": "2b8a0bac5cb3d9991acf3b66fdbb60cf0fcfe7fc4bc783ad011315bed88c1221", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038979, "uuid": "7de113d2-40a7-4a4e-bd50-2ad292dc2472", "comment": "Malware payload (Heodo)", "value": "3554b122b5796893b8cd05b2dce61733a2ec5f81", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038979, "uuid": "abe31b17-ee53-4f44-9a14-d1e513440006", "comment": "Malware payload (Heodo)", "value": "e49c105bc1fd5d067acb1e4c469973e60a4c1bd6d05fb38fcc17b1a628679c24f8f39e46e5cb51c3f7e81b289d8469b0", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038979, "uuid": "9b4253d8-5f64-4fef-b35f-b6c871aaee15", "value": "T157C33BF1A8025C0AE123C976B1FB661399D051ED42283B2BF87D507DD978A20D6DD8EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038979, "uuid": "2288a6a7-29f6-4e6b-af0d-d22d7b836b38", "value": "1536:RDBoTVdaeNtuXndCrJJmT4HVnteV4FrdMiYcx7bfCb6HPdnXd:1BoC+tCYvSMVnte8ZP1Y6JN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679038979, "uuid": "f9ee36cc-7b3d-4e8a-93d8-94ae228cacba", "value": 120428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679038979, "uuid": "1c2d1df8-8006-4534-b76f-beaff7323be7", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038979, "uuid": "1610d2a5-14ce-4d9c-849e-83d3ecc79f27", "value": "Omics Journal.one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d948633-c4a4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679044466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044466, "uuid": "8c52fc8e-8cbd-4857-829b-84700326e78c", "comment": "Malware payload (Mirai)", "value": "a5375b4e596af383432890e4623dcf91", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044466, "uuid": "4ed4691a-ee86-4e93-b369-49d8b6d2d0ee", "comment": "Malware payload (Mirai)", "value": "2c54f51bd42b7043166058f180b4c9b0fe6e64e12925cbf4f626d5fdc0f89776", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044466, "uuid": "c1b43194-bf29-4541-8c9b-ddf03768059d", "comment": "Malware payload (Mirai)", "value": "b6eb679cf4f01f9fd033c1eef280b2e86d72cab6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044466, "uuid": "5ae6a2bb-b71a-413a-8620-2b74500e806a", "comment": "Malware payload (Mirai)", "value": "a110a4a5a28a1d0a1c4ba053a7ba03d5ded714eecc9b91f344c9a388052413970f95deca365ce9a5c0cdbe4c6c126bdf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044466, "uuid": "ef740fa6-0e47-4640-93c7-8f636d9ef3bb", "value": "T1C9D34AC5B193E5F5DC1205383036FB27AEB2E07A213AD987D3F81A63AD85B42C41667D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044466, "uuid": "8a7a718e-e350-4f43-a6c8-692b4ee8b586", "value": "3072:SkCkPD8kw9+xgA1RShFukEzw2ouSUwfNTHC36Fms5ZVkn2SWly/m4ivDTOLwlXub:Sk3PDbw9+xgsUHHin9SUwFTi36P5ZOo0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679044466, "uuid": "e33c1f66-da4f-4180-a581-70a21fe10b75", "value": 141392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679044466, "uuid": "d25224a8-4b3e-4a1d-a1e1-1aaf77bae89b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044466, "uuid": "dd7c5b00-6fe6-4c11-81d8-a6a946caf909", "value": "pandora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8256ac34-c47b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Chaos)", "timestamp": 1679027026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679027026, "uuid": "056619a7-b216-4657-a434-55879647305c", "comment": "Malware payload (Chaos)", "value": "a866ae68e7b0ea26a64e7bae31864920", "object_relation": "md5", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679027026, "uuid": "5e029b19-c8b0-4f8c-ba60-45f14d596b2b", "comment": "Malware payload (Chaos)", "value": "2c95abfc28f9ce4318d470cd020b6dc71242ce31a14b4dad069b8e2e6be48f42", "object_relation": "sha256", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679027026, "uuid": "6d7a78dd-5311-474e-b566-f6f6529b25fc", "comment": "Malware payload (Chaos)", "value": "2a82d14c95d97657402f92f23f4bc8d7d65cd7f4", "object_relation": "sha1", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679027026, "uuid": "b2db6a6e-e206-4cc4-8c7b-4c79594734e4", "comment": "Malware payload (Chaos)", "value": "3b60f63f33991d94bd4fbf45a37a1f11a381cbfbfbe5940cbe49027ccbb067c9579f2feeb07cd343505cb92aa4d2c497", "object_relation": "sha3-384", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679027026, "uuid": "c4feb089-8a1f-415d-b269-e655808822c3", "value": "T19ED2081977F64B35F2FB1FB92DB211416775BC62EE3DD65C088E004D0822F5C8AA1BA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679027026, "uuid": "8ac6ad6f-bb46-437d-9369-8d4bdcc51fd6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679027026, "uuid": "e400f771-343f-46e1-9265-5800a059a7fe", "value": "384:2OgHsLT31RyzatgWViaQiMvJ3Kr91C0YbJQyTZXEmjpEdMvhcVKUI6Y+t:2OgHsv2zm3FHMBar9dYbjTVEEECEnt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679027026, "uuid": "14043094-eb53-4c96-b502-96c4f019caff", "value": 30854, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679027026, "uuid": "50d91454-fe19-4e0a-982e-8b800e1c6f57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679027026, "uuid": "d2b2b886-003c-4067-ae45-345a0d990d43", "value": "2023-03-16_a866ae68e7b0ea26a64e7bae31864920_destroyer_wannacry", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e40a963-c4a2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mekotio)", "timestamp": 1679043662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679043662, "uuid": "f120080c-d3fa-44fb-9188-ca43b25bc7a9", "comment": "Malware payload (Mekotio)", "value": "67d866d13b1741c1c3aec8e299143827", "object_relation": "md5", "Tag": [ { "name": "Luxottica", "colour": "#1FA906", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679043662, "uuid": "5740eb59-6384-414b-9b77-7b260062cd8f", "comment": "Malware payload (Mekotio)", "value": "2d66915d5a2c1f9411938c376c9f5c213dcf6722017945c295f1a8a38a03d3c7", "object_relation": "sha256", "Tag": [ { "name": "Luxottica", "colour": "#1FA906", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679043662, "uuid": "9393b96a-37b5-4075-aa8b-3ac35ab305bf", "comment": "Malware payload (Mekotio)", "value": "2cb1937643f0480dedce518cd2c31ad1ee67842f", "object_relation": "sha1", "Tag": [ { "name": "Luxottica", "colour": "#1FA906", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679043662, "uuid": "b8afadab-da3d-4722-a034-ee012e77c0b3", "comment": "Malware payload (Mekotio)", "value": "20ef6e911959157f83c47c6cf935e8bcfc067c7e63f9d4025175aa77ea0556f35b0a069058fbb5417ccec17b7df13422", "object_relation": "sha3-384", "Tag": [ { "name": "Luxottica", "colour": "#1FA906", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679043662, "uuid": "c912162f-0ef0-4f3c-804f-c892b621dfc1", "value": "T1838633D8DE5C4974DFDF7FE1F51BC3036010A3783499AA16E2A4AB9E3CD58C2167A00A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679043662, "uuid": "2d07db40-5590-4f0b-879e-24f6f3877c40", "value": "196608:CAmh11MP5UiBBAp9hILKSFquA6FwQlSWfrNcj:CfcBUcBAThILgCnSUrNcj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679043662, "uuid": "39622014-4069-4e4e-b1fd-6a9b2158441b", "value": 8027779, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679043662, "uuid": "76c5145f-52e6-4224-bb18-806a45f483ea", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679043662, "uuid": "26c37505-d496-49dc-90c4-5a6138cceaaf", "value": "ID-FACT.1679043573.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c3c678c-c4c8-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679059953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679059953, "uuid": "f52acc59-bb6c-459b-92c9-ff49fe40150f", "comment": "Malware payload (AgentTesla)", "value": "ff8e46057402589460d25c1bfdccc6f2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679059953, "uuid": "dcf0cf2c-423b-449b-817d-45f76efda795", "comment": "Malware payload (AgentTesla)", "value": "2dbe80fb3da83a13bc61a9eb891b70f4f37638323bf1048fe094edda6eb4e201", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679059953, "uuid": "a8134801-a42d-451c-827f-a2dcb7feb809", "comment": "Malware payload (AgentTesla)", "value": "b774f3a364fa4582d0d28c9b41033464c84fa1e0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679059953, "uuid": "bbd71886-e908-4eb1-bb2c-cc46e896e4f5", "comment": "Malware payload (AgentTesla)", "value": "1df3a555ac7d60015ac953de65fc6898791ef67c7c27bed5e75c7517b09f24262b3f228ee9d3499db6c1cf73eb31201d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679059953, "uuid": "7ffb2223-a483-402c-8188-fc37cf6d157b", "value": "T1FD25E0AC355179AFC90BFD3BC5942C649A20A962930BD20760C715AE9ECDBDBCE015F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679059953, "uuid": "60296258-2d09-4da4-a5ec-ec280183c167", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679059953, "uuid": "dfd16d88-5e85-4df8-9907-474f275b0f71", "value": "24576:UWlJTM2hYlH4brdsgfJ2bR6FpRyx4+/h:U0FM2hY54/6bR6p/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679059953, "uuid": "8798707e-4248-41ca-9ddb-c4fa12bb9c81", "value": 1042944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679059953, "uuid": "a9f453cb-e77c-4219-918d-0be10f5a40d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679059953, "uuid": "98f6e367-3a7d-46ae-95e1-9ce9fcb2746c", "value": "New Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f879db3f-c4ae-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679049129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679049129, "uuid": "f0439e0f-b9ad-4265-bbed-4ea2be797ffa", "comment": "Malware payload (Mirai)", "value": "ced3f612a974667d2246eb42683883a2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679049129, "uuid": "b96dda91-0297-4093-8bee-b2581055c505", "comment": "Malware payload (Mirai)", "value": "2e0df12489020ad7e8ff3cd3c8bcbc0e1cd258c6c424822064d69f3c5edd5a2b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679049129, "uuid": "7103f58c-92ad-46a9-9f16-633dc8e0349b", "comment": "Malware payload (Mirai)", "value": "d3fbde4338e906bd16fe1ccb1ba24ae14a615886", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679049129, "uuid": "749c3ec4-779e-4a90-9f89-4e68e6e4c670", "comment": "Malware payload (Mirai)", "value": "2de634d8134e8dfb7d511e01395c9644bf7eff3aa4cc2bbc5e01f09aea4a6fc381e313020820f85aab454453e5d4c9b6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679049129, "uuid": "56ba2525-3ca2-43bb-9ca3-44246251dc42", "value": "T19A535C21BD3E2E17C0D4B47B62F78754B2E1274E25A4CA1E7D720E4EFF12A4066631B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679049129, "uuid": "b2cf7ac5-4b45-4b13-9e2a-8a01fa6e7b91", "value": "768:wVoEN7X6F4mvqvgqW7NJma6eFDaamv2qBtnO+CPKWgrqmK:wVBX6F4mvqvgqW7N/uaYt72ezK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679049129, "uuid": "04feae85-b900-4054-9f72-204206cedd7a", "value": 61076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679049129, "uuid": "9635c4be-0add-4aab-aecb-f474e6b03b59", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679049129, "uuid": "a7c9d895-9033-4a19-ae53-7bae9d071a47", "value": "ced3f612a974667d2246eb42683883a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8c61680-c4a0-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679042982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679042982, "uuid": "58049eea-8dbf-4854-a094-fb8781a8c85b", "comment": "Malware payload (AgentTesla)", "value": "da79c70eeaa01d04e871417fb9ab905e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679042982, "uuid": "830f71f7-1abe-4c18-b33a-92d6a41676e0", "comment": "Malware payload (AgentTesla)", "value": "2e88105d979bfbe65b2ed9322114fc21ef9e1fdb324a63d6198defd1e976d36e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679042982, "uuid": "aa450c32-428e-415c-9d92-837d98acc222", "comment": "Malware payload (AgentTesla)", "value": "eef43f38a9bc27dc3282e4ec6d4af69840a538f2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679042982, "uuid": "dfe40c1e-0b86-4be5-a645-3b881de82b00", "comment": "Malware payload (AgentTesla)", "value": "e0cd73dfb2bdeb2c79d07226598403fb6031ac6bd50fa67860138f871c64471425af9790646fe4fe5921e9a2b9ffd817", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679042982, "uuid": "ff9712c3-b78a-480f-a92d-45fd62933b22", "value": "T1D5D59EB10A93FF87E77F1EB4D00024808D6054578B6EA318B9C629579BE5358CF9A7F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679042982, "uuid": "7c27ef7a-a92f-4cf9-ad3d-7c87ebd54084", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679042982, "uuid": "187579b1-1ca8-48f7-b244-1dcaa3be2f65", "value": "24576:wagM+9AjtZqo9kY8sTEhKAPIk+9Ot09OX7l348A5Nyy3QVxs1tuOEDpV9l4ZtuyF:wNoGfKiIkItY5pyBfGvYE7Wn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679042982, "uuid": "8537836f-49b6-429a-af89-5ea9b272d0a8", "value": 2954240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679042982, "uuid": "1b101566-794a-4ccc-8795-4039819f4bfb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679042982, "uuid": "76cf4ef2-7054-489a-b447-67302db9b8a0", "value": "da79c70eeaa01d04e871417fb9ab905e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18c9d367-c4bf-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1679056055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679056055, "uuid": "d79d4a06-c93d-4f21-89a2-32454e31eb86", "comment": "Malware payload (Gafgyt)", "value": "bf7f45bcef191eac8aacbcd0a47c8bec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679056055, "uuid": "0ac5465b-6b16-4826-8a68-3867b4f6b7c2", "comment": "Malware payload (Gafgyt)", "value": "2eb7c55b4de9283d3ae92d8ac79113bdd499284441d5cb4e46ff1a850fbb291b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679056055, "uuid": "00e9375b-0d28-49a1-b813-71310a407c82", "comment": "Malware payload (Gafgyt)", "value": "fdf730fb5fa614cf810a53aafe28b0e893a2afa8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679056055, "uuid": "65b9644c-598c-4d98-bf4b-4414367345b9", "comment": "Malware payload (Gafgyt)", "value": "d2783eef1b9d3c16e32a01859a278d5593cbb89c6a6ee98b50a5ef2987074efeb94d6c920de99a0c5fd2cfa7f4e2a85a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679056055, "uuid": "5e64aa18-f792-423e-947e-a5485c46e0ae", "value": "T10F53F649B556C5F7C8120BB1029BBDDE0769FD398A7AAE44F3183CF45BB3894392A311", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679056055, "uuid": "d46df6c1-892c-4a85-9ed6-efde6fa7ca1d", "value": "1536:ZqCB7rO6tPhCVjMWrj1FnFiYNPTuBvMBzPzAGlDgqX:t7rO6tPhCVjMWrjLYwPTuRMau", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679056055, "uuid": "40e06da6-74d8-4864-9ec1-e833e757029a", "value": 63479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679056055, "uuid": "f0d1f897-80c8-4c09-aaa5-ec95958bff30", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679056055, "uuid": "4d1bccaf-72ee-45cc-90ed-c25c685fdd38", "value": "wget", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd41c778-c4aa-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679047419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679047419, "uuid": "801c6121-e4bd-453d-9733-42e65d9f0e28", "comment": "Malware payload (Mirai)", "value": "d3173306605d59e2c9b04bb91753f6ad", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679047419, "uuid": "c6cddf27-0598-4ab9-8504-f0b054004f72", "comment": "Malware payload (Mirai)", "value": "2ee8cf18952ba0e87a8d7b4502609e73b2a44f569cfbd14aa1b9678e9ace9e96", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679047419, "uuid": "fc6d6ee3-03bf-400d-a26c-d3e12b17e7ab", "comment": "Malware payload (Mirai)", "value": "57bdd00b00d885ebcd9895e21eb25e27febbf15e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679047419, "uuid": "d04b12e0-dd46-4cd9-9c10-f08894bf04d6", "comment": "Malware payload (Mirai)", "value": "a154a027418c645c03f010f0e7aa444e448c38571b99a6393778aa3d59e79fff0a0dc635341cf5cafb630d36191b12c4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679047419, "uuid": "6e829ec7-ab77-4eb8-b5e8-019e2d2a7b1a", "value": "T18AE32A30D4504B17C2C213FAA79E825E3F221F9793DB33115B38BAB41FE279A1D69924", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679047419, "uuid": "e6272449-6460-413c-8972-55ca2a3aa9fb", "value": "3072:Cv/WwsLgaq353qHiCOvhOpeqkDQHbeskmhxQwoVSUNu:KPLaq351hOpeqkLskmhxQwoVSUNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679047419, "uuid": "ab88a6df-c967-4615-b1f1-1de4d27b0d63", "value": 143019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679047419, "uuid": "90544c41-7c01-4927-93b5-8724645dca11", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679047419, "uuid": "0895e4a0-1ba5-4c55-bfa1-8c9499004e8b", "value": "d3173306605d59e2c9b04bb91753f6ad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f55b69e-c4a9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679046697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679046697, "uuid": "adddb793-8dbf-4244-985b-84e19fff0855", "comment": "Malware payload (Mirai)", "value": "50755a6b0f6a4e6f5aa34264693cb1e1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679046697, "uuid": "8a725599-354d-433f-a5c0-c735e7ea12f8", "comment": "Malware payload (Mirai)", "value": "2f12b22c1bb755d7b70c0872f81098d7586730acf79ccc9d8ec92cf97e03763e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679046697, "uuid": "42249e82-6019-4812-b8df-e078daa3f620", "comment": "Malware payload (Mirai)", "value": "371ebcc50f02a4f832885b463e8e8a16a51bf312", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679046697, "uuid": "4d02473c-1883-4b1c-865b-f3a7c5c216f1", "comment": "Malware payload (Mirai)", "value": "8e1981ed207cf13befa67372a0d829b2a1ffb24b7daf2da75a32cda579eff72738e3cade4f469480241024388d1741f6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679046697, "uuid": "b4e29f6c-3528-4589-9f30-d70fc361a0db", "value": "T1F9438D37E86E1E74C08641B074748EB56F23B5C893972EB61AA9C2795483E9CF504FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679046697, "uuid": "1923a852-356a-42da-81d3-7e5e7db74d19", "value": "1536:9aa0brW/Od9hlCRjKK/KQXACspfDCMx2+WF:9v0brWGd9XlKiQqpfDQ+I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679046697, "uuid": "39a4acf3-a4a3-471e-aa55-7ee3df91c1c1", "value": 58740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679046697, "uuid": "4e83a0c9-b1bb-4481-b45b-3da38df65de0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679046697, "uuid": "a492d4d9-7870-464e-9ba4-c5ac41de32d4", "value": "50755a6b0f6a4e6f5aa34264693cb1e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e321cb9-c4f5-11ed-88f6-42010a9c006e", "comment": "Malware payload (STRRAT)", "timestamp": 1679079391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079391, "uuid": "72d091c3-429f-4e86-80e4-c4d66272a256", "comment": "Malware payload (STRRAT)", "value": "2387ee175df0907e4733a26b0c4a8c04", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079391, "uuid": "c7888988-430a-48bb-9b86-73ccd8cc7ba7", "comment": "Malware payload (STRRAT)", "value": "2f1ff0a33f6cb96ceebe861ebcde3b6cb786aa66ac26271c4ded664ddccf1665", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079391, "uuid": "f5323f5d-c4b5-458a-8efa-fca7a52d59d4", "comment": "Malware payload (STRRAT)", "value": "8d97d9e1f7ae578f50c7d1396e11ae23c0f15b1d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079391, "uuid": "98405bcf-ddc1-416c-bf10-3a05b913eb36", "comment": "Malware payload (STRRAT)", "value": "61c6bf83622fa42a008796c333c2126df34c584ed646fdcae4f3b8a7501813217b53e97a5625ae085a5c456afb65ea6d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079391, "uuid": "2239497b-eb86-4a0f-8542-dab0adb109a6", "value": "T151749D09B9843F15FBB5AD2C033A951F42E4D565B020E6CB657AAF4E7F92F08C60F648", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079391, "uuid": "a5af3494-19ca-4c77-b25e-2443194444ae", "value": "6144:GQE55/2UbpEY9xAwW0G+HajU87XLSqPebax3lr8KIept3bal1lT8W3K:NSdzbppFHaj9mba3nInPK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679079391, "uuid": "15d09eb4-1ddc-4991-9d35-6fc7a1ffef90", "value": 341003, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679079391, "uuid": "80bf2deb-a91f-4f76-a0e3-d2c365c1e55e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079391, "uuid": "0a1c3b73-0db1-4b5c-ac99-2d3d1c8d55cf", "value": "Invoice No. 102220034.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "056f382b-c4ab-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679047432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679047432, "uuid": "0e8bfb2e-34a6-4aa8-a732-540134bad5d9", "comment": "Malware payload (Mirai)", "value": "5478d736590048c3076a6906296041ec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679047432, "uuid": "d6aa0be1-7d41-4d15-912d-6516186b494f", "comment": "Malware payload (Mirai)", "value": "3036836ff1d740d0308a1546eed2c7861f7c66ba5f08a70f4dd8230b64f4a090", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679047432, "uuid": "bb1d66d9-8f47-48d8-bfb4-9589f2b7068a", "comment": "Malware payload (Mirai)", "value": "c0292c91f935fb25bb6c66ea158da8208e068938", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679047432, "uuid": "ae81627c-8247-4c09-bc35-a880d7542d20", "comment": "Malware payload (Mirai)", "value": "95d9c15f24aa2bcffd491de71405f6569d8ed33f910e3084a6964e82687ca272b3a41e859409acde2901329a594c4bee", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679047432, "uuid": "2f73ffe9-1e70-4442-a9f7-54a9c2fc04a4", "value": "T129E36D0276284F0BE6D216B4152F5BE083FEE8D025F0BA85594FD7624A36E37548AFCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679047432, "uuid": "11d0e6f3-53d4-497b-a98a-2e09bfbd1adb", "value": "1536:0EQ1N3MKBj5gGIB8Eec51oPFe8iJQbr1ZC9F0Nbk5m8Q7FBT9N/W+TvFlBI8FG/Y:0EEzXPe80qr1WFgkY8Q7DFBIsG/rg8e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679047432, "uuid": "008933e4-1e6b-4384-8ec2-eddc68dd2d9c", "value": 149792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679047432, "uuid": "cc18fe9a-6656-4cb5-8b4d-79a84b52db27", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679047432, "uuid": "86b35c69-97bc-409f-b2c2-666a830ef962", "value": "5478d736590048c3076a6906296041ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b1abe05-c4ca-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stop)", "timestamp": 1679060756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679060756, "uuid": "c6413524-4969-4c52-b4b1-b0f28b370a9f", "comment": "Malware payload (Stop)", "value": "9b49e3db168b06de0271b24f0762abb4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679060756, "uuid": "26a2aacb-fa44-4926-bc46-3b5c0f36dba9", "comment": "Malware payload (Stop)", "value": "30c76f05ef5f620e025fdbe3586002e54410ba8675bf8d5aa7e26a656a769fac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679060756, "uuid": "45faa5a3-be5e-4271-b450-a0f51e640b99", "comment": "Malware payload (Stop)", "value": "de6b3c548d76bf2b3c1794020a2b70f8cb144862", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679060756, "uuid": "37b02bea-19e2-4345-a86f-ff6a40a3c327", "comment": "Malware payload (Stop)", "value": "d9167fcfd1eb782126167fb7f2b5d03f5c3ca38ebb0e0d978c0ada360c268f96096c1aba768aed22e8fdfe436f6c4326", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679060756, "uuid": "c585fe57-463d-476a-9262-69ec1c02699b", "value": "T1C105DF4396A13D40EA268B73AE1FD6E8761DF661CF4E77B62218DE7F00B0172D163612", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679060756, "uuid": "6b0ccf9c-83cf-4359-a233-9fa74ae79a79", "value": "800c211657980cdb5c72386d0a0450fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679060756, "uuid": "ed9c0f51-6604-49b2-b4e2-7b92a9102669", "value": "24576:IgcqSqVh/E4NJoWB2U9vkSF+ZM6RMIDjsu9q7K:IgeqVpE4jFB2Csol6RMmjP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679060756, "uuid": "619acccf-153f-48d5-ab3d-8cc7caf9b010", "value": 812544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679060756, "uuid": "225d33bc-0b77-4ba5-abbc-312fffc8fd92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679060756, "uuid": "55013868-0659-4876-a065-7e48fe254dc8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91a12572-c4c6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1679059264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679059264, "uuid": "c8357bbc-304a-4077-b54a-d73369377b7a", "comment": "Malware payload (Gafgyt)", "value": "92b676da00e0ec41d74daf890131a412", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679059264, "uuid": "78657859-745b-40b5-9b9a-c7e5b4d9b427", "comment": "Malware payload (Gafgyt)", "value": "30cc0b391aca45fb82f82688d36e741d8c6da4d8887452342498e2f96ad295b3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679059264, "uuid": "805ff09b-8f0e-4c4a-b8a4-bb8c51bb6e34", "comment": "Malware payload (Gafgyt)", "value": "5ce571cfce575deff462e0b915f14937f4a45bd5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679059264, "uuid": "580b49f1-a7ea-4058-9872-96a43f531f92", "comment": "Malware payload (Gafgyt)", "value": "e3d363440a95898b8107f15fd888645cd2eb301c4312c553671b9d96a2377ca64acb48e6fafe6e838543250bbd3bbcc9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679059264, "uuid": "eee3b0ff-6634-4d54-8191-a5f30fac1009", "value": "T17B93E909D9605337C2D23BBEF79A82CE73361E946B97331196287AF41BE17DD1939022", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679059264, "uuid": "b6244d63-94fb-4052-83ff-2930f00cb3a8", "value": "1536:7yn767jY7Ps0dXvzH3I3Ru9PwGWY5lA3e64BvpTM4e2cFERX7pri5fcJRpqiBZgl:4s0dXvzH3I3Ru9PwGWY5m3e64BvpTM4Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679059264, "uuid": "2fb8ba48-4d63-450c-aef6-42826aca1765", "value": 96577, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679059264, "uuid": "af110085-cf1d-4c02-a307-d622019def39", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679059264, "uuid": "c6886193-b205-4a9a-9c74-e72d8d21982b", "value": "92b676da00e0ec41d74daf890131a412", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0398652c-c4a2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1679043564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679043564, "uuid": "01551d6c-0366-4608-ac3e-bb63fddf9a7a", "comment": "Malware payload (Gafgyt)", "value": "65d9a54e8df53eed8182b3a8593cd68d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679043564, "uuid": "5cc66977-8d32-46ff-8b14-b9d8fbff0a27", "comment": "Malware payload (Gafgyt)", "value": "3122949f35cb3b30cef73be48c56cc736c4e7237f6e77a1eff85b82b796449cf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679043564, "uuid": "498c6753-baec-42a1-88b2-efafdecc7b97", "comment": "Malware payload (Gafgyt)", "value": "166055e23382461743b0c4729d0c9cf319ec9bbf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679043564, "uuid": "0178099b-bfec-4493-b09c-7970ad755609", "comment": "Malware payload (Gafgyt)", "value": "dfe262cf4562ae392b02b4f9f6ea527cb0c26e63afde6eee7fe885980a24bfccc8d1fae2be094cc8bf768390cf60526f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679043564, "uuid": "d8dacc45-77ac-41c4-a4ae-573a57b650ec", "value": "T17B73298399A2AFB7C1866AB565E74A344713FC211F4F1B49713DAAF4434B9CDB80E720", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679043564, "uuid": "8ff483e6-9725-4f75-8365-a6b1a163e117", "value": "1536:qQzyxTXfIxiA9x6YKRY2O9iHC8ynMV/mIyVqIo26nkRS:q7xTXfKiA2RBHnGGmIyVqIN6nkRS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679043564, "uuid": "d5588e55-630b-4087-977e-49632e61e7dd", "value": 78032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679043564, "uuid": "24cbb918-5b15-429e-968e-fdbc5170eb51", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679043564, "uuid": "8a2db4a0-dca4-4dea-b847-44f213c8a21f", "value": "65d9a54e8df53eed8182b3a8593cd68d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "255366dc-c4b1-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679050063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679050063, "uuid": "8bb7487b-a3d8-4f0d-b953-02d67545b2be", "comment": "Malware payload (RedLineStealer)", "value": "760ce95dd548c94ee94882a1f73d3c73", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679050063, "uuid": "4a9ec70a-d86a-409f-a58a-17fe3a239806", "comment": "Malware payload (RedLineStealer)", "value": "31470a4770f337c4a470209760b92cfbc065e2850ff9cddfd1d5c972922edc8d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679050063, "uuid": "b2c1b85b-ba29-4549-88d0-c4e735645de0", "comment": "Malware payload (RedLineStealer)", "value": "53b5611b0458cd4e9bbf703299ef6c9da636f453", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679050063, "uuid": "b0e75338-cc9e-47f6-b696-ee40bdd89ae7", "comment": "Malware payload (RedLineStealer)", "value": "084e8728de54a227ed8c5a9a2a7cc5aa68fb049caf80e5a5074c06973ccbc373940e542cde4d3c6e59c998dfae31b450", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679050063, "uuid": "063ae5dd-7cf6-40e3-827c-3b0ba4851842", "value": "T195052251B7C44132E9B02B705CF603931F367DD1993846AB2B81669E8DB3BC4AA77327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679050063, "uuid": "e7cf501d-19d6-4a33-b19c-1f1ca3633d61", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679050063, "uuid": "08a66c62-e63c-4435-b5f0-59731a2c0a15", "value": "12288:7Mr/y90+UYgbXzeErff00mEl5hU9WoY5dddt0DC7USRprf7L3jArFqM3eNziUDuK:kyd7CfTlg9WTB0D0LH3jAL3exjqK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679050063, "uuid": "c24e8267-ea46-45f0-8e20-e38f392c06f3", "value": 865280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679050063, "uuid": "2d05134f-0f10-45e6-8028-109f7e97bf02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679050063, "uuid": "ef91ff7f-3a7e-432e-9d5a-c87290960d10", "value": "760ce95dd548c94ee94882a1f73d3c73", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f646b1f-c4c4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1679058374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679058374, "uuid": "7060867a-df4d-4d05-83e5-6c5805b10dfa", "comment": "Malware payload (Gafgyt)", "value": "b6dd4d21fff139810f832a24d449979c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679058374, "uuid": "b7af51d8-fcb2-47e7-9506-0746206c0ccb", "comment": "Malware payload (Gafgyt)", "value": "31e1da9324012c8559cc591ad83e14b7a9c6c257a8a074fd6b0c2f289f4ce9f9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679058374, "uuid": "3ef2aa05-bfe8-4a1c-b751-2db371d05936", "comment": "Malware payload (Gafgyt)", "value": "9a676928a4a7b699187ef17abfafbcc46e285f93", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679058374, "uuid": "de1a11f5-1b7c-4f98-9459-aef3dd051320", "comment": "Malware payload (Gafgyt)", "value": "8352a357b481f46960fe2f3b73e8264bf9e84b4dbff1e92cbf44a57b559ab461704ecfd509408b73345014fa516d3c46", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679058374, "uuid": "6dc92381-5069-40d5-80de-2ae564e59bf2", "value": "T12463F7E1FE42EF6AF40A9A3946C747346530BF270B421D2073677A628AB63D47517F0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679058374, "uuid": "3c85d12c-f8b0-4598-9bd2-3b5e1d05ece0", "value": "1536:005cQByeAEQKUM83oygdyK81fFMJvYJCluh:005cQBy5IMo1yfyJs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679058374, "uuid": "fee9237f-a310-4050-ba16-95ed71740f34", "value": 70903, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679058374, "uuid": "26e7a233-a46a-46d0-956e-b12136cc6b23", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679058374, "uuid": "2d712ab8-2f57-4432-9ace-1a6baeead233", "value": "b6dd4d21fff139810f832a24d449979c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87f24f35-c4be-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1679055812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679055812, "uuid": "c26a421b-4dba-4c1e-8bb7-17657e81e1ff", "comment": "Malware payload (RemcosRAT)", "value": "d9113a630d4f82e662b9476ba88a8fa4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679055812, "uuid": "7c5f2d7e-01d7-4454-b92a-38237f7fb889", "comment": "Malware payload (RemcosRAT)", "value": "3251570bf53a437adeb0d9ba5adcf9fb937e4d703d000cdb1be6922a9d4872bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679055812, "uuid": "398c2fe1-7806-4af4-a38e-2963c7cd3348", "comment": "Malware payload (RemcosRAT)", "value": "1529b3621cefaa9585a66a7f2d0dbdec826a04ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679055812, "uuid": "d86e62bc-817a-468e-9281-888124ec6895", "comment": "Malware payload (RemcosRAT)", "value": "751f290d7497f2b1eb696148170d330a970129f5db79abc3c909021c797acdc9caf0dd0f40df87a0cc12cdda0bc51c15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679055812, "uuid": "493d2873-07ec-4035-862d-09f928a7f439", "value": "T115F4012621A34662D6848E349CD0233EBFA33FC4B57A7508A8FC3B955D638733935A5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679055812, "uuid": "08af982e-2571-4157-b1ca-46524be111c3", "value": "12288:Dwc3h1D8/kkZCwOYvtD0Kb4vpUxi1N0ljmmRqxFh7mYW3Ed1oAidu17:Dth1TMAMDdb4RyswjmmRqxeX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679055812, "uuid": "c790753f-eba0-4997-acc1-2eae392fdf7d", "value": 769024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679055812, "uuid": "3070bb2a-cf07-4564-a58c-7c64036a3607", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679055812, "uuid": "1b7a4f52-9e19-4068-8c60-9e052714216e", "value": "z1URGENTRFQ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03191973-c4a4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1679044422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044422, "uuid": "4ad773d5-b219-4ccc-a89a-a3c1c9a072c9", "comment": "Malware payload (Gafgyt)", "value": "b1d963dea6e912bc23f453393c493a13", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044422, "uuid": "fe113283-8649-4189-a3f8-685462bf887e", "comment": "Malware payload (Gafgyt)", "value": "327b4aecd0da17156ec74df585ca8a3cf7c74a12f8504dc9bf41feed1bf19d14", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044422, "uuid": "f7630151-fd0b-41f1-92e8-d5fbc0606735", "comment": "Malware payload (Gafgyt)", "value": "208a4cd4b3e500c6af92c06c702c58091a993f1d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044422, "uuid": "b2c2bc9a-3f1a-4a3c-b5e6-20bc416aeee3", "comment": "Malware payload (Gafgyt)", "value": "137105eb5b122dabf9ae3ca226574aed26ed33fc0872c7617661354bb2f0a04e58768628b2c7c717641df42454f43162", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044422, "uuid": "a904b0fe-84d8-47bf-9057-8230104bfb4d", "value": "T19F933B56A780D5B3D14305B316979B620033FE7B1A5EAE0AE35E7CF18F3A0987221B5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044422, "uuid": "2a8f534e-235d-4cfa-bc3a-bdaadb26c25a", "value": "1536:msqmQTbw7U+OU0Cf5UI8E8WwP6kHzgk81VwcG2emFGMUNLe5um7WAgcVjmZIcBI:msi2UVUtBUI8GwPfHkk8rDeLesmqAgcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679044422, "uuid": "f8c62185-2c72-4abb-a8ad-f41041abcfb3", "value": 96268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679044422, "uuid": "4b2e26fd-003d-4396-81ab-9b9966f9aef5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044422, "uuid": "9386dce8-2d99-44c4-9efb-3db33c9c4e1a", "value": "b1d963dea6e912bc23f453393c493a13", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeeac66d-c4a3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679044388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044388, "uuid": "fc22b585-9970-440e-879a-a1532c3ac4ea", "comment": "Malware payload (Mirai)", "value": "217e1ba2d22bd719d94c1faadbfef627", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044388, "uuid": "9209534e-a15f-4ea8-b255-ba786724ccae", "comment": "Malware payload (Mirai)", "value": "3286043f3056a06a5f967e7d0a7ebf234ac382cda47610e49536d01b3bb31422", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044388, "uuid": "176c5c2f-7374-4ae5-9820-c708997d4dd7", "comment": "Malware payload (Mirai)", "value": "bbf1c4f8887914fa4db64e085db3bab5ee1304f1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044388, "uuid": "bcbefb4e-1b93-483b-afdc-31069d3aee23", "comment": "Malware payload (Mirai)", "value": "36989cd40e819f8bcc1609e42f0a43c7a4eb84c1a7da9eff783db6f151ce6c13ad0233371dd7b33fe0cb4085f25c8ca5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044388, "uuid": "6d82f3e2-b6c6-4759-ae15-fdf22ce612bc", "value": "T129637EC9E283D8F6FC1705706036E73BAE71E0AA211CE686C778D5B1FC86941A117ADC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044388, "uuid": "017ecf6e-3fec-4e5f-8b34-daec2855086d", "value": "1536:pnUQJZdRlDAXO6QyQwOaOAWpxsx97qJ7RvsuIr5bhg8a:pnUQJ7RlUXTQpwOaOAwxsn72+uWda", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679044388, "uuid": "70c85e82-5c2a-48a4-b575-9fc7713f206e", "value": 70736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679044388, "uuid": "95c003f2-5ccb-4c81-87cf-9cc171db43f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044388, "uuid": "afae6371-f1bc-4919-8e1d-b66c77854d8c", "value": "217e1ba2d22bd719d94c1faadbfef627", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99022385-c4c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1679057129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679057129, "uuid": "4112e594-157d-4197-9d09-721fb565988e", "comment": "Malware payload (Gh0stRAT)", "value": "1c8cf956e940116faad78c1e3afe651b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679057129, "uuid": "e7e841a0-763b-4aa8-a479-123c949e1db5", "comment": "Malware payload (Gh0stRAT)", "value": "328f9ce928fd425c12da50ddf3a0fe0eb66f2180643efd70e7f16081860eaddf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679057129, "uuid": "26767b1f-f132-45c3-b57b-bf8930d508ee", "comment": "Malware payload (Gh0stRAT)", "value": "b5a96368875333fa53098ea1cf165ed163676f04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679057129, "uuid": "53fac330-2274-4d6e-b61d-c79f4b12f955", "comment": "Malware payload (Gh0stRAT)", "value": "08fdd09c3acd6aeaa75f16aa3c517ef4a8fc5190cc77b39d4756feaacb57c0a6088cdaae6f63063051ab1bee55f41df0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679057129, "uuid": "0ac1ffe8-f05c-4669-b0f3-444e932aba54", "value": "T1E214F10D6E930127D98486B0C2E10EE90BFCEC53398275AFEF709856196419DA5F89FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679057129, "uuid": "0a3a6957-db96-42ef-806d-f676a5d107a9", "value": "08c3cfa15260bca26f874b5bdf8dd146", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679057129, "uuid": "957ceeb9-11e7-45e9-ad67-79a885004764", "value": "3072:fZYhjFTttfP9ZGFwgvRLLCzOYFDq+UdnIPPlMzcsofIw+KaX0LcHLkMIIRD:BYhhT96wgvRHCzOYtqlGyzcsX3KA0LQl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679057129, "uuid": "2dafc43e-5fac-4c95-add5-98282b7fbdf5", "value": 196608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679057129, "uuid": "638d8693-6ad4-43cc-98dd-5e357cac59ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679057129, "uuid": "f564878b-1498-47e9-8feb-af051b4df731", "value": "1c8cf956e940116faad78c1e3afe651b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d330d7d-c4af-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679049190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679049190, "uuid": "a4a6d636-f985-4207-a099-e7fa4b428433", "comment": "Malware payload (Mirai)", "value": "a89f4f6341b10956f6179e990b08bafe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679049190, "uuid": "367eef5f-d2f7-4ef9-9a9a-bc15c46698e4", "comment": "Malware payload (Mirai)", "value": "329b0765d3271d9018fa7f585cce505d2065303343dd5aa58d1ea438a2adac1e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679049190, "uuid": "e5b912b6-1bc8-49e8-bde9-ec8227d9aa71", "comment": "Malware payload (Mirai)", "value": "8056149f1fc3c4c78ae33f24dac7ca647d3af2a8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679049190, "uuid": "32d37149-d4aa-46b1-a853-1f9b6da210dc", "comment": "Malware payload (Mirai)", "value": "907ed910577c554daee7e005a2c083236c8abb0302bcd7b9b67237ab1c517c795e6ac091005273737567b189e4d5bcef", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679049190, "uuid": "dc2c178d-03d1-4cdc-9b1d-a16f82424a37", "value": "T15633027267AE29E152B05737FC33EC1A96DC16E89D6730DA2CF0661973C18024EF6782", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679049190, "uuid": "0bf4130b-ef91-44de-bfa0-8bf5ebd0ba96", "value": "1536:S9O/ZMAXIxNUk0aOLcPqF1aBexo4opKZbX:S9O/ZNKyWOLGqFUFm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679049190, "uuid": "35be64fe-89cd-4000-8eb8-d552190a7031", "value": 52520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679049190, "uuid": "6fd7ba2a-98d8-4a77-b1d3-c96af5ab7584", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679049190, "uuid": "53798723-81b9-4d66-8502-2a3d291153b3", "value": "a89f4f6341b10956f6179e990b08bafe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54f72b17-c497-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1679038976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038976, "uuid": "12aa5400-f92d-4ad9-bc43-fa1f467d6ae5", "comment": "Malware payload (Heodo)", "value": "0c521381f0d5fe36e9dbf63e9012067d", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038976, "uuid": "ed1bc3e5-8c6b-4f5f-9aed-009de8baca6c", "comment": "Malware payload (Heodo)", "value": "332107452ecfb3cab8af719978c4c2acc8325219b57eceb77fc2ea77529ff92d", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038976, "uuid": "a470b5b6-4029-4619-acf7-353cb62cb4cf", "comment": "Malware payload (Heodo)", "value": "29d169b2eca785dc579651b7e1ed2cb9ad854f37", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038976, "uuid": "9b236786-b789-4288-8388-5c4bdf7645b7", "comment": "Malware payload (Heodo)", "value": "20f40cdd4beea82156953583c67793707f102c0d7252d7bc4ff78d11f04f9c7ee078f137a80b805c85272fda9a2c4b50", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038976, "uuid": "03caff70-ec03-49a7-a2ff-f25015f20305", "value": "T18FC33BF1A8025C0AE123C976B1FB661399D052ED42283B2BF87D507DD978A20D5DD8EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038976, "uuid": "21c9a9a2-b02f-4e80-ad89-b8df865cb953", "value": "1536:RDBoTVdaeNtuXndCrJJmT4HVnteV4FrdMiYcx7bfCb6HPdnXp:1BoC+tCYvSMVnte8ZP1Y6JZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679038976, "uuid": "2feb8503-4d69-4eaa-b102-00b106953661", "value": 120428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679038976, "uuid": "4ce0a748-dc54-404f-8d34-bf97dec788c7", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038976, "uuid": "2fb2c04e-867f-47db-8f36-ebeca7c8639a", "value": "Insight Medical Publishing_4.one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27ab87a2-c4a4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1679044483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044483, "uuid": "f496635b-1a12-4c0e-8d93-f7b96d1832e7", "comment": "Malware payload (Gafgyt)", "value": "6ef7cf509a27d954393af410f6dfbec9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044483, "uuid": "87d6cf97-1efb-43e4-953e-608a9856ed05", "comment": "Malware payload (Gafgyt)", "value": "332e20df47ac0ef59e4cb4f3945943049d6875aedc56f3678b0e1cc65c94baf3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044483, "uuid": "703ec7a5-008d-42a9-8bb9-74237e831ff2", "comment": "Malware payload (Gafgyt)", "value": "a184a44acc73ba9e6f456644113e325394bc999f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044483, "uuid": "bfef71ed-5917-4781-aafb-57ca4ebe7085", "comment": "Malware payload (Gafgyt)", "value": "15357b565b7bd5bb020cb93ef3b029287ff2838500a6f202d86a15c1025fb967a2ba40ef47292cf57c1dc550a39eb2f7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044483, "uuid": "1dd5b201-a286-4d52-9583-511b2307024b", "value": "T1F3C3093B7B270A23C0D9507102E31332B9B9DE5938BA43D7A9D07D9C6F3A58834567E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044483, "uuid": "1999b074-96f6-407e-b7c8-0428f2a050a8", "value": "1536:ctrv5GE2dFg8aI0DN95P8tf7PJtADRdc0sfm7ypwYujl3IdnuW:ZP0DNPA65sfm2pwYux3I5uW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679044483, "uuid": "1cc15f0d-1897-41d7-bf94-380b371e7679", "value": 126446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679044483, "uuid": "eb2839ce-ab3b-4e40-abca-1737e93d9688", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044483, "uuid": "264a760e-c913-4e2b-9ebf-62066d189a5e", "value": "6ef7cf509a27d954393af410f6dfbec9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "304e1fa2-c497-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679038914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038914, "uuid": "dfbb820f-e1f9-444d-90ab-386ef3e0fc25", "comment": "Malware payload (AgentTesla)", "value": "cb4f52bfbd20524cd1e593e3d144b437", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038914, "uuid": "5754b5ff-5821-4225-9899-eaaaedb4565f", "comment": "Malware payload (AgentTesla)", "value": "336c6e2174453e52f6c8f72ff0b886011c5ab0d497b357de19b393d7c22214e8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038914, "uuid": "f3a822a7-001d-430d-b50e-b5147e010907", "comment": "Malware payload (AgentTesla)", "value": "b0a969cc5823930321ee787ef1308352e40d2131", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038914, "uuid": "0fad249d-66b2-4229-874b-215522e1dac9", "comment": "Malware payload (AgentTesla)", "value": "ef8684b5e9d8c2de136bd43718bd9af61cd2cf7ec79f14c9d79a046902925c26cdb6e11d74e9b56291ab4469e1ca0389", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038914, "uuid": "ae1b68ce-90c2-4303-9d79-75177838a5df", "value": "T190050148B666EB21C23E87FEB075746193F3950E6225F389ACDF60DA7B23F51460094B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038914, "uuid": "a180852a-a6ce-4c51-a8c6-7ba928262145", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038914, "uuid": "c5d80318-86e0-4e8d-af43-496c67c7756e", "value": "12288:rzC++IpjkjXyuaqZM+3pUH4mrVs239gWwvhDWs3tdc9jyT4p00gAEy5aB+AEZzis:gwjkj+UMsUH4m+1vJWSdcgTqSPFMBxV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679038914, "uuid": "517fc960-9522-4548-9deb-a92585bf35a4", "value": 861184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679038914, "uuid": "1c774fd6-b823-4c76-aaa8-0b77fb328303", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038914, "uuid": "1e99feaf-85c3-4227-9715-18d761d5b686", "value": "Payment Swift USD18,000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bf0a465-c497-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1679038987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038987, "uuid": "a326a527-a0a1-4cde-89db-c9758a408b31", "comment": "Malware payload (Heodo)", "value": "d55eb76786322ee9a12c4da6f37b231c", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038987, "uuid": "9d5a6c2f-b8d6-4ccf-a474-ee1462f101ba", "comment": "Malware payload (Heodo)", "value": "33d15d5cdf0a35080ec75bd4c038b77967e1b8bec722b26adea084c8466ad867", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038987, "uuid": "4fcfc17a-f8df-4b1d-90f0-a57444a2d4f2", "comment": "Malware payload (Heodo)", "value": "ff461c2256e17e90f2ab4bfbb5f3882b0c87deb2", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038987, "uuid": "33bf2eb6-fcdc-4da9-8bfb-2cf136640c10", "comment": "Malware payload (Heodo)", "value": "00d2fbed282eda7044ffd7ae463694502bb5ba9b59025634fe6608094e57b232dcbea4d5f424a5e97dfda4fd294255de", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038987, "uuid": "f3cf99e5-0e20-48c3-b898-8e266ef83c2b", "value": "T199C33BF1A8025C0AE113C976B1FB661399D051ED42283B2BF87D507DD978A20D5DD8EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038987, "uuid": "361a7770-e7b4-4e41-b271-bd70281a46da", "value": "1536:RDBoTVdaeNtuXndCrJJmT4HVnteV4FrdMiYcx7bfCb6HPdnXL:1BoC+tCYvSMVnte8ZP1Y6J7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679038987, "uuid": "400366e0-1326-4ae3-a44d-4e840fa9f42a", "value": 120428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679038987, "uuid": "a6e5aa75-7a81-47b4-9c6c-9d1b3218f65e", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038987, "uuid": "b29e2b6d-b3b2-42c5-8e1c-24e475b579ac", "value": "OPAST GROUP_1.one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99f30323-c495-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1679038233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038233, "uuid": "910e9ed1-2cdc-4a30-90d7-2d50bfe99938", "comment": "Malware payload (RecordBreaker)", "value": "c8de9d601eb2b1c2682dae1ade2c2aeb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038233, "uuid": "d458c006-3e9e-4c20-8dd6-f83a97312d19", "comment": "Malware payload (RecordBreaker)", "value": "3459b35320bc3edf6911ac3dcc837a47ed7536c40b9ed06c7e3ec1b78ef89e1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038233, "uuid": "3e5d0248-b578-49ca-a20c-4538d302d6fc", "comment": "Malware payload (RecordBreaker)", "value": "1d1637a7aed719eb0a39c8d68d4fa3a50b771b26", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038233, "uuid": "e7954f1c-7c2e-4710-bd6d-02b54ee35792", "comment": "Malware payload (RecordBreaker)", "value": "3cd173ef269d78e6ee7a0e25657bcf742b1e7023dfcc1122011a284f745467139a58ae20e124dd059a64044c841b966b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038233, "uuid": "b1c5ed1e-7c48-4a5d-8b19-b86e37ae2919", "value": "T136047D0393F47860F5268A719E2FC2F4771DB4538E79AF6B23185A2F08B11B2C66E751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038233, "uuid": "bf8671f6-d50f-45d3-834a-c181189f53c8", "value": "3391dcebdf72207e22a1ac369ab55c39", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038233, "uuid": "00216331-c764-43c1-a6e8-191b3d78a85d", "value": "3072:uVsBUgUA0uAa3M3DTnMeLf4rGVwaQpYu1RIuMnBm/hVOndJB:/Bp2p3DbMAQrkXQ2Wt9/hEdJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679038233, "uuid": "af8b8908-6eeb-4552-a2a1-c0b02e84aa48", "value": 177152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679038233, "uuid": "4601004a-2bdd-48af-9702-2b80e5976d09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038233, "uuid": "a6bacccc-d92d-4a70-b705-ad84786af7b9", "value": "c8de9d601eb2b1c2682dae1ade2c2aeb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7ea3c6f-c4c8-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679060160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679060160, "uuid": "2f3a6730-ee49-40f2-83d3-6d37ca7c0814", "comment": "Malware payload (AgentTesla)", "value": "f5f32fb52c9966b693b40bfd32c09a79", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679060160, "uuid": "f265f692-b9e6-4aa8-80b5-fc9cd474353a", "comment": "Malware payload (AgentTesla)", "value": "348d1afb5af3a4ecb35cba0ca113383e19c8cd31bef3156d2da5fb153f771258", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679060160, "uuid": "bc438902-4311-4ab0-8af2-af0791b49d8f", "comment": "Malware payload (AgentTesla)", "value": "929870f10e86e5bc4a6dfbb3a4119f34500c7158", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679060160, "uuid": "bc2a9849-7dad-4876-9c65-0ee6fd93a7ef", "comment": "Malware payload (AgentTesla)", "value": "b874d4207180553a22c56bbc3beb44950c0687ec6b8b8b155a8f89fc3e4f1343aa6832b00d19794529711c04282ecf9c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679060160, "uuid": "cbaccc69-7129-457a-b577-da13702c390a", "value": "T19915128C76FE5776DA2C37FF9040205443B0E922A666F35E1CC564E70EE27E99902C6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679060160, "uuid": "f0dc06d0-87d3-4a08-a569-38e3043feced", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679060160, "uuid": "9d6280af-e9c3-450a-8dff-0e48eb2bfbe5", "value": "12288:MmjY9iU2JGRTwydk15v2ckb1eFad+q01w22zri60GjEvPq7nGeBcQpOmXQ52Ksqw:0j2JT8gl2xWImzGoqrBgijKsqoY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679060160, "uuid": "368f0716-2f66-410d-9d90-6308a877ccdc", "value": 921088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679060160, "uuid": "2f55e22b-993e-4c44-814c-bbce44af927d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679060160, "uuid": "208ee1c6-caaa-484e-b21b-5375792ba14b", "value": "DISCOUNT PRICES.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "362f1a23-c4d8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stealc)", "timestamp": 1679066841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679066841, "uuid": "b4c0a9c1-8a1d-45ad-8fb4-0128c2b8e737", "comment": "Malware payload (Stealc)", "value": "134d8a47c6f8fa3d99b60ce9e4faff2d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679066841, "uuid": "67913c76-d5ad-4c44-947b-339eaf57e4d3", "comment": "Malware payload (Stealc)", "value": "34bb4acf55ee9866edad0f31075c09276dbb303b004b63a1ce00b3504e7c9bc3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679066841, "uuid": "dc9488fc-cd19-4984-aadd-faa4d557e7d5", "comment": "Malware payload (Stealc)", "value": "9d102bfa660683be4d56e86eaca1050ceb2a42c0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679066841, "uuid": "40d637f4-539a-4e9d-8f25-8666ba1d1594", "comment": "Malware payload (Stealc)", "value": "2bd2596d999e6bcda3567c7ef8c5146fe5e2a9436be448f6075ce7d83eae6046d4967d85bb2003bbba7c73d41f113351", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679066841, "uuid": "a7b48aed-da70-4ad7-8abb-e58c8ffee226", "value": "T11854294397E17C40EA268B77AE1FC6E8769DF660CF4977B52218DE1F08B01B2D163612", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679066841, "uuid": "188d11bb-1b38-47f3-a89b-787ca744039b", "value": "48e7bdebf7b90ec755513d967cfa38a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679066841, "uuid": "8cbbd53f-f112-4417-865d-6dd92679fa25", "value": "6144:Gg1LJLpZH0ua7uqaLNeaqPYMDQ4BTfOieY:Gg19LpZVqeNVS3DQL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679066841, "uuid": "77168501-5bb6-47bd-9827-030bf0cd0452", "value": 303104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679066841, "uuid": "20f44f2b-0a65-4e7d-ad0b-ec8d8af2b6a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679066841, "uuid": "a2ecc059-a053-432f-a0fe-89cca4bad6f7", "value": "134d8a47c6f8fa3d99b60ce9e4faff2d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4848f3ef-c497-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679038955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038955, "uuid": "03638bbc-2157-4fe8-8f6e-ebca383d39db", "comment": "Malware payload (AgentTesla)", "value": "1df06ea86eaac59f70bfb0644f3ad683", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038955, "uuid": "141a8f3e-0f79-45ef-a287-b42c5f443793", "comment": "Malware payload (AgentTesla)", "value": "34f94d5066b7b34db54d13762f1f3b11ac1b4cdfb971cc822bc3c4d9a7394994", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038955, "uuid": "5296eb92-973e-4b00-89bd-de4210ad8893", "comment": "Malware payload (AgentTesla)", "value": "91e7dea1ab7bf436fc4837df885f167c1dc91d21", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038955, "uuid": "de5cd528-233c-4924-a980-2fd2277c84a8", "comment": "Malware payload (AgentTesla)", "value": "efbbdf6e1e72913103a3ef63abf7d2c42a73f80e0b43eec1a4a8a8d4d14ca0c737689529054740d71c32502d765989f9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038955, "uuid": "d13592ec-0316-4cee-a80b-15dd1ddb6d4e", "value": "T1C6351202BEC194B2D5A31C731A397610AA7DB9312FB1CEDF63D04A2DDA715D0CA357A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038955, "uuid": "ab1db322-269f-43f2-bf82-73c502d3057e", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038955, "uuid": "2832217e-2dfe-4c81-8d19-528da35c99e5", "value": "24576:/TbBv5rULmVeLmvdWULotH9NwCLmtmH6opxUPYhLKX5yaUr:JBVVgeoULGHjVStmHXxUPYc2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679038955, "uuid": "00755ef6-fb5d-41e5-aea0-98b3e9b338cc", "value": 1087479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679038955, "uuid": "16f30e5a-f3f4-4df1-a13e-a713538a785f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038955, "uuid": "d21e9369-674f-434b-b703-f8ffbb3894f1", "value": "doc10010679052382012143717.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b01ac2c-c4a6-11ed-88f6-42010a9c006e", "comment": "Malware payload (ArechClient2)", "timestamp": 1679045294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045294, "uuid": "15b05524-cac8-4015-a629-fadc45982e1c", "comment": "Malware payload (ArechClient2)", "value": "210e93b80b868f6aebf712e0da9edf5b", "object_relation": "md5", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045294, "uuid": "951ab627-4472-475e-8ff2-e4662c7545bc", "comment": "Malware payload (ArechClient2)", "value": "354b77fe1cd430528a5d79455df2f0b1cf5047f74895deffb89cbd4e78cefcf3", "object_relation": "sha256", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045294, "uuid": "5bcc96f6-3450-4bd6-9950-e1634948a8b3", "comment": "Malware payload (ArechClient2)", "value": "5a45e712f10eb33c1d84bf96dc9b0fea6d810954", "object_relation": "sha1", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045294, "uuid": "7332604c-e6f0-4001-8b45-b00f5485da1d", "comment": "Malware payload (ArechClient2)", "value": "2f6d4482907fa2d9eda9a8eed1aa45c39b47de6493ecdeba15d31fcf2f2daeef7c0755191cd7e0587aad75df512f37bd", "object_relation": "sha3-384", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045294, "uuid": "450e9096-84bb-43f5-9dee-081fd9b1fd73", "value": "T15DC1FC015EEE50DEF23707306BEAB3B71566E8B1552E62B874448A989F31BD0CC21FB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045294, "uuid": "206e39e6-163c-4204-9f7d-cc7562165431", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045294, "uuid": "2dada025-9431-467a-a743-e70b63f0c6e2", "value": "96:/TVW79atkCFQRKt6Fpvk+IbAYNOstdvk+I9LBv8d3ojvrl:W9atPFFSpvkKYNvdvkXl8dg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679045294, "uuid": "dc2597f0-c3e8-4203-a868-1ab997134b63", "value": 5632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679045294, "uuid": "8bede23d-d4e2-48bf-b58f-e1be1d350350", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045294, "uuid": "97fe380a-e1e5-4ff8-a392-04b8849330f8", "value": "210e93b80b868f6aebf712e0da9edf5b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2fe908b-c495-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679038382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038382, "uuid": "0500a04b-aa32-40d5-a706-d740cad0e8c4", "comment": "Malware payload (Mirai)", "value": "f6d1656b9b935e83351f5ee31a891aea", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038382, "uuid": "0e9af303-962e-4d88-95aa-713f3f13f377", "comment": "Malware payload (Mirai)", "value": "3581f258d38b2470d7315d9af4b10171b1b687c02e26a192ef582e8051e88011", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038382, "uuid": "46222ff3-b154-4b2c-8a94-004a745eb318", "comment": "Malware payload (Mirai)", "value": "4b754573d0b9b0d988434be486c8295fbfdc9d2a", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038382, "uuid": "49c57204-abd9-499d-9b34-54ffe0e965bd", "comment": "Malware payload (Mirai)", "value": "e64bd5e6bef8f33b4f4576a0744af76f4c54fadf594288b7b55cc9b7c215d88e52e78586854b445af4b2e07a67ef60a1", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038382, "uuid": "77cd3036-9e52-450e-9ad7-2298d8094963", "value": "T1A1B33B376251C97AC08356F427EBC5729D13BCBB0B32219A33D47D60AF368DA1E99B05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038382, "uuid": "9cb69d2f-5011-4545-a27c-927496d6db52", "value": "3072:kiry859a2ADJf9wHYqbgFFo8+HeAv+TRCm7FnVqfJXFWbNb:T9a2aLqkrM2sm7FnVqfJXFWbNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679038382, "uuid": "e421117a-1962-4d61-a658-83a5cf883609", "value": 116503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679038382, "uuid": "d454bd2e-64ce-4b3a-ac78-3495b32f4127", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038382, "uuid": "cccfe5f8-2ba3-4bad-9e12-5b969c572a85", "value": "f6d1656b9b935e83351f5ee31a891aea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b1a7646-c497-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1679038959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038959, "uuid": "218e4ca7-63bf-47f9-8646-79c4c1214791", "comment": "Malware payload (Heodo)", "value": "d19669f2b8bd4bad55e88c10c77fc738", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038959, "uuid": "14d988ab-6297-420c-9a45-2dd6bcca5c0e", "comment": "Malware payload (Heodo)", "value": "358cedaa665ad10740cd6be545c240aecfc7313d653d1b7e808b0839f8b54aee", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038959, "uuid": "d5170db5-2aa5-46b6-933c-935bc037345d", "comment": "Malware payload (Heodo)", "value": "19b8c0b86b00de81fdfdd1692df3468194f0d986", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038959, "uuid": "3f437deb-abe2-4489-83da-2acd9dfed64b", "comment": "Malware payload (Heodo)", "value": "439cb1773b1e8fd42853efbb6c9f9cc840aa35344e8069bf6de95bf6a75786532d40b92eb0118d66867a76f3a85df109", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038959, "uuid": "8e6329fe-e89c-4cf0-bba1-047cf07f597e", "value": "T142C33BF1A8025C0AE123C976B1FB661399D052ED42283B2BF87D507DD978A20D5DD8EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038959, "uuid": "036899f4-7689-470a-afa4-336fd86a8ac7", "value": "1536:RDBoTVdaeNtuXndCrJJmT4HVnteV4FrdMiYcx7bfCb6HPdnX3:1BoC+tCYvSMVnte8ZP1Y6JH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679038959, "uuid": "4956cfb9-c53a-432c-a43e-ba378b5b534b", "value": 120428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679038959, "uuid": "0fb15256-1408-4421-b6dc-58956a323a89", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038959, "uuid": "23cac24b-032a-4205-8f75-3612d8ca366d", "value": "imedpub.com.one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74c0cc21-c46f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1679021849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679021849, "uuid": "b457381b-d1fa-4226-bf72-1a47a9272b62", "comment": "Malware payload (RemcosRAT)", "value": "86fc671549dae9122a212b2d0866518d", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679021849, "uuid": "bc374245-add3-4c59-8a7b-5161f53e07bf", "comment": "Malware payload (RemcosRAT)", "value": "35a12f062cf89d2ce795bca9ae9ecd96ee09df1f7f701acb7b122b466c2d7501", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679021849, "uuid": "a1209ac7-834a-405e-a7bd-1a4cf24a3173", "comment": "Malware payload (RemcosRAT)", "value": "6dae20a1f000b592f2b7b567b7ac6e02b60d6aaa", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679021849, "uuid": "99db610c-b776-4a9b-aec1-8b68e0a48616", "comment": "Malware payload (RemcosRAT)", "value": "b14b48c296f0376f675ed8f7c9a032e53f75de2ad1ada78cead104e159304f4580d619b56a115f4e794d955e48bbbf84", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679021849, "uuid": "88477b56-fc88-451a-8eaa-297899168dc0", "value": "T179725B004BCDA8F4C374F173826A901A44BAD6B6345B1EE8BD8D95D23BED61D8DF41B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679021849, "uuid": "4dfa35ea-2638-4fe2-9cb6-408c2a0c921a", "value": "384:+8CCGIJDrKNGDH+7Oz4ZT4LrtP9w/21/hta+YKXHW:+xCNKU+7O8kBP9w/uZg+x2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679021849, "uuid": "2ebc2b72-25d6-4989-9fb2-830b90734042", "value": 16172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679021849, "uuid": "88de348d-e5b1-46c7-b2ad-8c3f7a18be89", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679021849, "uuid": "9d85d431-16b6-4905-a7b6-248e8cc4bf8d", "value": "86fc671549dae9122a212b2d0866518d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20e7dec5-c4b1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1679050055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679050055, "uuid": "5d2ba5de-8187-46bc-bf25-e3fcd6e73385", "comment": "Malware payload (Amadey)", "value": "a55d0c5be5767946dadbc41ff81edfe4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679050055, "uuid": "f3b299b5-acf5-4233-9713-b2e919a04ccd", "comment": "Malware payload (Amadey)", "value": "3650a22b9f187270ce7007c04a2af35ba8d5239067f90901ee4ffa96fae3e67e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679050055, "uuid": "44c3709d-c93d-4567-9b7d-21027a6b9d1d", "comment": "Malware payload (Amadey)", "value": "e61fa4151224e9946aaa9b80c04a4124584e6eda", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679050055, "uuid": "5e18a063-2540-4251-99a1-13eb60f16a09", "comment": "Malware payload (Amadey)", "value": "7fc16640fb4fafdaacb7f28dfab5600208a3465dd64977fd5fc0ff7880f18d2231efbff99cc68c43b437fff5054f493e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679050055, "uuid": "d5a86431-bce6-4cca-9e12-c986521db25e", "value": "T197936B1030D2C071D67E55351878EAB68B7CB914CFE08EEF27551A7A8E702D1AE32D3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679050055, "uuid": "929ffbe0-5f27-4fda-a168-4a1d5dc3d3ac", "value": "52982bbab8b9d5eafbb4ec438626f86a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679050055, "uuid": "9327e3e6-2a2a-413f-9a8e-0b319f34d6d8", "value": "1536:To4NPCKLbqoYkbpplW9YoUsxXzbcouNhj2ZszsWuKcdJUsMOaB89p:ToUCWbBNpplToUs1uNhj25LJUsaB89p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679050055, "uuid": "3f1954ab-3d75-487c-ae17-666483c13481", "value": 91136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679050055, "uuid": "a955d283-134d-4272-8101-b686f1bc35ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679050055, "uuid": "7708b487-e8a8-49d4-acaf-25eeb48b734c", "value": "a55d0c5be5767946dadbc41ff81edfe4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a685a4e-c4dc-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1679068647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679068647, "uuid": "61587580-41cd-4c52-9747-78cb94904bb2", "comment": "Malware payload (Rhadamanthys)", "value": "d5a07ebefff6f03217cf2fcc454c76ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679068647, "uuid": "dfa48ca8-6f08-4dbe-a26a-5b5cef08d746", "comment": "Malware payload (Rhadamanthys)", "value": "37a56c0fe6f63e8eca749bb502ce84e4fdc0cf2cf2487df3f35683ddb92162c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679068647, "uuid": "0ac6593f-f66a-427b-9fcc-a0827a293029", "comment": "Malware payload (Rhadamanthys)", "value": "bab05714e2483b09629ef48865648b9bafe29761", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679068647, "uuid": "ee474d7f-7a26-4819-80c9-484e25e227f4", "comment": "Malware payload (Rhadamanthys)", "value": "0b503c3a8101703a8e8546e09c40eb956a1773e91a88765d95de2edc8b7c710d3acb52ac434feec83f4e49682df15886", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679068647, "uuid": "7b067f6b-7b96-4669-be64-e6d2bb0bb0cd", "value": "T186746B0393E17C48E9268B729F1FC6E8771EF6518E897B6632189A1F04F2172D163F90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679068647, "uuid": "9560279b-e6f9-4ef7-b736-3a91ffb32274", "value": "6e76b494f1a9946f83b6b72033f310be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679068647, "uuid": "6bcfef49-3e83-4255-b48f-1dfae6602ad8", "value": "6144:VIJbLYAIf9odCWaZvrOFn66oTBrSRgSLIIWadr+u:OJbhIlsCWz6hSqCWG+u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679068647, "uuid": "eb9cafe1-c70c-4aa5-b149-916cb3892b1e", "value": 367616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679068647, "uuid": "58ef0a1d-a3bc-424d-a541-760b98bdabf3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679068647, "uuid": "474e6a5d-fb7c-495c-9001-d1c363832365", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14ff8598-c4d2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1679064209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679064209, "uuid": "5a82d31f-94f1-4434-aa2c-7b7dfd405cef", "comment": "Malware payload (Amadey)", "value": "5121b5c68868732edab5c5b04c7ecc17", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679064209, "uuid": "c3c27eeb-dc84-4aaf-bea8-530bbde8b80e", "comment": "Malware payload (Amadey)", "value": "3807bab43a40623f856fa9c95a012b1e13bf4e28c1aecf425b1bfe85522aa875", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679064209, "uuid": "0d1e4b6a-da65-41d6-8fa8-2b6e1c13e398", "comment": "Malware payload (Amadey)", "value": "6f279be7f11a09a497cf6f3b9edafd1269f8792c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679064209, "uuid": "83c06c93-29fe-49be-b4cb-72c0c9e81bba", "comment": "Malware payload (Amadey)", "value": "da16bb474bb27e6be7f4b5d2753b3c524f98e205743037498c49416f049d54c2ec5dce5fd3ed4d9951cc0dbdcb2e1c33", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679064209, "uuid": "e6cbb025-f188-4222-b7fa-10de95cd85eb", "value": "T13245F1539AA17C50EA168B33EE1FD2E8761EF561CF4A7BA53218DE1F05B01B2D163702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679064209, "uuid": "a88b1bbd-453d-48d1-9dcc-fa10b1a278c3", "value": "800c211657980cdb5c72386d0a0450fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679064209, "uuid": "3b2cd955-5221-47b6-b7e6-5c312af8fbe4", "value": "24576:6BAQnUjC25pKw8ZWQl9D3c6jenpDQz3EmFXTi5+YzYcY:6r8pKw8ZnTRaWzQzN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679064209, "uuid": "56e15a74-6b4b-44a3-bc50-8a2137d394e2", "value": 1238528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679064209, "uuid": "e0d94ae0-ec03-4070-9193-537223a2f745", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679064209, "uuid": "709fe7a8-88e8-4fcf-903c-a42e0086d3e2", "value": "5121b5c68868732edab5c5b04c7ecc17", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eb8c5f3-c4f9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679081029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679081029, "uuid": "ebb7bf8a-338a-4a00-97e8-fcdb5f19855d", "comment": "Malware payload (Mirai)", "value": "fb45ad97efe7c5f03f9076330fa935fd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679081029, "uuid": "cf4f70a4-641a-46e4-b211-60ff241896cd", "comment": "Malware payload (Mirai)", "value": "3839972d66141f3716cfbdd63faed40bd1f54aa696206dc34df2d58b2cbb24da", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679081029, "uuid": "926dabbe-9868-4f25-92ab-9ae4fd0fb316", "comment": "Malware payload (Mirai)", "value": "007270b9d1aa2f952238c1d4473bc013ae50c667", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679081029, "uuid": "892091d6-5a82-49e2-8819-e49d9be7a19b", "comment": "Malware payload (Mirai)", "value": "e2b2fc3637f9413871106ed2c5fbefad271a0036d973d1c387502a8662a7094fb06dd8500748204645bd9c94df4f0cf3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679081029, "uuid": "f791f61b-7db4-4c0d-8ac5-cbc2fcf1058e", "value": "T190C2E144E3102E85FFDF6CB99E2A91C47B27175F678754A2763894123592D2BBC00ACC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679081029, "uuid": "7d388f9a-04bb-44a6-8b62-6db6e0fb2634", "value": "768:eUbgeS1f8Dnz+AHyRas6JAshPVJpR4uVcqgw09D:eUbfaAQGAiNJpR4u+qgw09D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679081029, "uuid": "af12bf50-cb90-4581-8415-dfbcafd80875", "value": 28280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679081029, "uuid": "94c325de-0d42-4026-bb09-45e130dbadf0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679081029, "uuid": "5a76e5a9-eef7-4663-a769-3a77232deb19", "value": "fb45ad97efe7c5f03f9076330fa935fd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03ba4658-c4a6-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1679045282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045282, "uuid": "673be644-0128-426c-8c09-620a0289db7d", "comment": "Malware payload (AsyncRAT)", "value": "0fbf332153113f4b0dfd105244cba305", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045282, "uuid": "fafb24b5-7fd7-4be7-bc90-f272b9a22b0b", "comment": "Malware payload (AsyncRAT)", "value": "39ad7e9557a8177e7c6babaef7330c2ba20345562e19624d875b15f225914731", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045282, "uuid": "cadbadbc-b695-4ec1-853f-04112007ffbb", "comment": "Malware payload (AsyncRAT)", "value": "a0492b86088ca776c1d0eb5fbc35a3a3c12bcb95", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045282, "uuid": "c2b12acf-4342-4a9f-9895-1877188e9bd3", "comment": "Malware payload (AsyncRAT)", "value": "687ee40abc7d8941cba9bdadf5db46e4a4ce930689dbe90427c9220b89a61535032fb14c4bfc4d7e82ff5bb34ae26cc7", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045282, "uuid": "c2f676a0-3a25-4449-a443-76a004bc3ae2", "value": "T12C160822BA5A0D32CA28E472741B022196FF588D4379F25AEA3DD0F50D95DD94F48B3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045282, "uuid": "b280c22a-37da-4539-9017-2086fb096c57", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045282, "uuid": "a396650d-87e5-4ff2-b0af-95a67ad56488", "value": "49152:ffpvN8/xMQg3Q3cX5C/wnvdAlPjcmYjoM47qN:ffpvN8/B7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679045282, "uuid": "36e6b2c8-ec4c-4084-b0d2-0306ec0872ba", "value": 4150272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679045282, "uuid": "d349c808-fd7a-4b09-9c80-b7f3a86e6a8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045282, "uuid": "e7efefb8-0193-4474-a393-64dce815a22c", "value": "0fbf332153113f4b0dfd105244cba305.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9076a24-c4b3-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679051170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679051170, "uuid": "e034a78c-2282-413f-8d5e-3337986fe514", "comment": "Malware payload (AgentTesla)", "value": "4093ff9f108caf63c96f434b7624b9d0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679051170, "uuid": "13d17177-1714-4be9-b161-8a90b1a4d8e5", "comment": "Malware payload (AgentTesla)", "value": "39cc4048b8a8f6b2ddbe8edbe44e801845189228c5799e36219ae85b003ad658", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679051170, "uuid": "17860516-6657-43b6-afa9-189ef24c89ed", "comment": "Malware payload (AgentTesla)", "value": "459591f8e4d5cfa2cb7564e4b9d3cb124f19884c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679051170, "uuid": "24952df4-9fd6-424e-8c69-a49ecd634f1b", "comment": "Malware payload (AgentTesla)", "value": "0792b6666b353834d81b591ed3cfaa0033ac21dd41513d24fc8a4d37c67bcf858212e93a3aed31675074af9f3ad6a3a5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679051170, "uuid": "a61b884d-22b4-44f0-a2e5-7e7fd6a82266", "value": "T13A357BC2A3358C09FE901E3E735564B3CE53CC89D8EBB29F2A87BD2964F554809CD952", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679051170, "uuid": "877bd54a-1a38-4a0b-9509-0a3ab45a839a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679051170, "uuid": "3412785e-d842-4e40-905c-4bd6c531d444", "value": "12288:uqUKI49v1K8tUyZmMRxEy0gG5H0dyS7kyEZjxg679x3C6q7ri8GuyXImL05+4nAH:jI7UdySit/r3Dyri8GImL00zuVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679051170, "uuid": "cfa878c8-39e0-4bc2-be14-326bd573efaf", "value": 1076736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679051170, "uuid": "ce4930d6-4668-454b-9f25-898ad64ae63c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679051170, "uuid": "2f8bfd1d-9086-4839-a2f5-da11ea79f7aa", "value": "ARRIVAL NOTICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52b0f8f8-c4e1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679070755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679070755, "uuid": "94520641-cd25-496e-8b28-3814af26deed", "comment": "Malware payload", "value": "41cf7206691eb11781458abaea7a1223", "object_relation": "md5", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679070755, "uuid": "9f21d5b9-5629-406f-84b3-2e0f972e8d01", "comment": "Malware payload", "value": "39d3532ffb7565aa79bd6ae6f510ecc7ac29ed7cd0a98a7b948c10162c5c25c0", "object_relation": "sha256", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679070755, "uuid": "41c3b7af-b8b4-4a3e-b684-a81fcbf852da", "comment": "Malware payload", "value": "9f8411a8765264ae9b2a44b788b28fe9a77bd3cd", "object_relation": "sha1", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679070755, "uuid": "05a1c50c-faf1-4ad7-b057-4d0b8124cfd2", "comment": "Malware payload", "value": "41b6a5d31d1681e29ff81c8056c87b21ed1cb2e014903ab809e769838b7fa3102e1e28658de3fab53551d7a3cb0e5a91", "object_relation": "sha3-384", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679070755, "uuid": "f14a1a5e-c170-4477-9be2-71ef3978aa39", "value": "T1BC348D00F55184F2E83952BA4DE79329C93E3D2C046DCD5797C79E6ACC613F0A32AA9D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679070755, "uuid": "277c4f38-d534-4191-aaa1-68075e0ffdb4", "value": "8f2649698c183ba2b52e5e425852109d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679070755, "uuid": "ad72dc7a-3514-4d2a-be79-1642228e9157", "value": "6144:N0jGCWF+x5Yfso1zg5k+TA2c3AlvjV0UzI:bHfsou5k+TdFvj+UzI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679070755, "uuid": "bc63844a-50b5-4209-a1ef-589e89ae958c", "value": 239616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679070755, "uuid": "bbecd5e5-6374-4af0-83c1-7a2c4c75c13a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679070755, "uuid": "a24c035d-9fb6-4e0d-95cd-1546b7607b23", "value": "41cf7206691eb11781458abaea7a1223.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87198809-c49e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1679042066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679042066, "uuid": "d02e38a7-5cdc-469c-a4fb-aafd01569966", "comment": "Malware payload (Formbook)", "value": "95719cd320fd07342a71296243529474", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679042066, "uuid": "80433521-4f02-4478-b33d-23dd13067a01", "comment": "Malware payload (Formbook)", "value": "3a65ea31064636050403b07254babbc4470f5531b50423aaa49fc5a49c2e1efd", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679042066, "uuid": "9fdc12e0-5319-4e8f-a529-9a0bf359c458", "comment": "Malware payload (Formbook)", "value": "4033d96ddd91357786fb170379d5f99fd96688cd", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679042066, "uuid": "2739ee24-4f50-4a32-a2f1-8136a35047fc", "comment": "Malware payload (Formbook)", "value": "fcec3eb931bc062b0b1beb7ace38c7ad251754834f78cb7a54030235b06589394d0a03ad351757151fc07df80de44553", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679042066, "uuid": "7215b165-18b2-4332-837f-e90eb1d453c4", "value": "T15435F12FB204DF49D5468BB86E17F9D8020C7D64ABD4B4C73A91771F2E365A22AC71C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679042066, "uuid": "42570451-38f7-4e60-b5af-dc4cff568f68", "value": "24576:YLKiyWQmmav30xtSnuSnFbLRHFFG2OyICffYO:YLKi3QmmQ30MG2hIC3YO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679042066, "uuid": "c079b101-7c51-40f4-8258-050b226eb4b8", "value": 1100288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679042066, "uuid": "987e1fd1-4f9d-46b4-8eab-ed3a1afe6f90", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679042066, "uuid": "2166b831-158b-4e31-9540-43d441b2c1b9", "value": "P.O. 102176 GERGONNE ECUADO.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a661b139-c4dd-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1679069177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679069177, "uuid": "2154769e-9867-4524-ad8e-517310c8d364", "comment": "Malware payload (CoinMiner)", "value": "49df22178c6c685dbe0189b3a0471a31", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679069177, "uuid": "03401aa0-b6ca-4026-b24b-53e74b935e0a", "comment": "Malware payload (CoinMiner)", "value": "3ab558bac728b231b76afbd9b8f5d354ebef599548347674cc5c6b7a2916ece3", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679069177, "uuid": "86094f33-c310-4a88-b899-50832ecbe8c5", "comment": "Malware payload (CoinMiner)", "value": "8c460c41d8bff4519a534861c9ef1fe6e73b9ad0", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679069177, "uuid": "c47dcf24-37d3-4af1-8871-62c565c54940", "comment": "Malware payload (CoinMiner)", "value": "6d8d3c694dfd301427a7e097444e2245e260c6692d35ae4bb0888b8573a8eed9d05669f81916d6e945ad0b49541291ef", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679069177, "uuid": "b08b29c8-c89b-4678-872a-36b3e85436e7", "value": "T1B66533B0E6C04545D6501B3584D1F71A7F8E24EC6F9345C9329BE2AD03EF6AFEE18688", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679069177, "uuid": "28b618d5-9a87-4f70-a22a-432541bbf630", "value": "9215f5e35d28044a32583e6054971925", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679069177, "uuid": "11baa322-5615-4179-976d-87dca54054e2", "value": "24576:NqyjfvAIxb5Kn/+pVcurgdaKVSVRY8t8XS+ZMQ7P8vzWrtlkEQtTHd9DroVwtqqj:NqcXAI15Kkc+gwK4gIOMQ7P8vyrtlmtR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679069177, "uuid": "d0a8771b-1ecb-4a24-b80d-c39d4052ada3", "value": 1479992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679069177, "uuid": "c8a22d19-9e5e-4d9e-85e1-78374b5b942f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679069177, "uuid": "fe7413e5-9c21-498f-a438-098066ada581", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7306b166-c4ac-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679048046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679048046, "uuid": "e7f17c7b-9159-4852-b0ab-9bc7b2a4d251", "comment": "Malware payload (Mirai)", "value": "b079d9c447f6d9e774e1423e3b70431d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679048046, "uuid": "823a00ce-ce33-4ac4-a586-237e0fa10c72", "comment": "Malware payload (Mirai)", "value": "3adc32fa67e9e315d1833a0cef08f9b63ee85346c7030a1a5a32d73d44a69422", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679048046, "uuid": "6df54724-29e7-4a14-830c-7987852cfa2b", "comment": "Malware payload (Mirai)", "value": "60875458ae785bd0b3077eb231dd451dc65d66b2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679048046, "uuid": "8695490a-5305-4fec-afec-28aa7e7e630d", "comment": "Malware payload (Mirai)", "value": "afd0cd0f604ea7e928dfe22945a6eabddf93564f312b9e7d92916e87925a5a4a1f1e0c3c6fa7c1c3b8a79bd173d9492e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679048046, "uuid": "ddf8396f-1192-4fbd-899a-d8ef0fd1bc5d", "value": "T18B330A8EB8029D3CF91BE6BE54164E0DB93177C152830B2767BBFDA36C721945E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679048046, "uuid": "7b520866-a30e-4917-9db4-8b51c1a99a8b", "value": "768:gduPBFnHooqR8qOCKq2GH4Kg9e+TK806MMUVjzkfQXObHud2oGN:r/hqaJ6Dg9eqK806MHdkfQX6HuCN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679048046, "uuid": "75dbf35a-2728-4389-a9ab-4533b277a1aa", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679048046, "uuid": "efdf03e5-83b4-4774-b2b8-35a6598896c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679048046, "uuid": "37a9d3f3-1c64-496a-8198-01eb3d27142f", "value": "b079d9c447f6d9e774e1423e3b70431d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34d9d679-c4a9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679046653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679046653, "uuid": "b294724f-284c-4799-8f35-04be951ba52d", "comment": "Malware payload (Mirai)", "value": "a421861767744baed525c8e6cf931db8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679046653, "uuid": "01a2dbea-fa30-4fdf-9ab4-f6b6e817c061", "comment": "Malware payload (Mirai)", "value": "3b3f79582c4a3bdb53e6609d1738a9baf351002850a2d83bddece643474e9158", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679046653, "uuid": "8f884678-0af3-4116-82b9-0df4b090fe5e", "comment": "Malware payload (Mirai)", "value": "4382d50537a2a5e65da568bbb80cbf82c1d156e2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679046653, "uuid": "f3984206-2a1f-4086-9ca8-b548f8dacaa1", "comment": "Malware payload (Mirai)", "value": "1aa16a60cc52dd7ddceb9f7e55cefa3e18a8f86ba3f7c28e27ecb1fec282ac2f55c49aab9f50376af8cc15b45919c1b3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679046653, "uuid": "bcae6c35-39d8-4f0c-a933-527abb8be254", "value": "T129432921B63A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679046653, "uuid": "71401fc4-50e3-40d1-a797-427fd8f40b3a", "value": "768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIqQKqgESnmC/xO+KpAwh:RqtmZPuutfbltZFBSJsBcfDSTFIaBEh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679046653, "uuid": "78b48c8c-03e8-42de-83c1-cb1238e070d3", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679046653, "uuid": "f2b8c1bf-64c4-4963-ae17-691865c7d3b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679046653, "uuid": "5e234f2f-9778-4310-96d8-276de053d76f", "value": "a421861767744baed525c8e6cf931db8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b527e8bc-c4bc-11ed-88f6-42010a9c006e", "comment": "Malware payload (LaplasClipper)", "timestamp": 1679055029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679055029, "uuid": "79136ceb-f89d-46c1-9e86-e748bf69466c", "comment": "Malware payload (LaplasClipper)", "value": "6804a224cbbf256e2dc74266224f722e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679055029, "uuid": "b17b82bb-3926-4776-88d2-61db08427b24", "comment": "Malware payload (LaplasClipper)", "value": "3b541877dd17ecb6be093bcbe1974ef938e0899835d7b860fcef0b0eac88d401", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679055029, "uuid": "c2453d9c-fc9f-48eb-bd09-b911564350de", "comment": "Malware payload (LaplasClipper)", "value": "781f1b11cc2f9f9d2dcb1792affe8542505476e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679055029, "uuid": "a952f720-49a5-4df0-8176-88b6817b88d2", "comment": "Malware payload (LaplasClipper)", "value": "35e0ab2a65a4c475fefa6f1c82812f3154135345e8227e7fc6bbc79fec8c312cb4acc7930005f41b5208d51a2aa83fae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679055029, "uuid": "1b1a070c-7bde-4f48-a7be-a279ad766b1e", "value": "T17F54184397E17D44EA268B73AE1EC6E8761DB660CF4A7BB53218EE1F04B0172D163712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679055029, "uuid": "7e08b11b-fa95-4695-955f-6afd83281260", "value": "800c211657980cdb5c72386d0a0450fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679055029, "uuid": "be283240-4625-407a-b10d-80e1185142fd", "value": "3072:TAvg+LcQGStJlR645Cuen+IBlj/kPeGADPECu0t+S3Y6LWWI3qu4MN:mg+LcRSO45utbkP3aPEmtlMOhM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679055029, "uuid": "a280027b-ab95-4eb7-ae16-61ba7723c65c", "value": 304640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679055029, "uuid": "05aff777-5c1b-4dac-a71d-67f95c9c11bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679055029, "uuid": "8d6d6079-a4ee-4a49-8d53-fc81bfb2724e", "value": "6804a224cbbf256e2dc74266224f722e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b69d692b-c4bc-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679055031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679055031, "uuid": "b6be7278-2166-4e07-9093-bb68c8274cf3", "comment": "Malware payload (RedLineStealer)", "value": "171f1c83e1fe42c1dd5144133a46e068", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679055031, "uuid": "8a6dee6f-702d-420b-9b3b-66ee8be84274", "comment": "Malware payload (RedLineStealer)", "value": "3b580739fc10aae600edd12d05a2edb1862d7a7058918b64b052c39eaf3a776a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679055031, "uuid": "c3deaf2b-5a25-452e-b47c-9e816b96115b", "comment": "Malware payload (RedLineStealer)", "value": "ebcfb3902908f13b15a4b3a5707a85e568d46db5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679055031, "uuid": "b4b525d5-b828-46a0-9851-588f2cdabce7", "comment": "Malware payload (RedLineStealer)", "value": "783929969a9a97b964c950fe12db2d5ce1fcce969ccca2f2642017f6d3e6d1a74f36a86867324bfe8768cb72651cf5c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679055031, "uuid": "fb6605de-ccfd-4ff3-83c0-bf6b5d3cfdd5", "value": "T1C4C5D03DF5EC2F82D7098F77A9E10010F59B80DD0581F267C2D9926E161EADDA689F83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679055031, "uuid": "c3751252-fcc3-4318-a4f3-f8347dfdea88", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679055031, "uuid": "be696918-8713-4682-9d14-1161b732a109", "value": "49152:RL5cHXZuR3LAelfKEWlKFVJdlC3IvIlr1ytm4hK:R9cJuRkelZWOVvUcIlrWmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679055031, "uuid": "79a3746c-cb8f-403c-88dc-8d71d2e526cf", "value": 2534400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679055031, "uuid": "825077dc-e67b-441f-b63a-27d92e00e554", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679055031, "uuid": "b2c1045f-3f96-4ef0-aaa8-1fb9a26f302e", "value": "171f1c83e1fe42c1dd5144133a46e068.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a702c336-c4ac-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1679048133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679048133, "uuid": "6d7fec44-6630-4e56-8cdd-0a53491af37c", "comment": "Malware payload (Loki)", "value": "a3c81501f0f96536a365e4ec83555462", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679048133, "uuid": "251ff0dc-0872-4da8-9540-a508c5474991", "comment": "Malware payload (Loki)", "value": "3bec8fa9b1952d7c7289604328ff1c6fc528ed0d5643e308e643422eab3f21ae", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679048133, "uuid": "7f073eae-2647-4f14-b9ab-3171274f802f", "comment": "Malware payload (Loki)", "value": "2cf00d17dc458f5d288b3b2999fd555b91ea3ef2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679048133, "uuid": "b7fa584d-3d44-481c-97dc-ded75ed18492", "comment": "Malware payload (Loki)", "value": "9486f5a294e5097ce304d92a540a82c26b517941bb33c02ebd7a14bf34b826f732c3827d85e6400bba2cd83adecf42d1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679048133, "uuid": "e4f0371d-d26b-4b04-a1fa-967520ef73ae", "value": "T138F40148B329EF62C63E97FE7036642553F3891E6229E24C6DCE35EA2673F810544C4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679048133, "uuid": "660a9ab3-7eb2-4f12-8c2f-123c99bf28c1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679048133, "uuid": "849f6019-1c1d-43fb-9664-179976189966", "value": "12288:+zCeMfpjkjXyuaqbuHOfPL97614bRHhuc66ppCCyDxiiVnMBBDN:BBjkj+wuHOp7fbQiOVdMBBR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679048133, "uuid": "8c572dce-3254-4b6a-a95e-c175facdd859", "value": 790528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679048133, "uuid": "76a565eb-5a91-4ba0-bbf5-82afb821aa95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679048133, "uuid": "ccc56f2c-6234-48db-b61a-ebbe9fde0ce5", "value": "a3c81501f0f96536a365e4ec83555462", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88799c1d-c47e-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1679028325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679028325, "uuid": "41c1b6f4-8c9c-4e8a-a7ff-5f82cfc4eab4", "comment": "Malware payload (RecordBreaker)", "value": "96ebe6cebb6d0bfe01a7bf8bf7652034", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679028325, "uuid": "bf98e38b-d5a3-4f3f-8ade-4ff403699801", "comment": "Malware payload (RecordBreaker)", "value": "3c0f15094521a8677c186664573964cf9e0ab6d45c0540ee005a816465b1de51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679028325, "uuid": "525a4c50-0728-4b6a-a450-043772b71c22", "comment": "Malware payload (RecordBreaker)", "value": "1c659eb49c0af81d9b8a7ca1af79a7274e2c64f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679028325, "uuid": "7792072a-a48f-4446-a531-8da6c28fd91e", "comment": "Malware payload (RecordBreaker)", "value": "dba3c4bbd72ccadac2e049f07b63075284ebec27ffaeab081112b53b7ec7d152a387ed74b62cbe074d8a626efc9c513c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679028325, "uuid": "c2a7792c-5c45-4289-94a4-57368a35950b", "value": "T16124CF313750C075C25A46B0DA56EBB4662BBCE1BAA14A4B37907F0F1FF23E1A527385", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679028325, "uuid": "a1634e6a-3adb-4557-8bc2-b5f9f50ed9d6", "value": "1a4eff9c4d3cb3a6772cfd44c9b889f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679028325, "uuid": "91324c9b-de75-4c91-ac9f-1643b53bded7", "value": "3072:AcjVUMyLxcHHZwR96Y7J2OSgWj547vCV8/g3xowzMCfVQxeG3ERWR3LV:TjV9yLeHHYFJ2bgy47lg3CLoCxvU0VB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679028325, "uuid": "afbe1b48-2702-43de-b0d4-f5743ee48acd", "value": 219648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679028325, "uuid": "fca15ee9-2f4a-4b7f-9d2e-297cd707ca84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679028325, "uuid": "7cc81785-69d3-4a73-83be-ee67bd491b81", "value": "3C0F15094521A8677C186664573964CF9E0AB6D45C054.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98f56583-c4f4-11ed-88f6-42010a9c006e", "comment": "Malware payload (N-W0rm)", "timestamp": 1679079033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079033, "uuid": "4ec01945-f6f6-4dbd-ae14-add95d345fa4", "comment": "Malware payload (N-W0rm)", "value": "448da7691ae07d60272790296c33328c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079033, "uuid": "e392e74d-efc2-488b-9be0-a803f24634b8", "comment": "Malware payload (N-W0rm)", "value": "3c1769ad786efc178640a7f744e02f048707c72b27d781531f64dd16e1822e9e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079033, "uuid": "00e1c7b5-29d9-4f1f-94af-0606c7f69bcd", "comment": "Malware payload (N-W0rm)", "value": "5678220047e78f21b5a48dd92179203455d67e7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079033, "uuid": "182b6b49-2f38-4a0e-9b4f-55e679c15d96", "comment": "Malware payload (N-W0rm)", "value": "8e4f82ba64c4110a72b4e8586144817d095958ec8764fe21f60bdc33b4a3f7eee771cca7265757870342e65aec0965c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079033, "uuid": "dfa664b1-3ba5-4831-adce-df0d9022dfc9", "value": "T1D364C03253E07810E6624A359E3FC6F4662EFC619F6957EB22146B1B09B10EDC1F271E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079033, "uuid": "5f1ce180-5d27-47d4-bf08-7c5b5ffb25ae", "value": "bc34a2c3909f8b2826a0eea6cb6504aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079033, "uuid": "9d53c836-f7fb-4ab3-b1a3-4f19ad07061c", "value": "6144:uqj+2zJgcNDah8dL6Ivyg1rskXlFNHa5CK:LFzJgGA8zxBnN65", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679079033, "uuid": "f0bd89ff-e4ef-4248-9f8e-4ae755de81b5", "value": 308224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679079033, "uuid": "4700c354-1823-4166-9386-e67c434dff0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079033, "uuid": "3b3ac74d-d6c8-462a-9530-c837b084278c", "value": "448da7691ae07d60272790296c33328c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74452809-c4e3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679071670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679071670, "uuid": "65729b04-ee8d-4cc1-848a-2dfe9b515bbf", "comment": "Malware payload", "value": "124ee1eb452fc0403f270bdc7790df37", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679071670, "uuid": "d5f11576-12fe-449a-ab33-960a6f8b6e41", "comment": "Malware payload", "value": "3c4cada7b631c69ecc8b429254abbb0fa7587739b0417c71a7423377d71db997", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679071670, "uuid": "899e86bf-061b-4580-b062-d35b08b5822b", "comment": "Malware payload", "value": "46ff4217cc932b127eb023ea5ee1447d96928289", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679071670, "uuid": "892a5a82-4c79-457d-b02d-f3c6162e5d7f", "comment": "Malware payload", "value": "2fdbb4d0c141408ba4054d29ee5f39ec7a6c3e4bf23ddf0593b9262f0a4c83f3368cf13687534425594ab4895db071f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679071670, "uuid": "72a0d941-cb26-476b-ae74-69dbfb792ac5", "value": "T1AA26BE2B5CD782E9E1848832E3AE40FD24B50A7F198267F7056407F8DF9129F71526EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679071670, "uuid": "0e69fc46-58d4-4841-9748-110969eae7aa", "value": "49152:lYjcIb5aK9IBT/xlgYEViFwF6l+BfclcPi7Dp1orI5FSo49CLfM:UJbMKqBTZlgY5FlcBfclcPi7LO049CDM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679071670, "uuid": "09c8669e-0221-409d-8e40-9353c11192c9", "value": 4678684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679071670, "uuid": "2242ccd6-431c-4443-aa40-e7ed9c2a57c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679071670, "uuid": "d4da0ae1-f92f-42bb-b472-60edffacb0e5", "value": "124ee1eb452fc0403f270bdc7790df37.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77f1c28b-c4a6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679045477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045477, "uuid": "f913f43a-9186-40df-88ad-aa23c714851d", "comment": "Malware payload (Mirai)", "value": "4547aef5f5fa08575fae7270f37db933", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045477, "uuid": "3ffa71a2-b698-4859-8322-67edd5b76438", "comment": "Malware payload (Mirai)", "value": "3c67aa35d04242cfd65eb8256aaff3f52a5913b961aac36d22c317642b02bf7c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045477, "uuid": "87ef3079-7419-4ef9-a4dc-7922c0e87161", "comment": "Malware payload (Mirai)", "value": "32d6372525e75158180b4e96ec629f323d0ca758", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045477, "uuid": "98025846-3d91-4b9c-bf91-c463875886af", "comment": "Malware payload (Mirai)", "value": "1fa008668454f745ec335c000d66e69efc3981d4a6fb9ee330f108843d0a21a67733879dec4a79ed8be3be64baf7e42b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045477, "uuid": "d4e95934-ba9d-4fe3-b776-4cb72411188f", "value": "T19883A51E7E228FADF76D823147B74E25A69833C627E1D641E16CD6012E6034E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045477, "uuid": "36340e6b-ba40-433e-9b95-46d30d6b7386", "value": "768:2ty6IP7M/kq0INRhfuN2Eo9tl/de2YIwHKRH0I84EH6UTUD7ZDYovZ73x/nL8y8/:Rakdn2Eo3ePu5GTgRYo99Be037Wl/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679045477, "uuid": "85c20631-f11d-4d85-94db-024a86810d6e", "value": 84780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679045477, "uuid": "5d8bebb1-5466-4dd5-bc76-8397048ce9ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045477, "uuid": "649e80ed-7d98-4486-9fb1-e94ad1df3797", "value": "4547aef5f5fa08575fae7270f37db933", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da3bcbcc-c488-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679032757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679032757, "uuid": "6a38ffc5-74ab-425f-8883-1ecaa4889bae", "comment": "Malware payload (Mirai)", "value": "de2e4e4ff4b93896ef20402642730d28", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679032757, "uuid": "0de95bd1-a428-462a-a549-d5909d5a5de0", "comment": "Malware payload (Mirai)", "value": "3c94da879149b20110e0bb22883d1b85d99abd381db4e44b0f7f56421784192c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679032757, "uuid": "e371701b-04e1-4661-b826-c4c5152dc427", "comment": "Malware payload (Mirai)", "value": "46e32efe0c3355727f493305846f11f9403f21db", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679032757, "uuid": "50739f8f-e82d-4c11-95b8-195ce7f37db8", "comment": "Malware payload (Mirai)", "value": "2cc707552191395ba1ea87b7261469c1613d8942ef006d425e8048faf4f47865e8e3d2d82cd009b998a61b28a505a355", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679032757, "uuid": "66f4436f-6a26-47c4-8b79-14d14af47333", "value": "T121632BCAF401DE7EF84BD6774C560E1CB671B3D016831B2B67A7BEA7AD72158180AC81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679032757, "uuid": "566b9a14-d2e9-434c-b970-6da131a26e84", "value": "1536:i3Z8R8M1OQWNn+i8QDralQeuacWjcW0JcWcBAS6hwR5yWNeJBb:i3Z8R82OQ0+lQeuacWjcW0JcWcBL6h8Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679032757, "uuid": "9581dad5-e15b-415d-906e-f1bb1f15e947", "value": 73084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679032757, "uuid": "deddec29-6ae9-46ca-981b-f113bfce46cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679032757, "uuid": "d9a6fabd-db11-4f42-ae8a-df17759fa9bb", "value": "de2e4e4ff4b93896ef20402642730d28", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b18b680-c4ac-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679048086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679048086, "uuid": "e4f44a22-c9ec-4a7a-a034-92aaa664e59e", "comment": "Malware payload (Mirai)", "value": "f43c4ccb268d8dab5fc823439afc5287", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679048086, "uuid": "b8bb9a1f-3e93-4365-9500-aba545e688e2", "comment": "Malware payload (Mirai)", "value": "3e7a2259dcde9c15b04a2584fafa943bd087e6192dcb76888bfebea07478f96f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679048086, "uuid": "70e27c1e-f72f-4e06-98b2-3f3ccdff6b62", "comment": "Malware payload (Mirai)", "value": "1b76dccaecd220c42df61ed2379837117c3b7113", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679048086, "uuid": "be2879ab-0cfd-4621-bfe5-aa68d47a3612", "comment": "Malware payload (Mirai)", "value": "eaeaa858afe828992ba0c9905cd2d84a3a178fcf9850396870b73a60d4e44e1c4e7667c4f8fe8f7a0420beb1c91102bd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679048086, "uuid": "0cec0da8-0273-49ac-818b-f95961b69720", "value": "T1FD82D0B9A3995021C6B0643FCF2DCB81539742FDF2FA3766211605F4BA5298E43BDD81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679048086, "uuid": "9c4004b3-a4f5-4152-8a40-e6beae60a6a8", "value": "384:MEMJcxMwYgsO0WyBXLZAJgn1ax6Z1+VLAqvHEBLlTOSFDV+qkhymdGUop5h5X:YcRYjO0WyuJgkx6cVIVvFDIls3UoznX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679048086, "uuid": "8ea4845c-7cb4-4ebe-9e79-51c2ded4ae07", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679048086, "uuid": "d45acb93-3246-47f0-b879-8a7d34ad9b0e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679048086, "uuid": "5618928a-c12c-4684-a1fb-437b02fa4f4d", "value": "f43c4ccb268d8dab5fc823439afc5287", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a499678d-c4a6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1679045552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045552, "uuid": "606498eb-6d86-4d2b-a292-2acf966bb550", "comment": "Malware payload (Gafgyt)", "value": "0ff54fb7f1c33da453def42e07507478", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045552, "uuid": "48ce234c-4731-4771-932b-fb3ca21ee162", "comment": "Malware payload (Gafgyt)", "value": "3eb884f5aee74c57890aa03a711b36b983c1689944a35dd243341e364041a04b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045552, "uuid": "a7d5b654-6048-4414-a705-da0d093a6e32", "comment": "Malware payload (Gafgyt)", "value": "df541963f79799442cf3a1f41d17a991e3b24612", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045552, "uuid": "6ca536df-1b41-4add-ac38-4c54d187a680", "comment": "Malware payload (Gafgyt)", "value": "30838169060ba93d03432c0a3d9cc806914436631045d4a810f8e5013d48d95d5c5a676767cd2b63e2d19d11642748f4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045552, "uuid": "a6a36ee5-e81a-4d9f-9d57-9a0c8ba330eb", "value": "T103C30A44F901475BC3E327BAE78E038C77355E6857DB33156A38BDB42BE1B982D29260", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045552, "uuid": "37c4473f-94a3-45d1-8c4e-1772653ea502", "value": "3072:H63VpNeuWDGeQf8sRCat3DxkS2YmyVUQuiXfQd6W:OSuWQEcCat3ZmyVUQuiXfQd6W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679045552, "uuid": "12550d6c-fc9c-4afa-9249-16713f669fa5", "value": 127723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679045552, "uuid": "06d92ff8-15b3-4558-b4f9-a4d6f28f6e4b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045552, "uuid": "7459d214-7913-44c2-a5b7-856f85c95d81", "value": "0ff54fb7f1c33da453def42e07507478", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdf45662-c4c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (RustyStealer)", "timestamp": 1679057298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679057298, "uuid": "76127dc6-4cbc-40b1-9235-6d25d50eb320", "comment": "Malware payload (RustyStealer)", "value": "65c2ae916c616382ed8d8df33aa50bbc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679057298, "uuid": "56bcf26e-d277-42a6-bd05-ac2c27f79676", "comment": "Malware payload (RustyStealer)", "value": "3ed4997b7fc422a343672e1159ca3b4c96b318a63e5ee85dcd7ce1ae9ce7bcd1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679057298, "uuid": "b32e39ae-7174-4b69-ad2a-67a70d70e52e", "comment": "Malware payload (RustyStealer)", "value": "49f5eea89fd1ee523dd6d5c1efb3b1bddee48764", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679057298, "uuid": "17ea1a60-8d94-4fe7-8b0f-14fd08b17f28", "comment": "Malware payload (RustyStealer)", "value": "7268b80a8f6aa653f2a972615354ead1b474640343a33146f87f92a7ec4143cf41b136621a7aa065d543f0bda900dbcc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679057298, "uuid": "00fc0d8e-a0c6-4da0-b7a7-d40b83f41b50", "value": "T19B5629217F5AA9ADC19AC474C3468A725A7178CE1B35BAFF44C056343F29AF46F38318", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679057298, "uuid": "8f59d899-5b4a-4e2c-b50b-6f170f63a980", "value": "90930df37dc3798c0e5f7020bf134bc9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679057298, "uuid": "08be3a76-910f-4347-ae2a-c71c9aef445b", "value": "49152:lKgfSN6T+QgwZ20UEkoICscDrCq/olbBRNSHX83xs9wfETs7128vkVdDUj6zNs5k:hwZ2sqVRbNsCaSenC+nz1a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679057298, "uuid": "72a95104-53ea-400f-a1f0-eeb27a43aca8", "value": 6301696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679057298, "uuid": "1109ee42-0273-4bc8-8085-6bcf8db99892", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679057298, "uuid": "ac825501-48c7-4cdd-b188-40f04e3cfa9f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "841d3610-c4c4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679058382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679058382, "uuid": "bd1acddb-14ba-4600-813a-ce36a8839891", "comment": "Malware payload (Mirai)", "value": "2ec1f80c3d79242caac3ef2be13df4a3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679058382, "uuid": "2da1fcac-771c-4e6f-b714-e4e36799a05e", "comment": "Malware payload (Mirai)", "value": "3f4798e1e3fc327233ef728cdd5dd74a87d1eaf385f106863f7ce90bc871a4e8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679058382, "uuid": "b808c487-f213-4f86-b769-55f59c42bc8f", "comment": "Malware payload (Mirai)", "value": "769011a560ff804d04bd234f7cfc3e5ed34d6121", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679058382, "uuid": "0cef2fc8-291d-4c0d-b605-6e0a02287d9d", "comment": "Malware payload (Mirai)", "value": "7beba8a3d7c312ecefd35ec9c4daa84cd16f845c827cfd631fdeac4202be2e97902c3b63f84ba3517bb5db0ad8dd3bac", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679058382, "uuid": "fb17b81d-511a-4118-aef6-2ce20b0f2ca4", "value": "T121832B43E9A19FB7C0866AB565AB5E300B13E9912B4F1B4A713CA6F4434F4CD780EF64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679058382, "uuid": "6b0a6480-86f3-497f-a067-3186c247ced5", "value": "1536:ClNtAyOXiUCrkk9p4iKmgUKfDCJCfCiRNmkxVqOEeofzee:g7OXiUCrkkGmrJMLmkxVqODofzee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679058382, "uuid": "237cd03b-58a0-4022-a623-a37f6c68cea7", "value": 88730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679058382, "uuid": "cf2685af-5b9b-470b-843a-31f42196b559", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679058382, "uuid": "c309c5eb-524e-41dd-9879-43d17530f0b5", "value": "2ec1f80c3d79242caac3ef2be13df4a3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "912fdd13-c4c3-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679057975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679057975, "uuid": "f23ff77d-2cca-4ab0-aab5-a9cebdecc4aa", "comment": "Malware payload (AgentTesla)", "value": "c55884a8e6345841a054a24b2cdb912d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679057975, "uuid": "a8ec102d-c03d-4f61-9cdd-431a49b1e0ce", "comment": "Malware payload (AgentTesla)", "value": "3f7e041e466f779ea61696d2b932da57ce525fefe11972c8a7a489b1a2a9e38e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679057975, "uuid": "bdfd7e80-d69f-4e9c-b39d-29618a3c5c73", "comment": "Malware payload (AgentTesla)", "value": "2e2bcf3e2f37feb0aa4f28a6f31e78a24883c6c7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679057975, "uuid": "b3b9a1f8-6ed4-439b-9458-1cb0b07aa116", "comment": "Malware payload (AgentTesla)", "value": "efbc0db1f3c4955fa17f79764002eb7b932b098326c7bc67e0a44d640550535f480fe9305de23a4bbee4c1a63c486c7a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679057975, "uuid": "c38ae2ce-0c4b-4471-b356-a2fac8642243", "value": "T11215F16CE9D46525CD2E0BB690A328645273AE2B5FB1D70E9DCA71A22F333C7C581C17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679057975, "uuid": "f833edee-f4b5-4ff2-98af-603244767809", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679057975, "uuid": "c45bc003-c651-4cdf-87d2-336bd1739385", "value": "12288:/UWz9DiHQwoLtaFcJvKQeUbQpRvybXbAloGomXG9rIB8Oc0/73Jxxk+4gYcrrz7q:fiHQwcsFc1KvfoEG95OTjxk+4gYkz5g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679057975, "uuid": "02c549f0-2b4e-4d38-b159-4acb47333e94", "value": 929792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679057975, "uuid": "1e838367-5856-40da-9ce7-c382662542e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679057975, "uuid": "a3c93c9a-c091-45ec-97cb-b929adb1e2f1", "value": "Parts.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0c76173-c4f2-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679078268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679078268, "uuid": "182460d3-018e-4d69-97c6-6d708160fd2a", "comment": "Malware payload (AgentTesla)", "value": "9f82c1885282264acacff8844494c930", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679078268, "uuid": "048fb2fd-9803-4df6-96aa-9c4cba0856ee", "comment": "Malware payload (AgentTesla)", "value": "3fdc18fb3e0fc005fc2dd74e912389748d805653cb8a0d978779390e75ca4a02", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679078268, "uuid": "61cfc690-ad12-4d48-aa75-333cfe4b00da", "comment": "Malware payload (AgentTesla)", "value": "53ae6d302a5a0890537280e12fc900a6bea3963a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679078268, "uuid": "8b7864f9-3d8c-4eb6-b920-1ead770fa76b", "comment": "Malware payload (AgentTesla)", "value": "b11e77678de97aff76b3835b0c3af91c9437051b18600752db9236ad48811e2a0d9a4cc1723dbe2dc3895980e7f65580", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679078268, "uuid": "c39ea15f-3bd5-4540-a199-60ed74ab35dd", "value": "T19FB423B1A429DEECF16CE00EFCD851B9A3985DF834116D77DA2E29804FDB1829A4619C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679078268, "uuid": "da5ae365-fd70-41ea-a651-bfbbd013ea5d", "value": "12288:c4qKkrZP4cf+fEaMYx/TdtkumkX5KCplRPwJxF/:DYd/f+FRx5JJwR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679078268, "uuid": "2dc868ce-d52f-4a55-a931-50a7778f0a68", "value": 501377, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679078268, "uuid": "256da8fc-d28e-47bd-8299-1246a98b0aa0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679078268, "uuid": "479c4aac-a09e-4e01-b185-4718364e705f", "value": "PAYMENT SLIP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c80742e-c4a4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1679044491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044491, "uuid": "7b6ef01d-5dfe-417e-96d3-bca36b24c8e3", "comment": "Malware payload (Gafgyt)", "value": "d67676897558b0ca3b9d840cf5fb15e0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044491, "uuid": "95f42c1b-4871-4dd1-b553-00e2af458aad", "comment": "Malware payload (Gafgyt)", "value": "3ffda9c11d8187024d11ffbf9984bc7f1307ae98c2092a68a4288e6cbf22de71", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044491, "uuid": "c5547d6b-9a01-4633-9a5d-dba302077b5a", "comment": "Malware payload (Gafgyt)", "value": "4313b9fdce2856a14c7723ee605f199025d560ad", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044491, "uuid": "129ca599-4c30-45a5-aa0b-7b08ed4c8c43", "comment": "Malware payload (Gafgyt)", "value": "94553d9066a465db9cfdebe35f15a65eb5569af8f170cdef47b8f611d7077af482b1c7e9e15e18d2ee9f08f000d84dff", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044491, "uuid": "d66cb063-ec51-4c29-a26a-6bb91945f95e", "value": "T128B3932A7E22BFFFE168863107F35F709795219237A19386E26CE6181E7128D1C5F760", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044491, "uuid": "12c0d817-baed-4243-ab56-a5d4085371a3", "value": "1536:r7jB1Th2qu/XYK+0i5Y2rKreJiyO87SXZzg3vCaI1eg5/xLfgm1+XFBk/1P2wv:9fw+0i2Iez4qaIL5/dgm1+XFBktP2wv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679044491, "uuid": "600bab02-afb0-4017-92c9-c73280e62a1c", "value": 113615, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679044491, "uuid": "f4cf06aa-1e53-44f0-aa59-608282c4a3fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044491, "uuid": "9917df2e-c9b4-4fef-9e5b-8472fa87f0e9", "value": "d67676897558b0ca3b9d840cf5fb15e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1acbc59d-c4be-11ed-88f6-42010a9c006e", "comment": "Malware payload (CryptBot)", "timestamp": 1679055629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679055629, "uuid": "2d750394-a779-44bd-b5ac-96f61d5536b9", "comment": "Malware payload (CryptBot)", "value": "9c27c3c506f2c018c73d1ad20623e5d2", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679055629, "uuid": "0c963217-4831-4893-a912-40b022ff6183", "comment": "Malware payload (CryptBot)", "value": "40d1db94dc15e8042332d08a56ab9694cd27d86a124941fffd12ec4ee8dfe527", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679055629, "uuid": "f7a08268-2171-499a-9a47-d0b890e1e9b7", "comment": "Malware payload (CryptBot)", "value": "236c8990a2133fe0a3ca2fa0498999a85893a7b5", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679055629, "uuid": "6031ffd4-d08a-4d0c-a10d-c3e7a87393f7", "comment": "Malware payload (CryptBot)", "value": "09d13fbacd4984e6fb1e17d7699ada0cc5ea370de5e289881582a4dbe6569e37fcaec7eed4d1f0afa77b2278842a5d8c", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679055629, "uuid": "452e7c67-5a40-4909-bbae-869337986d51", "value": "T1D905F110A6F0D077C563813EC5AD3335E665B9A0CC54FD9723E3B82DA36CE63AB0A516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679055629, "uuid": "698ee41d-8ff5-44e6-964d-4334d0ea1dad", "value": "24576:qLsifA9O1vvbWxmS1oiSFLKAypX/Q+UcH:qLsifu0W0iSFL3AQ7k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679055629, "uuid": "372089d5-fdad-4ab4-b1b3-bc030262b333", "value": 810496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679055629, "uuid": "638a52fe-f347-4de7-a372-52beaaefccb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679055629, "uuid": "091f9b0c-80d1-43e3-be72-3f0167aeceac", "value": "9c27c3c506f2c018c73d1ad20623e5d2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c85c2d7d-c4e3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679071811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679071811, "uuid": "e463bfe3-a90e-4e4d-9166-8fb2d68639b3", "comment": "Malware payload", "value": "19a931bf411ab50b03d6b0ff8605e0cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679071811, "uuid": "246cf9c3-1db8-4cf5-9d26-679a99a1106e", "comment": "Malware payload", "value": "40d553c04eba06fd464de79902a7b9aa9a4876039c4b3a5857584362d3fdb3cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679071811, "uuid": "cca3d39e-1abb-47df-ac8d-bb7f792033ad", "comment": "Malware payload", "value": "2be5e398a0ce414b7a493b078a9a3d1e8e983a42", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679071811, "uuid": "e6367f1f-53a4-4650-aafe-bc2690ab5e91", "comment": "Malware payload", "value": "b7aa30ddb898450ae99875dd8bc30d1aebf389fa5f4ad3b31ac1a24a497fae4a85cf427961058ab4e9617f6390a53c29", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679071811, "uuid": "b649405d-78c5-4d5b-b811-2e2dd8bf5dd0", "value": "T184273380AAB1B66BFF1A7033B584CF129CEDEBC12B87CD12925DD7D15E0407262E958D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679071811, "uuid": "9954cda8-7a49-440e-808f-c3aaca37a15e", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679071811, "uuid": "4fd81191-1dfa-4bb5-978f-d69e2fbd93ab", "value": "393216:gEiQj2JP6r1qNKxUJL5CEk3cYmQi/7vZHUB4St1cSczKw3I506tlS:ZvjO00NKE5CE44n7vZHUaStRct3IG6nS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679071811, "uuid": "f6c7829d-0cbd-46e8-973a-b5c790360119", "value": 20779476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679071811, "uuid": "f0147af6-da83-41d8-9928-693495f3651d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679071811, "uuid": "2e4f19ca-f90d-45d0-a5c6-9da50cdd36ac", "value": "19a931bf411ab50b03d6b0ff8605e0cb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6144008-c49f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679042575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679042575, "uuid": "785fb327-fab7-4efe-bd7e-fa7267add4a1", "comment": "Malware payload (Mirai)", "value": "6934ca155ff59b2a71ab0db156c83cdf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679042575, "uuid": "83fd16cd-4ad6-4fdc-9ec6-7d23c1004430", "comment": "Malware payload (Mirai)", "value": "422c493aee7a2204cd42fb725db36be6fe5c0e8c79f9bca39b55938fd817f942", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679042575, "uuid": "d7be3286-2df5-48e2-90d5-c9d0acfada56", "comment": "Malware payload (Mirai)", "value": "ca31d184523d9b74d4a862aecab56efaedcc211c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679042575, "uuid": "1076b697-a9f8-4291-b742-b6ff62a938fe", "comment": "Malware payload (Mirai)", "value": "aa53ade6a068264d96a80d001da911d87437945949010497590688684c92d70f8438f3cb0b438eba018209d3e684c62e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679042575, "uuid": "2917d2e8-a2fc-4035-b998-f21f02cacef7", "value": "T141334AC5D997DDF8E8201A793077AF3296B7E13E2128EDC3D3999937A942A03D10724D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679042575, "uuid": "95585733-396d-49cd-9d71-40bba1dc4d31", "value": "1536:PS+dEczOjRC6qf1dhWphmEBg19/MEgnNxg+kC:bOjRC6qf1dhWphmEBg1FMEGN+H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679042575, "uuid": "b127bf52-eb2e-4362-b3b6-4a58ba02d5f7", "value": 53852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679042575, "uuid": "3ca42f3d-27ce-4196-8380-a6b05e381211", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679042575, "uuid": "4eab95ec-24c5-4b3d-8586-fcd722d098bd", "value": "kwari.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2368873-c4f7-11ed-88f6-42010a9c006e", "comment": "Malware payload (PureCrypter)", "timestamp": 1679080391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679080391, "uuid": "3632a4f1-d0f4-4917-bc2b-310ea6eab1c3", "comment": "Malware payload (PureCrypter)", "value": "cfd68be8a2267696632edfab90cc0e04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679080391, "uuid": "0e048929-dd91-4d2b-9441-221695cb5bb1", "comment": "Malware payload (PureCrypter)", "value": "42b3e65f5f70a7e4b9497d19252dbf9c86aaf767ea47ca0951ec67cd2e9bbfba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679080391, "uuid": "3880f780-a187-4a07-bbc1-3b45236e8617", "comment": "Malware payload (PureCrypter)", "value": "dffffa158914d47017089c203c54d7d32cafeef0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679080391, "uuid": "9b2f839c-a224-4f66-b2aa-7c292f7bcffc", "comment": "Malware payload (PureCrypter)", "value": "6b13b48857885ecf31b34cfd7a90358a059eeca95acb232c6b9341f91759b5cfdeefe9313ad7aef42a5d7b4a2622b734", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679080391, "uuid": "e5c13ee6-8b33-4e95-91f4-5dd09c5400ac", "value": "T10154D7042FF98A1EF9ED27F5B83584D49B79F886A837F70D14412CDE0E6AB8449417A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679080391, "uuid": "c82f6bba-a645-4c8e-b621-091e2c342f7c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679080391, "uuid": "dd95f410-daed-47f9-86c8-8316c62b1985", "value": "6144:qqwyfIfX/l539kONwT8HYuqMyxqrqQZp8:20If9IuqMya8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679080391, "uuid": "38a1af9b-9689-4c16-814f-1f43f0185aa5", "value": 296960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679080391, "uuid": "32aa7e23-414b-40a1-9481-d831a4228b5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679080391, "uuid": "26b39636-4ba2-4bbf-9210-64352f5466d9", "value": "Product Inquiry #03_2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df140762-c4aa-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679047368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679047368, "uuid": "3fc3f574-2873-4e88-9b4b-773712be3431", "comment": "Malware payload (Mirai)", "value": "4a98643e5b42daed58d068832b2f9e92", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679047368, "uuid": "1c7f33ef-64e9-455c-a899-06e9dfea9ae6", "comment": "Malware payload (Mirai)", "value": "42b8a4b57430e69dc553257357ffe22ff5207461d5ce6528316844ebd98e71ef", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679047368, "uuid": "0d8f0c5c-a054-4f82-9f30-07c87d3774c1", "comment": "Malware payload (Mirai)", "value": "e0f3e747f94752ecb0d9e19fb30a104ca52fecdb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679047368, "uuid": "f40fff22-23fb-4162-bbc0-782ab1d1edc7", "comment": "Malware payload (Mirai)", "value": "4a7cf859ea3e8bc37a321b6e9b963f06c17b3b4f90dacd600a216a275ae5c4c487557c36910d9bd7b2c4795e7dee9574", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679047368, "uuid": "d042d830-4c1c-4093-b34b-efa46cd8a570", "value": "T16E432921B53A1F17C0E0A47D21FB4B59B1B15ADE25A4C64E7D720E4FFF216806943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679047368, "uuid": "4cc2884f-1da8-4d87-bc18-555e6e04b671", "value": "1536:dfRDxpsnPDtGPPGJ5dLo0SsU+0F3DgppE:ZFYvSsGFzepE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679047368, "uuid": "1c70919f-1f0f-4299-8523-64e03ee60072", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679047368, "uuid": "d4642bb7-2518-4821-b3df-4e6d5ab27d1b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679047368, "uuid": "7502c9b8-1deb-45c9-993b-76a1f5fdef32", "value": "4a98643e5b42daed58d068832b2f9e92", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d3d6ab2-c4c6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679059257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679059257, "uuid": "e036f0c6-2437-440a-9b04-f6027fd15262", "comment": "Malware payload (Mirai)", "value": "63d3b596c6de6bdae7286728ee2fa7f6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679059257, "uuid": "30bf69e5-76e5-45b3-bbe4-c1ddb634a8ab", "comment": "Malware payload (Mirai)", "value": "42bfd216ddaba87edcccfb4e12c8a7ce972993b600b44656ce6966f8cf555a5a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679059257, "uuid": "10126182-932e-4159-b946-0ae4b20c57c1", "comment": "Malware payload (Mirai)", "value": "7bc0cceacd884e5ac2b88a2eb9236de35c31760b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679059257, "uuid": "8fa2d5ad-d94f-4dfb-9ebd-f85fbbb5c9a0", "comment": "Malware payload (Mirai)", "value": "47ae4950053c43ffa74443c327bacc7d266b91f4923b1b72507e0c5d20c06fc443afade146097a3d7d50848ebc1933f4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679059257, "uuid": "39da4dc6-92d4-4069-b14b-9154bbe68648", "value": "T118A30796F800DFB7F40AE67604D34B24B670BBE14F535622731739A6AE722D52823F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679059257, "uuid": "154e29e6-b71c-4d12-8b8e-09a8c9c50353", "value": "3072:9xSGLktsZYyEaGN8fMSWmuxVqDr78fz1e:9xSGLkNyEf8hWmuxVqDr78fz1e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679059257, "uuid": "b9fe547a-ac48-4171-8bd6-ba72471f7a6e", "value": 98904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679059257, "uuid": "4c7d1310-f463-41fe-9ae9-a4885143dca6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679059257, "uuid": "b05746fe-5239-4bd9-ad5d-0a1079e074ac", "value": "63d3b596c6de6bdae7286728ee2fa7f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19d0b19a-c4a5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679044890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044890, "uuid": "0b242ccd-aec3-441b-ad83-cec24002dbf8", "comment": "Malware payload", "value": "1ea30d8d6f2723e50d19c4c4ae0725bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044890, "uuid": "872cb4ac-573e-4429-9142-693e648d7d0c", "comment": "Malware payload", "value": "432bcac514ab3d11fa0bad3262ea798e5f140b0f4ae62207429fa5bc05f5c495", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044890, "uuid": "5c4ec262-57cc-459e-9098-8277c9f16de3", "comment": "Malware payload", "value": "bed4c9c38d52773fced9c6868a893402a7163d27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044890, "uuid": "56499cff-a502-4724-af6f-d33b6d82e38b", "comment": "Malware payload", "value": "d7165792b9984e56eeb291b98add770bd72de620198b70031352e6ab697c9aa5c3c2b4b3303973a3aa472d4428bd9058", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044890, "uuid": "b64f653e-0f8b-40cc-9e87-535fabb9dc4f", "value": "T11DE4335A7E824C8EFD48CFB8C66538E525E3FB4200C6C5626B6D4AC72C9D8C9DDEC491", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044890, "uuid": "9c3a3be8-35be-4267-8a63-3f0d52fb4f54", "value": "12288:srZjdcjcFjEePfecYrYUXrSyqDVtFnQPuwOCjmEqe9yE9HWOA14Vso4OMnP7g4/:Gd6jcmJcYsqrfqRnUjbD9B2Oqf5OG7g6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679044890, "uuid": "ffd18636-b86a-419d-88fe-b3d0994b489d", "value": 702260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679044890, "uuid": "c9796305-0688-4b94-ad7c-aba48cb71f72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044890, "uuid": "23bc0c39-0be8-46b9-9f66-5f17ab9a8f3e", "value": "1ea30d8d6f2723e50d19c4c4ae0725bc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42044eb2-c4a6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1679045386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045386, "uuid": "4773616d-6cb1-4602-87c4-bbcc0612baed", "comment": "Malware payload (Gafgyt)", "value": "5fca9eafd252a603b5551254429127ab", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045386, "uuid": "d56aadb8-a2ec-4af4-9598-27d685c0788b", "comment": "Malware payload (Gafgyt)", "value": "440f381ae1dd166916789273bb8dea1173a7224c67cef7f5539e23bee0fbabdf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045386, "uuid": "e2383fd2-2ce0-42ae-9155-267017267886", "comment": "Malware payload (Gafgyt)", "value": "dc86c8395bdf69ca2c28fee65a8ec554e337d78b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045386, "uuid": "9fefe350-7de9-4c6e-a95d-77cf0d7f62fd", "comment": "Malware payload (Gafgyt)", "value": "9eb4ce78aa66ae748d494aa4d4fd0406df4ecdb4af5d859e70086934427adcd2ada7852739ecdbdbf83026d2868e57c9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045386, "uuid": "fd4214a6-09de-439c-ad60-d6cddf430282", "value": "T17B930941E9418B17C2D237BAEBDF439D37366A5497E733016A386EB42BC57D82E39120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045386, "uuid": "1cd9b563-e098-4b02-9b18-9f48e540053b", "value": "1536:0B/jLLh9cxU3eS8UNiOagU3hMnfSuA7oUT2YTADwM1mxdqQ4twJRfebS:kh6ZUDUOn7A7oUTlTARmxdqQ4tsRfebS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679045386, "uuid": "1693b783-17c3-4fef-8766-41628c99fc9a", "value": 92544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679045386, "uuid": "72c14921-a17a-43ab-8b7c-2a103546fe78", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045386, "uuid": "b1a860bb-74c4-4da7-8926-38d7c3689af5", "value": "5fca9eafd252a603b5551254429127ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8466ef57-c51b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679095749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679095749, "uuid": "4a139521-20a5-47c1-ac5f-9d506ea64c4c", "comment": "Malware payload (Mirai)", "value": "2cd74b8055b2268742b0e933b42c7538", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679095749, "uuid": "1604feb8-2086-4fdc-ad81-f7f4320e86da", "comment": "Malware payload (Mirai)", "value": "447615daac255217f326f6fd944d068d11b9e6ce3a618c590218d8ea2399292e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679095749, "uuid": "eee7d085-8aa8-4986-b37d-8c0604e4c631", "comment": "Malware payload (Mirai)", "value": "d6c808cb75ce2a2eb739e9d250fc4d5e00dd89c8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679095749, "uuid": "2fef58ca-406a-40af-aaa3-3c96d5680757", "comment": "Malware payload (Mirai)", "value": "800cb0784a112ff2f0f4b7eb079ccbe3420427a718da03be0a3c952d72dd1afbb21610a05aed8828683dfe17c5f9b5e7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679095749, "uuid": "ca389543-5acf-46ba-a239-9f1f4cf0c986", "value": "T193B2F75278C1592BC6E0627AE5EF464D3320A7A8D3DF7B17CC151B003B8691F1EA7B81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679095749, "uuid": "f3ac49d9-de57-432f-b712-dc96fbe0a2e0", "value": "384:8bamwkW+mO2eGuW+mOeNeGuW+/HPXfnv3/HPXfnv3/HPXfnvQb5s9/lL+7zUyyDx:8zjW+mO2eGuW+mOeNeGuW+/HPXfnv3/S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679095749, "uuid": "e4ccbafc-6bfc-48c5-919f-b47c6651eb99", "value": 23920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679095749, "uuid": "04e66731-6c68-49e6-9610-ac10950f59e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679095749, "uuid": "a15865e5-c3e1-4816-8473-23e514c63410", "value": "2cd74b8055b2268742b0e933b42c7538", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e0d7f1d-c4af-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679049245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679049245, "uuid": "a159db51-ace8-422c-b242-06efcf6eab17", "comment": "Malware payload (Mirai)", "value": "5c5b0e91a8b40915a1de78cb3990e712", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679049245, "uuid": "1490cece-a765-474d-931d-e47c00eec316", "comment": "Malware payload (Mirai)", "value": "44aaf6eabf3ac31757ca9601f6d1ba90c5b1e03ab89c39be41e9fc513d6c726f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679049245, "uuid": "9a112ab2-5fe8-4f88-a463-1ecec655f103", "comment": "Malware payload (Mirai)", "value": "82957f9033378dd9ea999463b91f8e82dfe16a4a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679049245, "uuid": "92d00edf-bef7-43cd-9a87-7b122e87b0a9", "comment": "Malware payload (Mirai)", "value": "0505e75b838f2b675106fe76e9b16c48d7c4305cefcbb200ce04439dcc4b963cb04c76727b09d05fc30685779c3fdb60", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679049245, "uuid": "8fda0ac7-4390-431b-832e-93110999bb16", "value": "T14C82C034219BB1B5CAB14434F66F8A868B064FBDE1FD32C31A887B758E0681652F81D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679049245, "uuid": "99b41b4e-bbde-495c-9b6d-021fa2d7926f", "value": "384:MnfzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUSDdgtQvwT+GWrhymdGUop5h5lA:2dV0P6+kom0tVAoNvm+tXDdWWZrs3UoS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679049245, "uuid": "aab6279a-9b9b-40f9-94eb-3af63bbe8bf7", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679049245, "uuid": "2d69a9d2-30d7-4636-902d-eeb48bc19d04", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679049245, "uuid": "b7ed34f1-2a2b-4016-a785-2701393b982e", "value": "5c5b0e91a8b40915a1de78cb3990e712", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc89649d-c496-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stealc)", "timestamp": 1679038827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038827, "uuid": "eb601809-5844-4212-97c4-57e8b0588a4b", "comment": "Malware payload (Stealc)", "value": "867aeddf1e39f9d7a7a46332c4b5d201", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038827, "uuid": "6cbea702-b6a4-4a46-a46d-1a6536d75d08", "comment": "Malware payload (Stealc)", "value": "44d21ea143ece509c6bb52d87090c7e4353c931b2be94021b0cee8a5d5854a50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038827, "uuid": "72bf8cfa-738d-4340-824d-f8db8fee1507", "comment": "Malware payload (Stealc)", "value": "8c0da74db407be99dc3963a2256e4d29886e4c62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038827, "uuid": "cf0631ac-cfad-4131-9597-d11b6197088b", "comment": "Malware payload (Stealc)", "value": "79e3b53fd39d285bad0d18b89ea6d3ab3dda1b42a12934a6a0ad34b009cfc52ef41e0a54df5e7f3ea01908b449af12c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038827, "uuid": "725f4e00-bbbb-4eee-abd5-d2274846e357", "value": "T10676DF25F20D9415F9B30E7659F91A9CD0BD3D204FC844E7B380DD6B38297D2EA31A6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038827, "uuid": "1cf342f4-fe91-41fc-8a96-b4249f96fdd2", "value": "8b4a74bcae9e952bf1c60c48e1e70879", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038827, "uuid": "a12b9466-ab14-4063-aae3-bcc3d6ef8faa", "value": "3072:HFwQeyUS7mBiVI9erx7qgBU6HwgknMRi1+0WwX:HyQ/q9uugm6mnMc12w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679038827, "uuid": "a0675f73-bb95-484d-af48-1c6074d9c7f3", "value": 7340032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679038827, "uuid": "f6b9bca7-1174-4c50-b661-4849fc771639", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038827, "uuid": "7313a0a7-ecbe-4d42-9e05-5941c1cb20bd", "value": "44d21ea143ece509c6bb52d87090c7e4353c931b2be94.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6de3ef17-c4c0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679056627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679056627, "uuid": "d09753a2-1558-476e-8565-770fa822ce9f", "comment": "Malware payload", "value": "112e00c580fc8e79d3d03f8b3ce30e59", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679056627, "uuid": "ad8dc261-377f-4204-85eb-657a8dd3906c", "comment": "Malware payload", "value": "456cf676be8028427627a21896c1ecbe5e2aa67bfeed8b127e44e37471e932a8", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679056627, "uuid": "bceb7b6e-257e-4e76-af23-c12486e50874", "comment": "Malware payload", "value": "d38a2850b1b56e1d3debe663557b537ccb10d045", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679056627, "uuid": "bf67ee2d-3bdb-425a-9b62-3586a14ca5d4", "comment": "Malware payload", "value": "ee756ff05a27db208bbb140d4985bb9a9bd387a98810018f5cd54bb60803fec48ac7f913d5a2de9edbdd5af1eb6cb4bd", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679056627, "uuid": "fd4428ec-01cb-42e2-826a-0e303f683cdd", "value": "T188428D4F21D35818E30A9930D108E5D1472D2ED2212BEBC667F4E09E6CBBADDCD6D974", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679056627, "uuid": "d736f14f-2e03-4503-bf62-5dc9860380cf", "value": "384:Q2tnE1NAl8sy7u2vk9vkGQzA3NiXI0y+aoyGXrHdu+7x4gsl0T/EWguhcoI:1EIy7jvqv9QzAgYHhCup", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679056627, "uuid": "a791708a-765a-4e17-abaa-748fff4ca5a1", "value": 13195, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679056627, "uuid": "548f4419-efb2-41e5-a5d3-d97701149b10", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679056627, "uuid": "f56817f4-7eae-4621-b4ea-b2a22baaa816", "value": "PO#16032023.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0967fac6-c4a5-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679044862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044862, "uuid": "97345f7d-fc4f-424d-b898-07463852a61e", "comment": "Malware payload (AgentTesla)", "value": "0e62cc35e2e3e587f0ccba39e1cb502e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044862, "uuid": "489b9bfb-4e43-4d16-a116-9d194ef921bb", "comment": "Malware payload (AgentTesla)", "value": "462b121f72bc42fcefcfc67174e4de53083b977458c7ed3d4009eec6bddd3f1b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044862, "uuid": "4928a357-89f0-4476-9499-3902164f0556", "comment": "Malware payload (AgentTesla)", "value": "18892411b33a4b9065c2e7b11b74f41c3466e5c4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044862, "uuid": "c7dbb532-27f4-4bbd-bcf2-f5db50b3cd3d", "comment": "Malware payload (AgentTesla)", "value": "d1ff1aa4e5fe850cb8913f614024944beb2ee1c69f928bc805b4c4a1efaef6f23d64a971cc3852cc871c080587cdc538", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044862, "uuid": "7451e0ca-40c7-4baa-8e09-82bd5a136dfa", "value": "T17F064B737193EDA1E37A6B33C08524204F60D8836B17D3ADB9CA276A5583775CE0A673", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044862, "uuid": "5113d223-75aa-4905-b840-e9c555eb5ef9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044862, "uuid": "227f27cf-af8d-43ac-be0f-a8028092d8e8", "value": "49152:cjb2qgyaCDTmDmfYnO+JOy3m/g1qbBX+Mc66vn/:cjbz/mDmhUC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679044862, "uuid": "f73474bb-5a84-40c6-9896-34b2306ed7fa", "value": 3938816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679044862, "uuid": "22b56f77-f4bc-4f87-83db-65b470aba7be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044862, "uuid": "f7247616-3bb3-4ec6-ae88-049cf17adeb4", "value": "0e62cc35e2e3e587f0ccba39e1cb502e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2de97590-c4e6-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1679072841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679072841, "uuid": "5cda88f2-fc28-4695-8d42-ed9b4a3fe720", "comment": "Malware payload (njrat)", "value": "3acee14101bf382368ac624fd6400599", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679072841, "uuid": "01f3b354-bae5-438f-b3b5-15750ecd667a", "comment": "Malware payload (njrat)", "value": "46ea8061668df7c3ba14092e752cee86cd2d0410dcb7085e5626d5865a4354fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679072841, "uuid": "d036a81b-1e4d-45ea-b148-e90d733015e2", "comment": "Malware payload (njrat)", "value": "ec011272dbecba4fc6526f3d71f068698b50cbe9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679072841, "uuid": "ce766099-43be-44cf-a512-3a9c3495e778", "comment": "Malware payload (njrat)", "value": "c8863071192bdce713522a21bfcefdf252b090b38633663e18076d063c67d7b37f8c160163be59d6ffd35d110ca0b250", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679072841, "uuid": "7f2bb804-b811-445b-b9e1-81802f561183", "value": "T13BE208067BF94215D6BC5AF88CB313214772E3838532EB6F5CDC88CA4B676D00645EE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679072841, "uuid": "553c2335-c19c-43c3-8ce8-bfacbfeb3268", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679072841, "uuid": "9cd55f62-046c-48a2-aaaf-e806b4435773", "value": "384:Y0bUe5XB4e0XtOVcsw0Q0mS03AWTxtTUFQqzFNObbR:tT9BuU6555dPbR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679072841, "uuid": "5dd04bb6-b29c-4f6e-ae60-e8609a3550e1", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679072841, "uuid": "61803a8a-e4a7-431a-aa67-c67501de603b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679072841, "uuid": "c6d2f2b9-f1e8-4e77-b615-080ace1f7224", "value": "bK8X.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f4c366e-c497-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1679039020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679039020, "uuid": "5a616349-c0e1-4235-9da1-63389e2f5949", "comment": "Malware payload (GuLoader)", "value": "778f9f61191bf812a829edfb93f5b442", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679039020, "uuid": "22ba3409-8560-4c4e-986e-0f592db17e8b", "comment": "Malware payload (GuLoader)", "value": "47b5e835d443cde52de78c36998cf1e312d391501226238ea00968139790e32d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679039020, "uuid": "6af4e13c-30b2-4784-9521-96cfa617ce5b", "comment": "Malware payload (GuLoader)", "value": "20f3e834b759252210d047091bc98c47e7e6ffdd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679039020, "uuid": "3cf5b859-1360-4529-996b-0ff1a7e2c955", "comment": "Malware payload (GuLoader)", "value": "b936898b04c37a9a37d98886d1035dff6541dab9fb571cfb05d8f4415e66f62b2613f50975df2bd12cbe1c8056121e0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679039020, "uuid": "f598fedc-3e39-46ea-8795-c3ed3ca318b0", "value": "T1A064F1253AB1C033FD954170CAA5D6F3E229FE48C924C18777A43F6EB9315848549EBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679039020, "uuid": "be1f3979-7042-4a2f-9d3f-b351c0b9ffb2", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679039020, "uuid": "76d5fc5e-a3d4-44c1-9794-b1592c55a1a7", "value": "6144:VDkBNYb/zy86tyPhzKpqs1z3WRA8ZbO7Sv4Zbf9CbTqGErmroIbvF:O3gUtuzaq+zwjZbrc4Tqxrmrh9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679039020, "uuid": "57bbaff3-225a-4f2e-8b2e-b3aec298c375", "value": 329416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679039020, "uuid": "772f934b-82f7-4205-a53f-973313644deb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679039020, "uuid": "646bba6e-4d42-45dd-8a8f-6b4ef3a81955", "value": "SC_TR11670000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94a9fdc4-c49d-11ed-88f6-42010a9c006e", "comment": "Malware payload (zgRAT)", "timestamp": 1679041660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679041660, "uuid": "34904ca2-abcf-415c-be2c-4a8edb348c42", "comment": "Malware payload (zgRAT)", "value": "3ce125bca4a29f14ae5bcab2d7247241", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679041660, "uuid": "1186b8f1-e4f0-4cf1-a0d7-8151411f769b", "comment": "Malware payload (zgRAT)", "value": "47d56868d1577e5599d2f000c08875bb73492d055f73f4c7f5ca747d13b6410a", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679041660, "uuid": "5ed4b4e3-c5ed-48a6-9263-cba611e274e0", "comment": "Malware payload (zgRAT)", "value": "5be8d5885792a0118c72a6cacd3d1bbd9b0e153b", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679041660, "uuid": "480224e7-e88e-4150-8d76-a95af0b453a1", "comment": "Malware payload (zgRAT)", "value": "a4ef93e538cfb2a72da55c2a4e6f99eb7ca4807729cfb055c2b324b921de88a8cd49c66f8f6078b293cf92717a18109e", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679041660, "uuid": "04ba11b2-427f-4a0b-a0c8-67b3360d1f29", "value": "T1FA617A1457EA0308F3F2AB3AA9BE52994E3B3956E932C74E0059414F52F1A40DCA3F37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679041660, "uuid": "328579fc-cfed-4b3f-a04a-dbc7787b9042", "value": "48:89HasU9Dmel0iglZ+6bslpQfYj1sAT1rTRRSJxodgImcC:89HmB0+6b86YZsErTR0/ygMC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679041660, "uuid": "3358ab1a-9368-47d1-8352-e66f615285ba", "value": 3456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679041660, "uuid": "2b47f727-a3df-4c37-b90b-458b58a2bbf6", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679041660, "uuid": "8ba205c3-8f8c-4bac-b0ff-6dff8e5a03a4", "value": "SP-11940.png.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "647c6783-c51b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679095695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679095695, "uuid": "4075b820-b43e-4ced-8613-f6e1adb4317a", "comment": "Malware payload (Mirai)", "value": "fff0456162bbf2cdc65a2f401353770e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679095695, "uuid": "e304d174-4cdc-4e45-b444-a3853c2cb3c0", "comment": "Malware payload (Mirai)", "value": "47f7d03ddaabdbdf160606362082790c43d3df876d2391497b293af746c78d57", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679095695, "uuid": "73d11c5b-c968-4840-98f0-34b84b85867d", "comment": "Malware payload (Mirai)", "value": "2b5ee940dbba4727f3d7fc8419d98a111fe0c9c2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679095695, "uuid": "13ba78b6-e493-42a7-ac0e-bdfc4f802034", "comment": "Malware payload (Mirai)", "value": "179f48a8c1b0c25122128bc0f956c32f22c067fd7257e3e6cc4d257752b7f849d0084557b36a3cb46fd49b89dda4195c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679095695, "uuid": "20104d00-4575-4af4-9949-f62ef90f56f7", "value": "T1D9F2E121B143FA2FF3D09E73979C716F6E87976E41868717A8878057409E01BBBAC464", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679095695, "uuid": "53bf9f9c-2223-426d-ad90-48f94dede26f", "value": "768:h46nYPVnpQ8YwkM/FDtZZBjdjU3F8U+pbT7kbEKjOeuYqhcVTyI9ntHVNdRSC:h46AYbQFZfLBbXkbEXeWKLt1jRSC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679095695, "uuid": "6d117d30-33d8-4759-bb34-3a2bfc4cb81a", "value": 36924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679095695, "uuid": "71493e53-b3b5-4fc5-adc2-7673b1865e2e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679095695, "uuid": "aa742052-f09f-4246-85ff-18580563cd26", "value": "fff0456162bbf2cdc65a2f401353770e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "274697e7-c4a9-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679046630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679046630, "uuid": "cdaa06d3-ecf6-4010-9a0c-2663b9c408a3", "comment": "Malware payload (RedLineStealer)", "value": "6ebc3fb4b4f4d3fc09684d6723744dac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679046630, "uuid": "e92205af-d46e-4955-98d1-ce0a7cc0272c", "comment": "Malware payload (RedLineStealer)", "value": "485cfcb9cbb98a598598b0600e8b8ecd8b80483b3f2d7af8e3082c672e685ac6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679046630, "uuid": "ef95d478-e88b-4ca9-8bcf-96e3098c238e", "comment": "Malware payload (RedLineStealer)", "value": "5d1729212d880bad16773ef5d02928e3eac26b91", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679046630, "uuid": "e6dd2ea7-36b8-47ac-8005-d9ff3b2d4eb8", "comment": "Malware payload (RedLineStealer)", "value": "6e8cd97a77ee14a743abe3262268a4d7b3d78481dc77286af3e852a7224b6fe6762a2bd69627d3bc3125a2a2437168ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679046630, "uuid": "82f44ccd-b5e4-485a-8e0e-dce5803bc395", "value": "T12D64294397E17C50EA268B73AE1EC6E8761EB520CF4977B6221CDE2F04B11B2D163716", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679046630, "uuid": "86ef4378-12dc-45ed-8ca5-06401a2b3a9b", "value": "abe3ddf8623240e0db2d6ab65f42f1d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679046630, "uuid": "9b6845cf-ba8a-4973-9203-d5ae0bcd90d8", "value": "3072:5+urjEdLrShg2wMSYKn/d/woFkeXnVeNsCX6QtwkXDpTqmI3zB:5JrjEdLuhg24fzk4p2ak5u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679046630, "uuid": "fd21655c-e69e-436f-9282-362a47b13978", "value": 308224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679046630, "uuid": "e8a65ce6-6735-4a3c-9d02-6c60a7a17a3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679046630, "uuid": "0789ad3a-8f5f-4a1a-b6d6-6ff5fcd7d2fd", "value": "6ebc3fb4b4f4d3fc09684d6723744dac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54612dfc-c498-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679039404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679039404, "uuid": "3b47fc5b-b29a-4b7e-bb9f-1a30df93a8a0", "comment": "Malware payload (Mirai)", "value": "62f0c9d5c5be18c636b6f45417d7ce49", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679039404, "uuid": "98b2d6fd-9fe8-44fc-9658-b04fa40e9428", "comment": "Malware payload (Mirai)", "value": "48f06d99e9e421fbe1bbf15640c27bae9b923ad07f83a7a62c7b28698b582163", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679039404, "uuid": "9f38106b-0206-470c-b399-38d10874efdf", "comment": "Malware payload (Mirai)", "value": "2a591b08dbd66290fa26a300e6c680781a4471da", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679039404, "uuid": "a36fc4a9-0fcf-4149-8feb-ca9e13935d9b", "comment": "Malware payload (Mirai)", "value": "cbdd789ff63a4897c2c6e71a633aba4514976f7b3193a863472d01c8f172ef00b07bb11711ee1c4baf45e067c66557ae", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679039404, "uuid": "993105c5-24a6-4b0c-a7c4-a43ac5f0e931", "value": "T153E31A56EB414B13C4D61775BAEF424533239BA493DB73069928AFF43F8279E0E23905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679039404, "uuid": "004389be-a046-403e-a0ec-3cd58c1a78e2", "value": "3072:qW2gksHkoGqafwGrW91eL/xS2dBpW77SYo1M/9LTNo:qW2g2qafwGrW90L/xDY77SYyM/9do", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679039404, "uuid": "5d651a1f-b515-4997-8eb3-3ba975f95f1d", "value": 146122, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679039404, "uuid": "f7096247-f69e-4ad6-b287-ae79e591b19a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679039404, "uuid": "d0603478-7cea-47ef-acd0-433df29debf2", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c3fe6b5-c4e7-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679073375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679073375, "uuid": "aeb94457-36fb-4981-bdc5-3a3d6f666584", "comment": "Malware payload (RedLineStealer)", "value": "078d86d1a2bd44e7f81d4cf6087abc96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679073375, "uuid": "4efc2d37-1546-4309-b300-97b6f8106f75", "comment": "Malware payload (RedLineStealer)", "value": "494db39c06a36c330ccbe854aae1d1ba184700610aea5a579e046e62c046d568", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679073375, "uuid": "240932a0-0c4e-4166-b3de-38398c1e4af9", "comment": "Malware payload (RedLineStealer)", "value": "5359dc82e34ac31250e98c2cb27b8c816164e54a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679073375, "uuid": "4d920f66-bb34-4912-b7ab-fa2166c6eed5", "comment": "Malware payload (RedLineStealer)", "value": "90a02712e55f1a675b5c6bc2f63d8c63fb2315f3f7a230721a42513b1f1c565d29789858705ebfa4d9e13270a6d1445e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679073375, "uuid": "cb120ddb-9737-4fec-9b3c-36dbbe9f90e4", "value": "T128845B4392E17C48EA258B729E1FC6E8771DF6718E89776532189B2F04F21B2C163F91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679073375, "uuid": "66b1f71b-0bcb-4ef8-a7dd-d6e3a9b9884f", "value": "6e76b494f1a9946f83b6b72033f310be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679073375, "uuid": "6e9818a1-5914-494d-aecf-3fec6d709566", "value": "6144:o/J0L2xisHQSWH3TmBpj4c7HjWfg38p7VAuPr+QA22u:qJ0QiswSWXTmBpjTggMpBTj5yu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679073375, "uuid": "9167e09b-ae5f-4bec-b7cf-01737a7b34d0", "value": 401408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679073375, "uuid": "c2eb3586-6cec-444f-9da2-95f5eef8fab5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679073375, "uuid": "4d01dce9-0262-423e-b6f6-a5730229f59f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e74e2f69-c469-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stop)", "timestamp": 1679019464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679019464, "uuid": "4653f649-cd11-491a-aa35-d15e78086e89", "comment": "Malware payload (Stop)", "value": "c479e029d48107168ffbf6cb881df926", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679019464, "uuid": "5894aca5-4618-4075-865c-8083e54cf8cf", "comment": "Malware payload (Stop)", "value": "49505420a8e71e6bd97c5ff658cb43239fd664eb750824cfed812ff1474b7b7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679019464, "uuid": "c2e1da9a-d2a4-4173-bd74-a88d1026e786", "comment": "Malware payload (Stop)", "value": "99a705989563c5b4511d2994d7340f7f3c3c72b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679019464, "uuid": "91949a28-69dd-4c00-b78c-c1c9516eeead", "comment": "Malware payload (Stop)", "value": "cdc77e4227d55d08459898d75cd8cc2620856aec297ece3b150a7cd3b796ceb9d5fd11cfc897be03562e9fb238e781c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679019464, "uuid": "99ac4835-63e9-4c6b-8459-5e41c2c099bd", "value": "T1F0E4121253E23C64F9294A354E2EC1E8761EF8539E78AF772314DE1F08B15A1C8AF395", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679019464, "uuid": "171b4d14-6b7a-4741-9b5e-271943c9d8bc", "value": "4b2faf5e2157c756cf2fd31d6cfd3d44", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679019464, "uuid": "7b9088b2-9ff6-4542-a3f4-f0e01fc358fd", "value": "12288:C7j6YgKPckpaglCTbmjTmM+uKvCReA44vnt0ZJgBshfypCyMa9z:gDPcglAmjTm3CoF4vt0XqC4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679019464, "uuid": "c9ad1e69-9750-41f9-9047-dad520f37dc4", "value": 698368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679019464, "uuid": "c2e7f340-19d8-40c0-954e-93508a99eadb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679019464, "uuid": "ca9b1bda-5be9-4d0a-8192-af910233067e", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2404b4a4-c4a5-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679044907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044907, "uuid": "cb79546b-e19e-49f2-88d7-3944e3a35fe2", "comment": "Malware payload (AgentTesla)", "value": "51c58dfea1c73629e07af8bdc813c9b9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044907, "uuid": "eb3f781c-78f9-4c08-a0d4-ed4b17a3c898", "comment": "Malware payload (AgentTesla)", "value": "4978dbd8c40bff5c01fa888ff9523adb19b70efeabf9f1453ba293d2a5afdce7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044907, "uuid": "d5e2fb9b-7377-4fa8-9052-5297b45c65aa", "comment": "Malware payload (AgentTesla)", "value": "22aecc96b7cf83b2d8585b24dcd77d2c2fccdf14", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044907, "uuid": "3750241c-9517-4b0f-8fc7-a6e9274da98b", "comment": "Malware payload (AgentTesla)", "value": "ac14d731abf53b2ae6ae1d29021ffd450a3c65d56148a04601adc861e6e76a70c9c8b3f9d97f11af584d65fab3d80e62", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044907, "uuid": "6defffe5-d324-44ee-8a3f-d096daf2b656", "value": "T104159E4483444F2CF6E0267D30683EC62F9158CCE9AEBBEF99A7D879B5E845517C6C02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044907, "uuid": "21f7f835-c69c-4387-baeb-f857bb11f34c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044907, "uuid": "b4a9be7a-3d8e-4505-8118-f3adae789607", "value": "12288:kNJO8lpXU5ZkXQ54KTm5E29OiQAvVzKlJhZSRrq2V5IbIZkrD38VLwbQji17B:kU54aAO/AtzSSRrq2ValSuj/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679044907, "uuid": "925fbac6-8675-4898-9532-f3e90ffb93b3", "value": 912384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679044907, "uuid": "3555f920-037b-4b17-aa6f-0343a4618a2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044907, "uuid": "c7e7ce89-3a7d-46dc-9f6f-9e4fefc6ee3f", "value": "51c58dfea1c73629e07af8bdc813c9b9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d3251a0-c4ed-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679075899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679075899, "uuid": "a9f96f87-bf35-412b-b7f1-4a5eb2b4bb97", "comment": "Malware payload (Smoke Loader)", "value": "d8763db9d9d38dad889c1ad40bb92552", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679075899, "uuid": "3520ba2d-513b-4f29-979e-0095fff4ade0", "comment": "Malware payload (Smoke Loader)", "value": "49d393dd5011f729861bba497ebc7a0fc1312dff59820659e922bf109dd66ac3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679075899, "uuid": "a6094f8e-3a18-446d-80cd-befc3edad57b", "comment": "Malware payload (Smoke Loader)", "value": "b809c19cdfbef05949a6cda91a4231c1f619fa86", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679075899, "uuid": "069d3288-5150-487e-98cf-166b5bb9eda0", "comment": "Malware payload (Smoke Loader)", "value": "0c8e7dbb9d24a94c87881e19eabb7800e08db1b69f8a7dda34be822c6658e820757be69516880d8fc8ab7f0ae67d2d72", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679075899, "uuid": "2d8d92be-2c44-41de-abf7-36ea009023c3", "value": "T16254186392E17C48E9268F729E1FC2E8771DF6618F89776932189A1F04F2172C163F91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679075899, "uuid": "b03dde80-6c06-4c49-9020-00c98e968e1e", "value": "967eb4f66af509da0d8ad27d2261daaf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679075899, "uuid": "ef5ccd45-ef29-43ef-902e-bd3d1eb59346", "value": "3072:b0FShgMLyXGoO2i3Mz/VKUHdCgH9ypQcSLizM4pdyxitigfuM:QwgMLy2og3MxzoQ4wLizMJ/gfu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679075899, "uuid": "9bef07c3-7806-49f3-85a5-baa5a60bcbf1", "value": 303616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679075899, "uuid": "2436ced4-0fa2-4085-b9f0-0a36b5220399", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679075899, "uuid": "363f0f7a-ba4d-4fde-bcb2-090fcb82fc37", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94dd1d8c-c51b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679095777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679095777, "uuid": "3b503ddc-6017-47b5-ad0b-b99a4bc593c4", "comment": "Malware payload (Mirai)", "value": "56b4e2c346cd581a726990537f1874c8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679095777, "uuid": "96af48ef-1181-40d5-8141-677322b35844", "comment": "Malware payload (Mirai)", "value": "49e2f510f57d6a4e5d2ba3fbf63e45e9778183112f2fbb09b118ea0a923f9555", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679095777, "uuid": "ccb1dffe-25d4-4d6b-8429-774eadeab3ff", "comment": "Malware payload (Mirai)", "value": "295ee157e6e73f42a9dfbfedd54cbe17bbc4db4a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679095777, "uuid": "eb152eda-a51d-4d85-9e30-6c9eb7d8b3df", "comment": "Malware payload (Mirai)", "value": "4ebb669a084578f453f9742511663a19e91c3f31b2097dadf141c418d100d159c5bf0a76ef988d55b05ad33d17ddefd9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679095777, "uuid": "fa326f41-1d80-4192-8466-ac9200b221c7", "value": "T14563F1F1F223508FF29B0733C578524A5149B66CFEA94B4A5E40FC5ED081E0EA857D9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679095777, "uuid": "b6eb0b11-b929-47bd-bc1f-846867b8076e", "value": "1536:rJqjSRAosVBFcL2cH5fY7W6KWSGIE9Pzf55BPKusnhR0oX:FquOEP5fYK6K3GIE/5Uu4n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679095777, "uuid": "6ed402d0-87e2-4fb6-a0df-af7c4b45815b", "value": 69428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679095777, "uuid": "8b18df81-706f-4b73-b9ca-3294461379a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679095777, "uuid": "f51cfb0c-9480-4b67-a2fc-4d206a2282c0", "value": "56b4e2c346cd581a726990537f1874c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9f6a261-c4c9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1679060701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679060701, "uuid": "d8a1f918-79f2-4bec-8dc9-abdcba81037d", "comment": "Malware payload (Rhadamanthys)", "value": "9d22b64d110d1e6711562b61abb42934", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679060701, "uuid": "84e5c49d-a36d-48ee-b3e0-3108560d3301", "comment": "Malware payload (Rhadamanthys)", "value": "4a032ce9dfb9bb82989ea0eb406deeae00778e3aef234b67a64ee713c7e7dba9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679060701, "uuid": "b192958e-ff31-422c-ac76-1ba4eddc51d2", "comment": "Malware payload (Rhadamanthys)", "value": "38e2ec3f6a2abe8481294d1e06f7de50f8cab195", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679060701, "uuid": "1535343e-019e-4420-aa06-0661017c8a6b", "comment": "Malware payload (Rhadamanthys)", "value": "db9e27f1d46dfea516223ff4398a76734fa00306cd4d47474b373e56d80d1510fdb64b02aff03b321bdac4dc10f16922", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679060701, "uuid": "f2940d8b-721b-4c98-a7aa-2a11c5b5aa0f", "value": "T193746C43DEE53C44EA258B73AE1FC6E8761DB660DF4977B62218DE1F44B0272C163622", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679060701, "uuid": "e8837fc2-1c05-43e8-aa01-bd2ebfc9b283", "value": "800c211657980cdb5c72386d0a0450fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679060701, "uuid": "bb3bfeaa-3f52-4160-94fb-9eca7fdff93b", "value": "6144:cJSLfGFu9AramzSsDiUOwxw+stB8b+Blj22Q/U:cJSKFCyOsfZalB8bYar", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679060701, "uuid": "961b8334-d84a-431d-8b3c-dff52a992025", "value": 366080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679060701, "uuid": "80301517-d056-4df4-a7be-45c608254eb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679060701, "uuid": "d85a0b24-46d9-43a1-b985-7b1130214896", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd4b0943-c488-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679032708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679032708, "uuid": "77a86eb7-1ad1-43b8-9c57-c5f7efa0a6c2", "comment": "Malware payload (Mirai)", "value": "d53db1c27d2af48e8990c5e2ac199da9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679032708, "uuid": "ee8db4b2-0d51-4b15-b7c3-7aaf99378e34", "comment": "Malware payload (Mirai)", "value": "4a6f87b7bcdeef09b1e23c0dfb423444286d533b2636377ea36349261d4dd31a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679032708, "uuid": "582d193d-43a9-430b-a654-971ec82c01c6", "comment": "Malware payload (Mirai)", "value": "e805b2c535b81d0994c35a052e1a336984bc83da", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679032708, "uuid": "627cfdd9-28ef-4a96-8f5d-ccbfbcf6d699", "comment": "Malware payload (Mirai)", "value": "6641736136173bc664e411065e0ca7b4d6a2b7b0ac9390a57379fea0f20d4cf95913c9122f2220f7beedc13f048bb39e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679032708, "uuid": "478aab2d-cab2-4c26-9ab7-eca8a1fa135d", "value": "T1D272D056930BCCD1D3317C3ADC2E42837B9817B494F53067B64A4A5C9ACD88A5AFE9C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679032708, "uuid": "6f649e06-7849-4290-b345-a97c4af59330", "value": "384:TALoRBrZGswHUuHxqooKbCIsLLiKWuh7qmdGUEpia8:UKSjRqcbCnyKWu9q3UEL8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679032708, "uuid": "02e0d713-0133-4a6b-b905-0e6dd0f90c66", "value": 17428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679032708, "uuid": "9381580d-5338-4c2e-83b2-9302a9a5b92a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679032708, "uuid": "0f6feaed-e56a-460d-a194-b67e94eb01f9", "value": "d53db1c27d2af48e8990c5e2ac199da9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e107198-c4f6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679079740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079740, "uuid": "aae1f38c-a45b-4aac-85dd-2003aafa15bc", "comment": "Malware payload", "value": "a56066a85878fc25f3dc586ebcdf3f47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079740, "uuid": "bebb11e5-b483-4872-ab1a-f606dfe8f826", "comment": "Malware payload", "value": "4aedc9bb0883727fe16c60d0338e652f27ae7c3e87435d6dbc762599981ba1f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079740, "uuid": "6e1bf20d-c4f9-4754-9500-97fb24bc2a68", "comment": "Malware payload", "value": "73f8eca32569931159c320163a00b4ccdc7c8e8e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079740, "uuid": "7aec8de5-3799-4806-ba75-556e77d76afb", "comment": "Malware payload", "value": "c3a3d9ea2038087b2781e8c692e508edef2bd616fd5a8eb85d11ba84cf5f17746b2865817fd42294423091bab4e52edb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079740, "uuid": "09c0e933-7891-46ea-b3ed-1697f11da04e", "value": "T14D166D5AA1A651ECD0BBD074822ABA07FBB1341D433059FB45E18DA62F17FE05ABF701", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079740, "uuid": "67b8a923-2d99-44d5-8530-b6c2ea4eb27b", "value": "49152:WzsIuyiqqfYWIkuMwtTbtNS/qPRKyQMdYUOtSZhCeLzMi34+B8SE6dcj8o9vMRRo:Wb+YOEGHxy4yOFvMo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679079740, "uuid": "c221e22f-e437-4761-a72f-f8e8cd9c3cbb", "value": 4384708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679079740, "uuid": "9bff1c81-c60a-42dc-8c67-1a17b4e24eb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079740, "uuid": "9bfcc0b0-defb-458d-b7a5-a1ec53ba3a03", "value": "a56066a85878fc25f3dc586ebcdf3f47.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89c212e1-c4a6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1679045507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045507, "uuid": "7ee6d6f6-97f0-42e5-bd6e-8e6f0fbcbd7f", "comment": "Malware payload (Gafgyt)", "value": "fd0f42bcdd23d58f14a88ed99d6c51ac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045507, "uuid": "2dde482c-15bc-42ba-bd0a-d789f1343342", "comment": "Malware payload (Gafgyt)", "value": "4b84c9a9df3574dc547aea9c9396621cade0766270ccc71818afaad4ab597246", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045507, "uuid": "d771da3c-ae23-4345-9e0b-62b866e0add5", "comment": "Malware payload (Gafgyt)", "value": "e84d0b9c19f0ec1701481596733e5332d1a7be23", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045507, "uuid": "b062dc1c-d9d3-4695-bd24-01da0d8274db", "comment": "Malware payload (Gafgyt)", "value": "e512d91758bfe2c45c6fffbeef472dc380651b7f1d626ace9ddc16459cb908e844df8f6b90915d997e3f9c28dd7ba4bb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045507, "uuid": "fa295bd0-a1fa-4dd7-9479-8858cfcaf31a", "value": "T1BB23E06FC3F336D5CC8D4C7BB1A5A2E12C257960B306575AAB75EDCCBA1A08B7814013", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045507, "uuid": "23e36b7a-5f44-43fe-88e2-f2add2a72716", "value": "768:fMZ//IivxQHZhHSOSy/HmS2GWTl3y/OUDcdtKTtJzuP0/5WRuHU9+GszE:fMZ/aH3SOXmHN+O6cdY7uP0lU8zE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679045507, "uuid": "4849e964-785b-4fc6-affb-a7d298b96427", "value": 45832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679045507, "uuid": "76486f6b-426b-4f12-aa8f-9e857a05bcea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045507, "uuid": "5d9b5984-13c7-41f2-a63a-b491674d3176", "value": "fd0f42bcdd23d58f14a88ed99d6c51ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b02d5993-c4e0-11ed-88f6-42010a9c006e", "comment": "Malware payload (XWorm)", "timestamp": 1679070482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679070482, "uuid": "a61ab2f2-6e78-4589-a7b6-be2be4a692b8", "comment": "Malware payload (XWorm)", "value": "8682c4dc2e3ae57079e9ada0943b813d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679070482, "uuid": "cb9db95c-6403-4c15-b406-91409e5e7edb", "comment": "Malware payload (XWorm)", "value": "4b9d11ad0a32fd2d76d4d8e9256f13df37b7628df9eb50b21dd11016d0a4ca22", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679070482, "uuid": "1e9052cb-4d06-40ef-846d-bdd5e2f4d8dd", "comment": "Malware payload (XWorm)", "value": "d855ac963756f24d67297c1c9b94b86d6e5350ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679070482, "uuid": "29c58267-857d-4045-8593-412179acc79b", "comment": "Malware payload (XWorm)", "value": "efd0bc1aa15836485cf22a6f81cf2eeb940d22b01f6ca00fdd754c2c00cdae2a33ff805aecec2dceb77d7d78f0ebe3b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679070482, "uuid": "9895bc94-a1a9-4cad-9ce5-4797d74d9261", "value": "T19A638E0C7BF58124E0FF6BB558E17296DB79E2135913D61F34CA029E1723A89CE026E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679070482, "uuid": "0f5a3430-ce5b-4d0d-9e89-0317f54bb831", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679070482, "uuid": "a0d239f0-d5f6-46cb-991a-c155c7ece728", "value": "1536:Yd077VI2kTksimD7A9sb0sBmaOu8EJSRK:Z9kT5imD7Osb0umaOuxGK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679070482, "uuid": "7e8f3770-4d8b-4187-b888-f3e0cf42b7fb", "value": 67584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679070482, "uuid": "9023808d-3f0d-4b5e-8031-4a050932383a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679070482, "uuid": "139b9268-5052-473b-9f62-f3265086c1a4", "value": "SecuriteInfo.com.Generic.Malware.SFL.3F6EC589.24369.702", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b32bb74d-c49e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1679042140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679042140, "uuid": "12a85865-7607-4405-a874-0659f42c1e42", "comment": "Malware payload (Loki)", "value": "060cc5a81752d5b1bf3421aae454b3e2", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679042140, "uuid": "73c91499-bda1-46c3-9f42-8cf710f767c0", "comment": "Malware payload (Loki)", "value": "4bef592cd8a16a4a32a5d68a8eb0d822928d501d8704c0b9f7b12372ac16c54a", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679042140, "uuid": "4670263c-2f03-4f9b-af70-b4bc4792ac13", "comment": "Malware payload (Loki)", "value": "14fedb2a4c87d22b29c8a092a3056a32a396c4b6", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679042140, "uuid": "5fd98ce0-d1c3-47d2-a2ae-4f27222c5628", "comment": "Malware payload (Loki)", "value": "36a75bf146803a076ebfeb874348085325b63b492d3963d0fa8ffb757369c67311d4aa84eee05fd8e9b7897c4fc4ee6c", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679042140, "uuid": "a195e83d-9a22-4816-95fe-3ec5a0e6408e", "value": "T17B45F12FA140DF4AD5168BB86E17F9E8121C7D10BBD4B5873681771F2F361A26AC72C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679042140, "uuid": "a259e1f1-04ef-4b0e-82f7-c5e7dcf4a196", "value": "24576:GLKNWQmmav30xv+KZl+KZw/r+o5an7+G1Oaw6nVh18pZ:GLKsQmmQ30UG15w6P1UZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679042140, "uuid": "d8a6cef3-7fad-4e06-b9c6-ef38a4193efd", "value": 1224192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679042140, "uuid": "5c3c4233-78c6-46d3-8205-fd16d9c251c1", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679042140, "uuid": "eb0a2034-8c20-4af9-a194-d31802624187", "value": "Request Quotation.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d64ea626-c4f2-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679078277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679078277, "uuid": "5dc7ece5-0591-4e98-8f47-1190856e9c3d", "comment": "Malware payload (AgentTesla)", "value": "5bdad991decf39d6212c22eb23e88208", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679078277, "uuid": "361697e4-bb3a-4e9b-b5d8-dcd28f7f5e3f", "comment": "Malware payload (AgentTesla)", "value": "4c20baaa49d158f53ab58c31f8d875fd4043b7d3eef9d4f18c986ec334002e9a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679078277, "uuid": "f3081aa7-48ff-4584-9653-729099e7e7af", "comment": "Malware payload (AgentTesla)", "value": "f440a2b3d6fc2e73edcb28f75e9ebb7d50104373", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679078277, "uuid": "530e0de2-22f1-4bf3-8749-47bbd4e34ee7", "comment": "Malware payload (AgentTesla)", "value": "86514920fc4215e67ae3fb16827a71297ddf686754eca8c4a2b8fcf636167220e54bd8f041e270fe3a43c8f9eb7acbbe", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679078277, "uuid": "a3c33471-0b68-424c-9e5e-1edcb64eee4e", "value": "T1F8B41245B560C72FDA9C76FAC0A5970053E86FB03432D21A6E397AD28A37743CD1C66E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679078277, "uuid": "271d21f0-f8fc-4d1b-afa2-36dcf625d965", "value": "12288:MNd66m+LwfbaVYx9kyOkH5YWpX00XpYCluMAv3npMovInUg6dqrlb:CzLwzaqx7HYEhNhb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679078277, "uuid": "863f09ee-1d18-4a74-96a6-995003d6ddfb", "value": 530944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679078277, "uuid": "9082590f-958b-42f9-997d-3cdf90f8623e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679078277, "uuid": "254746e6-429b-4d35-8979-1c68c799657c", "value": "PAYMENT SLIP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61a82157-c4f2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mekotio)", "timestamp": 1679078081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679078081, "uuid": "412be09b-28f7-48d6-b7b9-9bcf1190a7f8", "comment": "Malware payload (Mekotio)", "value": "ba3e9e13da5c3cd90bd729eabbd98c5e", "object_relation": "md5", "Tag": [ { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679078081, "uuid": "859feac8-d867-4bd5-b666-95bc37d8f0ed", "comment": "Malware payload (Mekotio)", "value": "4cbae49ea38538510e34c36627d4476c83334777bc514fa3e3b50cc2f75d87cd", "object_relation": "sha256", "Tag": [ { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679078081, "uuid": "dd52672b-46ac-4d06-a150-57ec495e76bc", "comment": "Malware payload (Mekotio)", "value": "cb0c3da0c99d5947b84b144427dce0918b12f466", "object_relation": "sha1", "Tag": [ { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679078081, "uuid": "80ef3152-836d-4be8-9365-aa360b98c14f", "comment": "Malware payload (Mekotio)", "value": "56328b20c588f6b5bf1e58866d43463d5128612b626d65847454295723f18bb26fb5445f9206aa1b86f9eca04013948a", "object_relation": "sha3-384", "Tag": [ { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679078081, "uuid": "f0cb149b-b78e-46da-a22e-089282a54bdb", "value": "T1ECE633B1219A4191F7AB07ADC115E94B71036C503BBAE81E8218C18D5772EEE3FF46DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679078081, "uuid": "d2e784bd-bf34-4759-afbb-69f3dfed5aa6", "value": "393216:IaYFe8Xr6jDRJpkXX9cdL0Qu/1CPn0kZvvrCPq07ADCioUykKT:I1our6DsmLFu/+0kZvvmimZnPT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679078081, "uuid": "82b302fe-3f29-460b-bc38-d93d46158671", "value": 15040542, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679078081, "uuid": "8c75929e-fed0-4a57-a960-28d9d5fff9e5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679078081, "uuid": "99eb5fe9-c6d8-4341-a1d4-51c36d669db7", "value": "mekpayload.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59a58594-c497-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1679038984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038984, "uuid": "1db7f2d6-c5ff-4793-b8ff-77d8a2a6a583", "comment": "Malware payload (Heodo)", "value": "d8ae235301430b167636c3b340753e1c", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038984, "uuid": "bf1ea16f-1461-4eb7-8365-766df327b8dd", "comment": "Malware payload (Heodo)", "value": "4d1b4eb3ece5fc99f45696dd41eec2ca7148319320f796fecb3a4258e6ec2998", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038984, "uuid": "afa6803e-3e4f-479a-a71e-f87928c2821d", "comment": "Malware payload (Heodo)", "value": "69b21fd95f9f3c36ef6b676e9c0314a22dbadc84", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038984, "uuid": "850fbe7b-6d8f-4e31-b1a9-9a360626bdd7", "comment": "Malware payload (Heodo)", "value": "1f0cee6316746c2dd482d38c1cfdf2189b73990aae78d7ca0ca83eb97944eb3ea51812b4f4875a3624a29a167004b704", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038984, "uuid": "9f36e40c-30d8-4a64-8f8e-a616fec7b464", "value": "T1E0C33BF1A8025C0AE123C976B1FB661399D051ED42283B2BF87D507DD978A20D5DD8EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038984, "uuid": "6bb5a450-846a-4c87-a4a6-84daf8f3c55e", "value": "1536:RDBoTVdaeNtuXndCrJJmT4HVnteV4FrdMiYcx7bfCb6HPdnXu:1BoC+tCYvSMVnte8ZP1Y6Je", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679038984, "uuid": "ed705d8a-5a21-4143-ba21-19e5b598a472", "value": 120428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679038984, "uuid": "8a2f5ead-4c32-400e-8f7b-752684449d72", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038984, "uuid": "64d42437-8e60-4664-9bf0-86f8bf64380f", "value": "omicsonline.net.one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7019f2e3-c4a0-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1679042887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679042887, "uuid": "d6eade65-ac8e-4cef-95b7-fa07e05f18d6", "comment": "Malware payload (GuLoader)", "value": "12703302b0d0854ad8e8fc590fada59b", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679042887, "uuid": "c5ae2827-f531-4187-a216-07de4394f289", "comment": "Malware payload (GuLoader)", "value": "4e3558094a3556f6b2c870b91c39d4bf62bd45c5f1ab67afb94d4e19205a2eb7", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679042887, "uuid": "46761954-86ec-49d2-9e71-92a16a4a3dde", "comment": "Malware payload (GuLoader)", "value": "49cbf4b0a439fc22080abfe9456dfcf545cdada2", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679042887, "uuid": "7b851169-6452-4470-be44-6d14f4462e78", "comment": "Malware payload (GuLoader)", "value": "e6b4ce4cb8ef90e5999b6ff4c07bf43c15fc289351cb21eb1053c91157233df7c3fb8c10414c9527fed0b726bd42d558", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679042887, "uuid": "cce4f734-5757-41c7-ae97-160c5a119d36", "value": "T18B6505609FD725197D3F1F9A9C4248C5F4E88DFB0E2201ADAD9A234E154225B837F63B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679042887, "uuid": "bd9aca53-d745-4781-a83d-28c73f521eb0", "value": "24576:XkG5YUgqmXqkw0pt7tkHs0bRSjSat4qPTcE:0d/qV4/tkHsidqAE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679042887, "uuid": "6856b0da-7add-43b5-81a3-89a09cd7f70a", "value": 1506104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679042887, "uuid": "1d6db549-0508-4785-aee3-0baca1b368a5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679042887, "uuid": "0368eb25-151c-43de-81c1-acb27cec9fbb", "value": "5573_Confirming_685738_Permiso.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e59b9f5-c496-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679038455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038455, "uuid": "7cfc0c73-83ee-450d-a17c-841f4d34d32d", "comment": "Malware payload (Mirai)", "value": "f20e380421a16e6b594cec99d770f67d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038455, "uuid": "90c11d64-c5cb-4d8d-9642-1e52289640b5", "comment": "Malware payload (Mirai)", "value": "4f0d1d6aa752a7b1d58e66a06da66655e853964de9762853af312facd920a4d5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038455, "uuid": "9e330553-82f3-4f72-bd18-05155c07dd8c", "comment": "Malware payload (Mirai)", "value": "8113ae8453acb177da4fd6bb66f69bab1c143738", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038455, "uuid": "34573445-880e-4697-a5cc-8854d591e0ee", "comment": "Malware payload (Mirai)", "value": "9c319cb59940b0dfba74891fda2bc1683294307d5b4eb900bdc6ceb6952798219648364b9ec3d4da50ff237d2cb73b72", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038455, "uuid": "58692071-30c8-4057-aedd-9f872296e283", "value": "T127B3F872B804DF66F00A96B504D38B367E30BFA70E6316A2731B39669D331D528A7F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038455, "uuid": "d0ea2e88-976c-4e55-9c92-e008c6c5a54a", "value": "3072:Ydg8GXIDvGIk1MG8+mjypvZYoamm/QcuLB1niDNb:YuFX0GIk1MHyphhamm/QcuLB1niDNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679038455, "uuid": "2492a964-677d-4884-a7d0-e859360ea343", "value": 118090, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679038455, "uuid": "638861ee-1ff6-4f81-b0c9-ca6e2502aaa3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038455, "uuid": "18e1e9a4-6b46-4126-b495-a3e73156b4c3", "value": "f20e380421a16e6b594cec99d770f67d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edfacc43-c4a4-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1679044816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044816, "uuid": "fed250f3-d1d1-4b3a-802f-f9c95ee776b2", "comment": "Malware payload (AsyncRAT)", "value": "843bab6d9df36499a5880621c9fd1cd8", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044816, "uuid": "991798ed-0fa4-4c96-8002-ec2d3994f2b1", "comment": "Malware payload (AsyncRAT)", "value": "4f441a6bb7bfd54af0c0fcc7f53f6afad3a126835f56e431f55ebde8a13a0965", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044816, "uuid": "ede6fade-cb0f-4e47-9a25-74bf65522b61", "comment": "Malware payload (AsyncRAT)", "value": "be304a8bac2c32617ddec972f73f617c7cd5658f", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044816, "uuid": "bb8e21b8-ac7b-4850-9024-524d4e37b44c", "comment": "Malware payload (AsyncRAT)", "value": "8b2affc6b59c1d425587999acc737a483071cff5f8602df995dbc90986865062ed9e3ee5f5aca105290c4ac5b392553b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044816, "uuid": "46f5838f-fe22-4275-b875-001930db03a9", "value": "T1ADC571862F888533E249973AC6E36A2D93E7F40CA656D2C334E957B7341A7035D31B1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044816, "uuid": "680f6d05-32d1-4e5f-8e7d-be0da4299948", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044816, "uuid": "22cf5e86-dcc1-4443-a867-416e05fce131", "value": "49152:WWsTEkwghTKv4jysGUqgCoOtt1JKtmqABg6ryUQtv:WFEkwghTKv4jysGUqgCxttsmqABRCtv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679044816, "uuid": "d404f05b-ff4c-4a29-93ea-9fb4d622fd3a", "value": 2720768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679044816, "uuid": "a127ada9-3f3b-4b99-b7bc-a59c23bcd10f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044816, "uuid": "9d2991bd-a749-4880-94fd-24b5288ac961", "value": "843bab6d9df36499a5880621c9fd1cd8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12da5fd8-c4a4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1679044448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044448, "uuid": "56b94979-aef7-4b7e-b475-1adb3ea517af", "comment": "Malware payload (Gafgyt)", "value": "493488ad2505dae0878c593629c7aa7a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044448, "uuid": "1572a40c-0fe8-4db6-aecc-68f66d42bdd2", "comment": "Malware payload (Gafgyt)", "value": "4f8f2ef5e513a858c637be04be105c567800b9e4dab6721053a16fef4ad07b9c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044448, "uuid": "99601091-ac2d-437a-84f0-a28f08826faf", "comment": "Malware payload (Gafgyt)", "value": "02d20d54a501d8b893640a78728770bb1298b738", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044448, "uuid": "b393a6a1-a391-4336-add2-a6fcd28b2333", "comment": "Malware payload (Gafgyt)", "value": "e175fae19614b6d5cbdecaf361da9345d93ed53a123e768c7f09384cee3b7743c7927934ea473fa7e152afdef7484e4f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044448, "uuid": "a80f3a52-cc80-4ddf-adc5-f90ef8237f8d", "value": "T1A5E38366BB619EB7D80FCE7309A64501118CDD4642D93FAFB2A0E51CE76B84F08E3E54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044448, "uuid": "7ed95193-d2b9-4300-89c7-b1ddc3855659", "value": "1536:bVeTpqCVvWRYx0O9vPBysZgvsgxqAz/0ufMytVYpLtaoLAImlP+s4zWfOodW:byvWmBx+sK/PflWgImlWs4zWfOodW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679044448, "uuid": "98433c19-ddb3-48e0-9b78-41bd0a03891e", "value": 152201, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679044448, "uuid": "62440473-906d-4cbc-a229-c3cd07fc6723", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044448, "uuid": "8bab6775-9e5d-48ec-b2a9-5f90bacbe94a", "value": "493488ad2505dae0878c593629c7aa7a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04ac928b-c4ec-11ed-88f6-42010a9c006e", "comment": "Malware payload (Kaiji)", "timestamp": 1679075348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679075348, "uuid": "6bae630a-0924-4873-9aba-ceac444b1756", "comment": "Malware payload (Kaiji)", "value": "3ce1c9ca35f30e69c9e161e49ea449e8", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679075348, "uuid": "e5b54b7d-48a9-4081-bc77-1d53da4dc393", "comment": "Malware payload (Kaiji)", "value": "4ff59cde02c4fffef74630c766c2e51ae01cf02403407e903af99d01c18da1a8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679075348, "uuid": "04c3cfdb-20f1-48c2-ba69-46802feacce0", "comment": "Malware payload (Kaiji)", "value": "bfad1ae8512173d41430063820951cc2a46a35be", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679075348, "uuid": "edcb5f0e-2076-4bc8-982e-72862eb3cfba", "comment": "Malware payload (Kaiji)", "value": "f440c3c52476c0d748a173babe77ca799168566e5d95853f06e3ef69bd54d25e7842180b67b3c0aaab03106ec43032dd", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679075348, "uuid": "d3f4a550-0b09-4d1f-acf4-c6931dcd482e", "value": "T15BB172CA0D47D4B2929A9E2662D451ABCC8461D3E9E51505F7CCBF330B78AA4F721ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679075348, "uuid": "f32fba05-3463-4ac3-a03f-ba58557f96a3", "value": "96:42sQC73wC734/jtxIAEzgsC/ofpC73gTA0zC/Jtg5/JGq:k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679075348, "uuid": "a6586e01-b824-435d-8823-0c36018d34d1", "value": 5170, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679075348, "uuid": "c7aad142-389b-4521-8594-7b00e4f93f43", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679075348, "uuid": "8c42c000-f5ab-4dc1-9898-dd56c16a609c", "value": "download.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "606005db-c4a6-11ed-88f6-42010a9c006e", "comment": "Malware payload (CryptBot)", "timestamp": 1679045437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045437, "uuid": "8ec658d1-ba52-499f-889e-61e9b7f3121d", "comment": "Malware payload (CryptBot)", "value": "edf17409efa144282021fcba2b1e5033", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045437, "uuid": "1c74a22e-878f-478d-9cde-51130cde79d6", "comment": "Malware payload (CryptBot)", "value": "50809992588189f6adbe6cfeb6f7c7f5c5722db14f73d13e9bb8eb1b92528710", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045437, "uuid": "f209db35-01c5-415c-acf4-b6ea857cfe13", "comment": "Malware payload (CryptBot)", "value": "62bdbc5f5c0dfecfd35674eaa177a829b0843993", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045437, "uuid": "88c3ce0c-81d9-4c41-86fd-8b33a1136946", "comment": "Malware payload (CryptBot)", "value": "2a6fea0514725c90ac9c8b001d85ca50384f4441cbcc9e6e388b60e19d904fa14f6592ccf8870760b81c76b474cd2707", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045437, "uuid": "57bcf227-e194-4422-8530-914f93efd1c3", "value": "T18E050262F8D6CCB9F02620B2872D8716676A7E710C77B45777E47D29BA3851393CB202", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045437, "uuid": "c9ecadfc-5641-431a-80b8-f17d9dd029e5", "value": "12288:hh9ZOqdRHEws20o6hG/MqV1D40X2cWQcPNvW0e784L08rwxCP5F0ZRKH:2qXkqkRScPN+r784LnwxwyiH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679045437, "uuid": "f86c4ea4-4b67-4d10-86ca-3f7704654b14", "value": 810496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679045437, "uuid": "31573669-6e84-472f-9f0b-eaf3d4d94ef4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045437, "uuid": "04c82e2f-2333-4151-be7a-4038b9717e1e", "value": "edf17409efa144282021fcba2b1e5033.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f022e03-c45a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679012686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679012686, "uuid": "78b3df52-8d35-44c9-952f-32bea5d1f375", "comment": "Malware payload (Mirai)", "value": "99c2b29b784b3e451805a2276069f5b9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679012686, "uuid": "6d27cf68-4733-435e-9d67-cd532c69a13c", "comment": "Malware payload (Mirai)", "value": "50e1ec724bed4bb883bef77aee46dc087bf613329162bcdc02b2132308b39236", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679012686, "uuid": "93bc522a-ef7e-4d2f-8e69-017da5776729", "comment": "Malware payload (Mirai)", "value": "4859ae864a53b32bc3b65e1ee1e290e331200b38", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679012686, "uuid": "130e7b28-bc7a-4fe5-a73d-4926d44f6d54", "comment": "Malware payload (Mirai)", "value": "06efeea2a77806c6af0ffebd90746a1075f7ee9122a09b03a1b04cb62dc3f58f41fd08bc3709a3da1f688b4112bc70ec", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679012686, "uuid": "a7f9ea7f-0f25-42b5-85da-bf7e6b1cd969", "value": "T15653F19023467EA884A17875DA2681D989A397F6D48FFC733322793C31470DCFE71696", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679012686, "uuid": "1134e9fa-3b13-4e9f-a539-336e16a60fea", "value": "1536:Sgifq108jppNoklF0dm+nS9MjcYL337fPKWzr/x:SNq1j9pNzuSCcYL337KA5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679012686, "uuid": "596c43b8-195a-49db-9f7f-3f824a2ecd53", "value": 64604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679012686, "uuid": "c9c79e82-a0fd-4215-a65b-4522a74426b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679012686, "uuid": "319edce3-a65e-4d43-b54f-632aa916e479", "value": "bok.arm7-20230317-0024", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a28bcf21-c49d-11ed-88f6-42010a9c006e", "comment": "Malware payload (zgRAT)", "timestamp": 1679041683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679041683, "uuid": "23518f33-5783-4b4c-b7fa-f471fa507a94", "comment": "Malware payload (zgRAT)", "value": "5946d4e01841f870de309c8c6ca01110", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679041683, "uuid": "b6b7f259-41b9-4c18-86b7-88867a7fc4d9", "comment": "Malware payload (zgRAT)", "value": "51447bd91c79ad117cc62f284e464a70c061af597ab9f411295634abb3ad7d92", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679041683, "uuid": "6a9bc0e9-94f6-42d4-be66-96df9084e6d9", "comment": "Malware payload (zgRAT)", "value": "c076d380eed80a3282312108ccf00efecf8cbf59", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679041683, "uuid": "bdd99f65-e89c-4b3a-8eed-81d6129c88ba", "comment": "Malware payload (zgRAT)", "value": "955ea1c20893c80b8777a5f41aff733f5b038969b57dd034c1faeab49c79c947043f036be2312cf3bd3935e50271cc18", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679041683, "uuid": "aa6bf617-56d6-4689-9d6f-e569a8f06b26", "value": "T19B618C1457EA0708F3F2AB3A69BE56554E3B3956ED32C74E0059414E52F1A40DCA3F37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679041683, "uuid": "fe8f35f5-d82d-4f78-8e99-90c9c89d6ea7", "value": "48:8wHabRU9Dmel0iglZ+EslpQfYj1sAT1rTRRSJxodgImcC:8wH9B0+E86YZsErTR0/ygMC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679041683, "uuid": "764f3218-08cc-460d-89cf-7fdfcf162575", "value": 3466, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679041683, "uuid": "3e1be6a8-a1dc-403f-a841-873514c0d23b", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679041683, "uuid": "62b79e1c-6d10-4ee8-a31d-a4f7200c607b", "value": "Design.png.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2099faf-c4c6-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679059318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679059318, "uuid": "333d2880-86c3-4bc4-9275-9b4156689210", "comment": "Malware payload (AgentTesla)", "value": "d14f277809ffcd649c7101bf7eac0270", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679059318, "uuid": "b5660da3-3618-4484-99f2-1f2518f4a08b", "comment": "Malware payload (AgentTesla)", "value": "518274b2c93caa2782cce928568da66ec7c8e0140929500e08503e883f7733ae", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679059318, "uuid": "90fac11b-c9c9-4616-90f8-0c3b01c2b738", "comment": "Malware payload (AgentTesla)", "value": "e5052ac628a7fcc23872668c9f6a1b901950841d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679059318, "uuid": "5867dbf1-d601-47bc-8007-7c57c3e1d50f", "comment": "Malware payload (AgentTesla)", "value": "edc807218d02c2a22fa3f1d1cecaeb0efec4f64583c564d0469393612eb70ebd5a26be332d82c31b5effe4cc71ae6121", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679059318, "uuid": "83584e48-efb5-436f-b2df-53cb1e7ac439", "value": "T1DD050199F326DB12C63E87FAB0B5646193F3945F5636E38C5CCF24EA6A62F900600D47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679059318, "uuid": "37c6e666-cd94-475a-bb7c-cf7085dd0c30", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679059318, "uuid": "824e9646-fc92-402a-a1b5-b4311c2768bc", "value": "24576:rWjkj+ZGQGT9/q1eycrsN07mzHU1tgrhMw:rWjkOGQGT9/q1JSsLI1tbw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679059318, "uuid": "88481ba0-1906-46c7-b0af-4a4036a634ad", "value": 866816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679059318, "uuid": "8da6e218-9f39-437f-a88d-8ca42ec9823e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679059318, "uuid": "18cf494c-249a-4766-9bc6-a4300c3853af", "value": "ORIGINAL SHIPPING DOCUMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f3ee960-c4f9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679081003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679081003, "uuid": "95b2fe77-59d3-434f-8250-34e2e774e8fe", "comment": "Malware payload (Mirai)", "value": "712f42d8f37447132b991ce8137c4a02", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679081003, "uuid": "8cf9271f-b953-4a97-a838-e3e3cfad4f06", "comment": "Malware payload (Mirai)", "value": "51850f6f0ecf2b8af907435db65084f41f8367c3fa8bf40d413ff580fe21babf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679081003, "uuid": "05e58475-b705-46f0-8393-bf8263f21613", "comment": "Malware payload (Mirai)", "value": "e76997ee3f5441c5d61c98c0b6a5319a88e5ff85", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679081003, "uuid": "1bc8eebc-72c5-49a2-bfe8-ef8758dd43a6", "comment": "Malware payload (Mirai)", "value": "c0f56422965dcc3c80450238b46a02c2878a1fc5df4eea243de6ba75a1e075ca81a90df71e356943fb4d25b5985ba3e6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679081003, "uuid": "570be224-ed94-45bc-8012-96bec44966f6", "value": "T168539FB5C5A8BD99CF698278B61488389723900565E33DFAE741C7A6D00BEECF00D7B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679081003, "uuid": "e5edb85a-1284-4dd0-9fa7-005de602f844", "value": "1536:B/bivQhunGauwt4IduhosjT1RYeycfs3QtLok1cY3CJda:BjiBGFOdOT1Rhf+Kn1cY3X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679081003, "uuid": "8a34d62c-9d3f-4091-8f93-33d55d3161ad", "value": 64348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679081003, "uuid": "b690963a-d416-4f0c-8061-147edee0637e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679081003, "uuid": "5d123ace-6b93-40d1-9ae8-95abbcb8775c", "value": "712f42d8f37447132b991ce8137c4a02", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09bbc9d5-c4e3-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679071491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679071491, "uuid": "8fed8d20-cbeb-4b8b-93d8-73d9ad202720", "comment": "Malware payload (RedLineStealer)", "value": "66982a9b92e51b0fa37953e61e12c221", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679071491, "uuid": "f7a62545-6465-4799-9bf6-2f0ec610c148", "comment": "Malware payload (RedLineStealer)", "value": "528b3cff028baa3990a895589ed4933cb9ca0f5451f6635329cfc46f6e9655f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679071491, "uuid": "951ddba4-daef-4b6e-854e-c717843c16e3", "comment": "Malware payload (RedLineStealer)", "value": "be7f1f5b5716f4e627d8dc6452ca5d3f208b91f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679071491, "uuid": "1fb81eaa-9844-4f8b-b21f-f383d9211417", "comment": "Malware payload (RedLineStealer)", "value": "e63c2e6907d3cda716d7777eeeab1f3896a34854722cef1d3ccc56145e22889615b61441ab9be77831acee9c43429d38", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679071491, "uuid": "abfaa491-0420-4cd3-bdfc-472b3bfb1739", "value": "T129E4124BB6EC8036C9761BB02DFA03D30A363E524B38836B275E695F0872564B17577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679071491, "uuid": "9d659bfa-a4e0-44ca-9210-9db78e0e2c6b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679071491, "uuid": "755cbaa5-8161-47c5-a693-a4b69f65e498", "value": "12288:RMr4y90Xw+GVYUfjbccDQDbMRAP88Zah8nXK18ZbwUnrdlWjP8gC39hnUXybr5v2:tyXNVYUncPlZaEaKEmWT8gCXUXwr1pA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679071491, "uuid": "94580ec3-78b9-451c-a0e6-0f4405cf167d", "value": 706560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679071491, "uuid": "6516fba3-b644-435a-9d06-b06573e66c94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679071491, "uuid": "2a3422ee-4b2a-46f8-a818-2077242dd17b", "value": "66982a9b92e51b0fa37953e61e12c221.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22d11393-c47d-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679027725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679027725, "uuid": "c450aad2-0f35-4367-9521-295f0d48e6e7", "comment": "Malware payload (AgentTesla)", "value": "8d30673384b0b1e9757d6ca4cf44b9b9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679027725, "uuid": "ef9e5f0f-ce13-4f11-8449-9e7afe7cde33", "comment": "Malware payload (AgentTesla)", "value": "52fa61df5567b0069577dff44111a00a77d641e8162360a548171632258a757f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679027725, "uuid": "9662ac06-1776-4b6c-90ed-c6ef9fa406f7", "comment": "Malware payload (AgentTesla)", "value": "572489d562d93bd057679075ee373556e6db1c3e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679027725, "uuid": "58ce2ddf-7f9c-4864-b29e-2a02579e0b37", "comment": "Malware payload (AgentTesla)", "value": "3a746c6dee753f76aad1ec069efddf2bc47e21759b4d5eb34df4114a35a2385f6d7ea64e3b7239df80033e1b4cb333a9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679027725, "uuid": "ec1d25c8-9851-46a1-a52c-d8a189113782", "value": "T1E6C401B320520A04D86492F0DFBEA6FDD0275D790D11971B8BEAF9C7AA790E309D13D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679027725, "uuid": "3a6b8601-a889-4555-a30e-a798a47e5a4e", "value": "7f4ccf92449463ab8fcf605c2ff08e26", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679027725, "uuid": "471f4f56-732d-416b-9cda-65e55e9461bd", "value": "6144:ndrWAmzRJ0x1qzfkYFwlCdlYEgO1dkjercA7fD3vFtKLjA3QoN:nJWAiz+1Q8YoCrYEtSJA7L32A3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679027725, "uuid": "6aeade50-1e26-473f-a47d-867b3de34920", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679027725, "uuid": "3e46f1cf-ef7a-4d68-b94a-44f23a76fb83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679027725, "uuid": "f22f5176-81c8-49bf-9790-fbdab7d83681", "value": "52FA61DF5567B0069577DFF44111A00A77D641E816236.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2aa59fdd-c4e5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679072406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679072406, "uuid": "b662bfc5-ce2e-4eda-b71c-148868ef9ae2", "comment": "Malware payload (Mirai)", "value": "0612af1d6408a61b134f67d1dba1f457", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679072406, "uuid": "f702eb7e-1c1f-467c-91ca-0cac6bb1a5d9", "comment": "Malware payload (Mirai)", "value": "536b7cc485cb97a944addb727f69eb5a0e3226ed347d10588362e2125fd8a720", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679072406, "uuid": "d94cfcbe-06b2-477d-b451-a6cbba63cf9c", "comment": "Malware payload (Mirai)", "value": "72c345ff8b1dd7160757391f5aa27adec19663ed", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679072406, "uuid": "947e932c-8b93-4f8f-a348-fe0f79c0c9fa", "comment": "Malware payload (Mirai)", "value": "b942eadc803d9e41925075385326845239880a3583d5b7721a055f64d0ade2275dbd05867faba8ae73e1eedd6f67a957", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679072406, "uuid": "1310ecee-d77d-4e10-8c88-33f82550605b", "value": "T18BE32B46EA408B13C4D61779B6DF42453333ABA493DB73069928BFB43F8679E4E23905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679072406, "uuid": "5f89b712-ac5a-4d2e-af8f-2aa9b8a0c20c", "value": "3072:IBK0/9ARZUhra5UOwRN++5pE7or1l2ZXUzEM/9QHRQY:IBK0bra5UOwRNt5pxn2ZXU4M/9mQY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679072406, "uuid": "e3c88b7f-1893-4460-bd11-38a2b917df85", "value": 150626, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679072406, "uuid": "9b23b9ce-6f54-4737-affc-3ada11638954", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679072406, "uuid": "80d64e78-b6fd-4ed6-a6f7-802c751864bd", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66cfd732-c46e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679021396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679021396, "uuid": "487c9be4-3eb6-4098-b9bf-d719b21e5a64", "comment": "Malware payload (Smoke Loader)", "value": "6c1f75e3e766e2178a84c2d58e453a3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679021396, "uuid": "81d39cf9-4d5a-464a-856b-536aa5076ac2", "comment": "Malware payload (Smoke Loader)", "value": "536e71d2d626e9236bd14ea6cc8a85d43aecaf1ef32dcfe470084697bf1e5ed0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679021396, "uuid": "118a1c3f-b51c-4d0e-a438-ae7ffd74e52c", "comment": "Malware payload (Smoke Loader)", "value": "feb00b3345ee3e4a501890a423bd38fd92df6479", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679021396, "uuid": "8fbee55e-5197-4cd3-98f0-0e104879b46c", "comment": "Malware payload (Smoke Loader)", "value": "32dd1c313b0a561dc8f46914e21515f4387fb581f3a24d6b115fbd5b6bec68f5fb3bdd2826039d15a9a0df27f7a4e4ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679021396, "uuid": "eaa1d382-e8ef-49b1-9a23-025e00a131ad", "value": "T1B4543B0393E1BC85EB2A8B739E1FC6F8761EF5608E097B6922289F1F54B1076D163711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679021396, "uuid": "422ec377-2fbe-4ca4-bea9-17b6779f3830", "value": "02bcb533fc6eab16fabdf3b7ff49a9d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679021396, "uuid": "6a1005da-3b55-43b0-b748-85dc81c3eb12", "value": "6144:H9TLv3sAivIo4uuz3O+3Q6MDUKpNXr7ZN6:HNL3shAo4h++bMJBr7Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679021396, "uuid": "91b98449-893d-49ae-be6e-2adecf15b300", "value": 306176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679021396, "uuid": "cb0db5d6-7480-45bd-896f-77415d8fa3d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679021396, "uuid": "6428e95d-2386-4fdb-b5a7-9a0d61c96cf8", "value": "installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af284577-c4ca-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679061031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679061031, "uuid": "2daed591-8cf9-4c70-9f22-745eb1b34cfa", "comment": "Malware payload (RedLineStealer)", "value": "23f292278cde18138db875431d56db94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679061031, "uuid": "cdd0168b-1273-4e00-a654-d1b6de9aa87a", "comment": "Malware payload (RedLineStealer)", "value": "5373ba1ec1e71eb138db374ab61c1e51f605f34a89083b9a802c191acb796069", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679061031, "uuid": "925146dc-bec2-4a8f-8487-3dd5f410e4e3", "comment": "Malware payload (RedLineStealer)", "value": "b8cc91cdf1aac62df73740b62e1388ab56113956", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679061031, "uuid": "528d2b31-b363-41ac-b338-350ee2fdad95", "comment": "Malware payload (RedLineStealer)", "value": "47bbbb35136ffab701291d5de8583b20e91b8e4fb35d9f503a8107da72e5609071250f7ea8ab9da68b49c3075371edbd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679061031, "uuid": "6fd5bcae-268a-450e-87f3-72f6da32d876", "value": "T11BB4AEA772546AB1E4D44C7B768F74884B63AC7ADC17D30A34E4B33B12BB3B58206917", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679061031, "uuid": "91c46a06-e036-4e3a-9f05-ed775133fd74", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679061031, "uuid": "f3536182-e91a-4bd1-9f74-2a5692319f97", "value": "6144:fxzuLpAXhnEf9xgc7g+E6Qitfz97jqVvzEHm4RUxXnd7wh1vSkxiiDt:fxSLahnEf9Z/r96hSmQUMt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679061031, "uuid": "ca63835c-c406-4976-847b-46871e48ccd3", "value": 525432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679061031, "uuid": "242142de-8c17-4027-bfe1-ce79b7f1a299", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679061031, "uuid": "10f5b290-8ee1-40b4-a069-934f0ffd5d3a", "value": "23f292278cde18138db875431d56db94.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23faf4f4-c4a4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1679044477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044477, "uuid": "59ff82e1-0326-4d18-9b08-b49c557a6826", "comment": "Malware payload (Gafgyt)", "value": "37fcd8c2fee30e81dc406239b57d6af6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044477, "uuid": "53937802-02a2-430d-b343-5e7da3ee291f", "comment": "Malware payload (Gafgyt)", "value": "5428f25eca62fd4ca6da0f8c826f0d32c1139583539b04dfc58aab512bc3796b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044477, "uuid": "b8345366-97e1-4a11-9713-a64c2c750cae", "comment": "Malware payload (Gafgyt)", "value": "f50b1f3ab6a5b4f95e73e10f846e25a8062bd66d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044477, "uuid": "45249933-4b55-485c-b6bd-5452e81e59a5", "comment": "Malware payload (Gafgyt)", "value": "6bf16bd2ed02fa1d5a39856748e907fb85768be7283e903ca7c9ed478f3f9ddee857f4eb903c2d732d9ce15b0fb1f7fd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044477, "uuid": "ce2ed47a-c632-48dd-815d-11170874a7fe", "value": "T176A32943A8618FB7C043AAB925B75D740763BD931F5F1A853128BAF4027B4CEB41EB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044477, "uuid": "f69182e6-f882-4691-a361-40f6e6abdbf6", "value": "3072:eSivnysXHvNdHUF/w/mMo+HWpbFnjnK6NO:eSivnTleF/w/Jo+HWpbFnjnK6NO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679044477, "uuid": "67fc1dfc-fdee-47ec-a640-e2084f6678cd", "value": 104356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679044477, "uuid": "ae6b3541-7885-4d2e-b270-1a9d96ac8abf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044477, "uuid": "376005bd-54bc-404b-8696-17ded800b2b9", "value": "37fcd8c2fee30e81dc406239b57d6af6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f5d46c5-c4a6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679045516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045516, "uuid": "fb12e021-886c-447d-9600-b7dd25df1cdc", "comment": "Malware payload (Mirai)", "value": "27ac7eb989b5216ceb8c126b625173ac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045516, "uuid": "f6466779-be92-46b5-91cf-d971caedcf91", "comment": "Malware payload (Mirai)", "value": "54467542fbabf6eea60d738acfaec115b59c596bec9ad4fccbb862b247e36e9b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045516, "uuid": "fb36dd89-43ce-40bc-92f0-89a1068a6be9", "comment": "Malware payload (Mirai)", "value": "a6adae98f627844b9db98ddfc91bf4b5b850e186", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045516, "uuid": "5f5f4c9c-b17b-40ad-90bb-8f6f78a0cba7", "comment": "Malware payload (Mirai)", "value": "fa47117d79a9ff3b8020fcb13739cb080ee8ed4db3178444a693642a59e9bd60dacc5283b36fea816fe1f3255a0526b9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045516, "uuid": "527995ab-6971-46e9-b1be-543aef408a09", "value": "T152730756B8814B12C5D512BAFA2E118E332317FCE3DFB2129E206B2477C696B0E37D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045516, "uuid": "03f9c562-6e29-4a8c-b017-e24a20c2e806", "value": "1536:2lnHaxP6XkC/zTkS7IDHtfMwo8K2ta0J0GIgi/z3KvcIc+5UYIWUj:nxiX1Lgbtfbxtabz3KvcIc+uRp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679045516, "uuid": "7a772d94-8fd2-4b54-889e-3bdc18cdcda3", "value": 79160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679045516, "uuid": "990455a0-a2f4-406c-ac6a-d7287d3673b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045516, "uuid": "f0b6167b-ae2f-43d8-8c0b-84c28977962f", "value": "27ac7eb989b5216ceb8c126b625173ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22deb36b-c496-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679038462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038462, "uuid": "2c6418d2-40e1-4483-b195-7c823bede514", "comment": "Malware payload (Mirai)", "value": "b069841e407cc5714215b0b7c4b2ae0c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038462, "uuid": "63582902-01c3-4a39-a579-c5db68151448", "comment": "Malware payload (Mirai)", "value": "5469760732519bff25afdcbe4c79eae1c3cc80e8c3575831a6d80af315c86d72", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038462, "uuid": "9559235c-f0f6-4028-b596-feb7e1f4224e", "comment": "Malware payload (Mirai)", "value": "1bfe67df0649ba5561a47650d89c5a6e63c1e8e5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038462, "uuid": "4dfe2c38-9803-4209-830e-6a46012234b5", "comment": "Malware payload (Mirai)", "value": "31e71afb110b2e85cef09d822f08e6478a35a420e761126b327eb5187d2ff358c44477983d0f6f89cc0300d21297a1c8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038462, "uuid": "0497cc41-69cf-4a24-84e6-99eacf68e502", "value": "T1DAE3A53E7A11AFBEE168827107F29F70CF9529D326A19381E26CF6185E7118D0C9EB54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038462, "uuid": "63d81ad1-dab7-45c4-a39f-eb2f8762c0a1", "value": "3072:JW6dm9tS1aRGQdK76t/zCEI5mrThPaLEnvPrNb:c6IG+LC5mrThPaLEnvPrNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679038462, "uuid": "29ec8b4f-c9f9-4fe6-96f2-62657a4e3ae1", "value": 155428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679038462, "uuid": "eae1e1c2-d601-4b56-a379-e4d28d731057", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038462, "uuid": "56cd1f79-418e-44da-8633-2dd8f7a2c1a6", "value": "b069841e407cc5714215b0b7c4b2ae0c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa9769e1-c4d0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679063601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679063601, "uuid": "9cd7d933-4c22-420e-9242-d27a0e1c7025", "comment": "Malware payload", "value": "08c68f12dbe2df415a2ef242d5cf80a8", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679063601, "uuid": "60ecb5ec-5c9f-429f-8b4b-1125eeb4e274", "comment": "Malware payload", "value": "54697dba6847817b0fa8328c43b0944e7e86d4ece9e697a68c77b241620da70a", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679063601, "uuid": "df1a48b6-d6e4-4a47-9016-3f35f3e71e62", "comment": "Malware payload", "value": "08c7a732bde73e5c23c38be461d0df029b97330d", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679063601, "uuid": "08ffc942-fa1e-480c-8793-22a57f6ed85d", "comment": "Malware payload", "value": "32d104efc31babd04ed22d3c031a46857ec5cd2eefaf7bfe1e6b2e8de0afb6ff8f44ff6feec40fd3223f21c8f0161e5e", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679063601, "uuid": "3fbb7e3f-31dc-47b7-ba89-608bbf296a93", "value": "T1A02286734FD673150F9A22BCA36A51CEED10B1D82325EB7DAC3B825BA54C4506933986", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679063601, "uuid": "67e771b5-a7ee-493e-b0e2-acb4a8f28cc6", "value": "192:bxS5NKeiY4reklA1XYJNS7hKEYTUgnUdM+f//NNTBJDkjZ2iaaNmw5210fc:QHKlqTApRUgEMA//NBvt7aNmw5210fc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679063601, "uuid": "7d82af80-3faf-45bf-8006-704e72985f0a", "value": 10569, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679063601, "uuid": "1911eca6-d715-4cf4-89a9-8720dbddfae7", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679063601, "uuid": "46b85b37-3e1a-4bfc-96f6-da04e499dade", "value": "Aliquid.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9906ae9a-c481-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1679029641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679029641, "uuid": "f2553860-91bb-42ae-8bc5-7fdb317b1987", "comment": "Malware payload (njrat)", "value": "59645ca85405fac3881899a293149272", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679029641, "uuid": "9201da5b-c50f-477a-9ddd-8e4c6815feeb", "comment": "Malware payload (njrat)", "value": "546d7be50a9f2e5172fe46d3e20031f8d743d1f1cca29a432dfa3df9d109e292", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679029641, "uuid": "50f7a6d4-d81a-4253-8f69-cb40eb13eee0", "comment": "Malware payload (njrat)", "value": "a6fe815e16b0f0dbec37b553ec1d7ff4ac97f08f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679029641, "uuid": "7fc4cce0-a6a0-45b8-ba8e-1873cd7c5395", "comment": "Malware payload (njrat)", "value": "abc3eb03cd7e01d087d965cf6bffffc79236ccaa305b5470c4eb2a113a122eb6c051e83cfbca68efeed4504ae7751a89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679029641, "uuid": "ee4aedf1-8b96-47b6-ae22-5625f887e8d1", "value": "T138B21A4E3FA9C856C4BC177486A6965043B0E1470423EE2FCDC560DBAFA3AD91D4CAF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679029641, "uuid": "02511c82-d945-429b-a2d0-841855a008b4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679029641, "uuid": "8b6f9700-eb80-486a-a7e1-291b258e634c", "value": "384:3oWtkEwn65rgjAsGipk55D16xgXakhbZD0mRvR6JZlbw8hqIusZzZMo:Q7O89p2rRpcnu6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679029641, "uuid": "4c4ba7f8-20f3-44aa-97f2-96118d87f059", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679029641, "uuid": "3eeffc07-087e-48d4-8d43-7fca584f12da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679029641, "uuid": "c753439e-15ed-4ee3-97aa-6b80c3256077", "value": "bK7F.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66e56223-c4be-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1679055756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679055756, "uuid": "e84a7c29-fd2f-4e4f-a449-d4555caa9891", "comment": "Malware payload (Gafgyt)", "value": "acdd6776c6953637fbedf853aee63e29", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679055756, "uuid": "1e7708e2-b83a-4176-a69e-48dce8921dc3", "comment": "Malware payload (Gafgyt)", "value": "54de76bda7162a55c8b05fec7c1ac153ef5135abaf9fc8abbdb3ba79be0b26fd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679055756, "uuid": "6361a458-d025-49a6-9421-0adf8034388d", "comment": "Malware payload (Gafgyt)", "value": "87375c7d61075da9060f7f91010cdd763d3bc5f2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679055756, "uuid": "b7374130-691d-4b98-9b99-d8dfd8003ffa", "comment": "Malware payload (Gafgyt)", "value": "939c3b13af270fbf678486c228279f0d406aec48b55f8c54bc6b0cbda0e8e19c6cd172fa2212a6b9e15d6a314054a8d1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679055756, "uuid": "d760acf2-7156-4b18-b975-21fcbbdad901", "value": "T171C3093B7B270A23C0D9507102E31332B9B9DE5938BA43D7A9D07D9C6F3A58834567E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679055756, "uuid": "e37a41c0-7f3f-47c3-8980-9c9b705fa861", "value": "1536:ctrv5GE2dFg8aI0DN95P8tf7PJtAZRdc0sfm7ypwYujl3IdnuW:ZP0DNPAk5sfm2pwYux3I5uW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679055756, "uuid": "89701271-4751-4106-b62b-0544013adcf7", "value": 126446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679055756, "uuid": "11aef124-87e1-4a2a-8ab3-54af8d9faba4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679055756, "uuid": "68bf6fe3-6207-473f-88e1-5e6c6a575bf7", "value": "acdd6776c6953637fbedf853aee63e29", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9024c66e-c4c5-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679058832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679058832, "uuid": "462230af-3d61-4658-b044-b515b4ea6125", "comment": "Malware payload (AgentTesla)", "value": "717ba9f7a1f37f2f195e185f1720c6cf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679058832, "uuid": "325b62bb-ab41-4aa1-bdb2-d10955939da9", "comment": "Malware payload (AgentTesla)", "value": "557d9da6717c493fc55fc70978a0d966607f099785877d626f6389571fb553f7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679058832, "uuid": "612b7424-0331-4750-855e-7a6ea6d4a46c", "comment": "Malware payload (AgentTesla)", "value": "d0a3cd8243ae571bca3b9661d378558d0541895c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679058832, "uuid": "11d6daf5-0072-4230-9f30-256caaa3d99e", "comment": "Malware payload (AgentTesla)", "value": "35996584d5b4947a8f82178087293bb4f4f5619f0408fa9ead0620a4a255bf8d55bf9254f6044231cc07e75f58bd17c2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679058832, "uuid": "12309d54-f39c-4ed8-8030-88b934383e2a", "value": "T11305014CB9E8A914C92D0B7B90A3316093B6461B8F81E70F5ED206F62F327C7D585D6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679058832, "uuid": "61dddd07-ce9f-43f8-a5b2-20b7cc1976cd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679058832, "uuid": "7ae6b65d-1b35-4786-973a-70651d5a619d", "value": "24576:PhQwc2zs4XEwSQLyj7ldLGLsg9dbc2SZQ:G2Z04LUrLGLdbc2S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679058832, "uuid": "ff1689bb-ddee-408d-885a-826c4906a064", "value": 815104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679058832, "uuid": "d368a1ce-7521-481e-bc0d-5caa2299215d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679058832, "uuid": "919a48b0-f1ea-4c66-8c8f-798ebcf04fa6", "value": "Shipping doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06052dce-c4f5-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679079216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079216, "uuid": "a879be86-45b4-4134-841e-22040263ed60", "comment": "Malware payload (AgentTesla)", "value": "ea05f7ce4998ed1cdbac10b0f19fa433", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079216, "uuid": "29a637af-e736-4ef2-9d7d-c81edbcad1a5", "comment": "Malware payload (AgentTesla)", "value": "575e4f0b824a7928e47d8eecd646b7aed2355ae8a1f85175b6ce092e26d43854", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079216, "uuid": "1fbc1cba-29d4-4ef7-a9f5-1b2475e711d4", "comment": "Malware payload (AgentTesla)", "value": "4a2b0b22314d8b83a266ac66eec5b3c07c3186d4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079216, "uuid": "c8117113-a40c-49fa-8a47-48209d39a832", "comment": "Malware payload (AgentTesla)", "value": "594e0a15e3411db35662c76e48581fb9d94f8b179d729633b01999b856e0b217c519082b878ec5baf2f0b915dd781ffa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079216, "uuid": "31a96777-a813-45aa-98f6-a50b091fe990", "value": "T1DDB2D76AE74B0275CF4261B6930A1789566DF13F725540F238AC923833BF81AC6776BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079216, "uuid": "cf1d1c9e-9596-44be-b1a1-9583c4581947", "value": "384:oL0AbZSnp3h31P4XdJavhZrVxm4sUpQZnYD7zoHRfgbSyqP0/k7b8fLjtk6j:owAbZSp3h3d4tYv3VdsUprDEf8rk7bi9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679079216, "uuid": "12f668ae-7d1e-46de-9cb4-3ea8c0876fec", "value": 24092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679079216, "uuid": "f7098817-8e66-4214-9465-62907483f332", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079216, "uuid": "88d9d534-38e7-487e-b922-8a9bbcbb3533", "value": "Bank Slip- 701536.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b00a4c3-c4a6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1679045536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045536, "uuid": "9d73fa1b-1a6a-418c-b20d-d9201ee6a193", "comment": "Malware payload (Gafgyt)", "value": "31c076acb2215526a80047c5363e6917", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045536, "uuid": "e3b8332f-54e2-4874-83db-3771dcd1a1dc", "comment": "Malware payload (Gafgyt)", "value": "57901f951bb82861430c4a80b25037836a7790aae62d31543d6724a09c4693a7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045536, "uuid": "78d3d12c-aa7a-44de-9d13-6b70807b2c5a", "comment": "Malware payload (Gafgyt)", "value": "e27cc2093e9b63ef8864b399211f7bd84d79e432", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045536, "uuid": "17ea7bdc-92a0-4788-b803-627beeb4925f", "comment": "Malware payload (Gafgyt)", "value": "bff8632d7041b458cf5889ae5cda71448f4a8ed297f0ffd1f93913f265c3b55f8687f41c9ae0018e0f578ae09db37245", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045536, "uuid": "a0fa5b0c-0798-44e4-ac68-5033359f5e0d", "value": "T1CBB30892F900DFB6F40AD73604D74B247630BFA24F9326267327396AAE361D52827F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045536, "uuid": "eca5b56d-f3e8-4506-b30a-880b9406a382", "value": "3072:iMSiAwapGmpnGwGHONyDVRDdDqAimmi/Wpb8XTnKTNO:iMIpGmpnByDzDdZimmi/Wpb8XTnKTNO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679045536, "uuid": "041c1d24-9675-4995-b3c4-9c43af40f435", "value": 111578, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679045536, "uuid": "484b885d-4acb-4c02-aa1a-415616afb5a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045536, "uuid": "8d034db3-2804-4965-b05e-1004eed9ff58", "value": "31c076acb2215526a80047c5363e6917", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18bf84d1-c496-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679038445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038445, "uuid": "1e7887e7-c133-4f91-8458-522f2aa5bff4", "comment": "Malware payload (Mirai)", "value": "0c3d821256f95da1966117055df100d3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038445, "uuid": "cf627ae1-4d24-412e-b90b-5b879c79442a", "comment": "Malware payload (Mirai)", "value": "579dfedda32746eba67bb8251c358c8db4329e3706e4cb191a2507add1ec2787", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038445, "uuid": "c8cd566f-a105-4f42-9e62-3bf749a59e45", "comment": "Malware payload (Mirai)", "value": "ce392f859951952709e65fbadf317fbde83328e4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038445, "uuid": "2cda5350-44f7-46b8-8029-15a5ea86d92f", "comment": "Malware payload (Mirai)", "value": "822693a5b38834555c28d4e8ebf47bc0889bb67b837afc1d9ce664d2f90ee6b5c285c474ab40c3baedb2d1f6b7d5441d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038445, "uuid": "0c739c80-6c3a-4727-bc1e-0f47df75292b", "value": "T12EE32A30D4504B17C2D213FAA79E825E3F221F9793DB33115B38BAB41FE279A1D69924", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038445, "uuid": "ecd6026f-8338-49e8-b9e9-47d695062877", "value": "3072:Cv/WwsLgaq353qHiCOvhOpDqkDQHbeskmhxQwoVSUNu:KPLaq351hOpDqkLskmhxQwoVSUNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679038445, "uuid": "164fab7e-8eda-4a6c-839e-f8f3695d9324", "value": 143019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679038445, "uuid": "a0820e2f-00fe-4d6a-b2d7-f114b585055b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038445, "uuid": "30e028f9-9636-4ef6-95af-8da4cee62661", "value": "0c3d821256f95da1966117055df100d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "577815c1-c4a9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1679046711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679046711, "uuid": "d6fac64d-3722-4b5a-90a4-3d9014cb2831", "comment": "Malware payload (Gafgyt)", "value": "a0dc8b2df7b5f60bfd453325a35c865b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679046711, "uuid": "2b1b5f63-8032-42b5-bb13-1effaec7e292", "comment": "Malware payload (Gafgyt)", "value": "584605556f72046fae7699f16f9cc419b43cf2b0189337cf6b634a048813f9f9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679046711, "uuid": "b56e448f-024c-4749-9f24-038f39000405", "comment": "Malware payload (Gafgyt)", "value": "7620adce999fde4f8242debd8eb8260076924671", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679046711, "uuid": "7efd3528-81ed-4e55-9b37-95ac36bcf6fc", "comment": "Malware payload (Gafgyt)", "value": "73e0be4efbddeb74722b005f429ecf16c5b46d364fd8c67f4406f296daf20901566911aa31c883041458a051674a8829", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679046711, "uuid": "aff56059-5325-4b99-a742-6750e8484e31", "value": "T1F353F217CAAE4B1362F818BCF1FE06531158737EED53B03A8666D5C768825D37BE9900", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679046711, "uuid": "73653cb0-bcb2-4e98-9a28-ec4883bef54b", "value": "1536:tVHAV60D5CQhduKXSTyItZ9rZFU9qCxd7a1:tVHUtCDDrZF4qCLE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679046711, "uuid": "e669d71c-7154-4f92-a690-d28c946150c2", "value": 63768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679046711, "uuid": "a5c81b73-6612-40b6-b3e1-4276475e644e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679046711, "uuid": "1559a7c4-b9cb-4c79-9adb-f78e497aafa2", "value": "a0dc8b2df7b5f60bfd453325a35c865b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94e78b7a-c4a6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1679045526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045526, "uuid": "63a6228b-8f5f-439b-8006-799c76209a03", "comment": "Malware payload (Gafgyt)", "value": "b7410decad0b1ca1763866da6d973492", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045526, "uuid": "0b434ea0-730f-4dff-8143-ffc5f1d0e12f", "comment": "Malware payload (Gafgyt)", "value": "58544c00edea509acbc373a3629268849e4e7d066b372d819f9d45ddb1c4f31f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045526, "uuid": "b6f181af-25e5-439b-bfb9-d2b2529bd805", "comment": "Malware payload (Gafgyt)", "value": "38839a72daf1a25f1c508f8c3f127c9ca7b0f7ac", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045526, "uuid": "7e4f822b-9675-4f08-bfe4-7054fbd7dc5c", "comment": "Malware payload (Gafgyt)", "value": "7a2504ba24a0eb732ab0cf52d33d426a684703ff3afa9e118bfe653266b593f9503608cc33997d2667c02fdc1c64d8d9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045526, "uuid": "4c4abb47-530b-4244-b745-3c24239bb100", "value": "T165731B06EB43C6F3C8430AB506A79B664531FD2A4E2A9F59F31C7CF8AB124D87217355", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045526, "uuid": "896a8e04-b26c-4242-824f-a2b1f71e0ed2", "value": "1536:yVxMrT7vtgW2CvPAaSyAuWPuqqkcyEnmx+LVO049unnuY:OMrT7vuW2CXAaoXWzjyQm4LVO0iunnuY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679045526, "uuid": "30b232cc-ebe0-4acc-ab0f-593d8d6d8860", "value": 73575, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679045526, "uuid": "c68f6d61-0228-4611-822b-e2fded41544f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045526, "uuid": "18c62cd9-b03c-45d1-89e5-e67a4b8153f3", "value": "b7410decad0b1ca1763866da6d973492", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54bed71e-c4df-11ed-88f6-42010a9c006e", "comment": "Malware payload (AuroraStealer)", "timestamp": 1679069899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679069899, "uuid": "0b07a751-643f-45f1-bb57-8f8fe7e7d29d", "comment": "Malware payload (AuroraStealer)", "value": "d442830fc92de9465d9bf425922173a5", "object_relation": "md5", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679069899, "uuid": "33c62f69-a405-4cba-a51b-dcb1d7374161", "comment": "Malware payload (AuroraStealer)", "value": "5892a93d287a1e4bd97fb09b79b6e2af5643103511f3678c8212ec803ff3b449", "object_relation": "sha256", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679069899, "uuid": "bfd615f2-5b7d-4ad6-b6e4-54f75c344a60", "comment": "Malware payload (AuroraStealer)", "value": "27eaed777470e6a9f855894b2af3c7baa1c812eb", "object_relation": "sha1", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679069899, "uuid": "97120fa3-3e00-44e7-95d8-e25b62b06a53", "comment": "Malware payload (AuroraStealer)", "value": "0414781dc1f28028ba42691efede482a21ace38196009ca13563b25ed717250461b1954ccb7543e9da16f4e2c534f9d1", "object_relation": "sha3-384", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679069899, "uuid": "a689fe43-7dd7-4ea9-a6f3-a89f9ab93044", "value": "T1363612BAB9E5FF0AD8778538C560B335D12A9C129253850DD3DB3210BEB27EC2D86D58", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679069899, "uuid": "2a20cda3-2ca8-492f-98fb-e0797631ba39", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679069899, "uuid": "5a9a7451-3def-4363-8516-71bdcd4e0c9f", "value": "98304:9j3/I9FTuPXPlGUi317EPTiu0ENWS5ywGDZHU:9/MF4l5GgUEMSrwU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679069899, "uuid": "b6d62fba-b9ca-47a2-a85d-f1c9ee204a82", "value": 5018112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679069899, "uuid": "2df8182a-9829-4aa7-8766-288539719916", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679069899, "uuid": "c0872c51-08e9-4e4e-b84f-24e799879cc2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61510cc9-c4a9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1679046727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679046727, "uuid": "c3df40ca-4ee1-4a7e-aeb7-cc97e5ffaa7e", "comment": "Malware payload (Gafgyt)", "value": "0f5c866de13bcda6811b763b355d2aa3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679046727, "uuid": "11f2c177-55fd-42f5-be30-a575a002014e", "comment": "Malware payload (Gafgyt)", "value": "589a571d28ba2740847efc2bf58577978dbcbe22bd80ce73d4fda707f476cc93", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679046727, "uuid": "6908726a-fc39-4044-b15c-da4574500f18", "comment": "Malware payload (Gafgyt)", "value": "4ec6c262e0379a7a85824f1a5dc002b61cb0b5ce", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679046727, "uuid": "f19fe900-a133-48a4-94c6-bfe2940fc641", "comment": "Malware payload (Gafgyt)", "value": "d829344728b5f739d1bc988177ccdb382e76dcd7c2145c9fb494875f0fa0805dddb54931420b33ea6e068ffc41cb4069", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679046727, "uuid": "66d9e53c-23fe-485b-b7ff-d08a381dc804", "value": "T173933B56A780D5B3D14305B316979B620033FE7B1A5EAE0AE35E7CF18F390987221B5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679046727, "uuid": "72387260-4120-45ae-8fac-f72bff4e6211", "value": "1536:msqmQTbw7U+OU0Cf5UI8E8WwP6kHzgk81VwcG2em2GMUNLe5um7WAgcVjmZIcBI:msi2UVUtBUI8GwPfHkk8r4eLesmqAgcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679046727, "uuid": "07dee811-fb94-42a2-b425-021d8b2d66e6", "value": 96268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679046727, "uuid": "a2802ca4-21bf-44da-b5c3-79e2bbe84c33", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679046727, "uuid": "d12a3e28-f3ec-4e37-a6d5-0c2fbef35bbe", "value": "0f5c866de13bcda6811b763b355d2aa3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42f01190-c4c7-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679059561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679059561, "uuid": "db88139f-1220-4a30-b9c2-757dae6b8361", "comment": "Malware payload (AgentTesla)", "value": "0ce21d037edca8258e42daf572de4fe6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679059561, "uuid": "2a77e0b1-3bfc-4e2e-8db4-fbad17d529b4", "comment": "Malware payload (AgentTesla)", "value": "58d36f362adeee043760e5ed367b54e3dbdf4c4022f12d1c88f923f286d1f301", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679059561, "uuid": "b22b62e5-7ac8-4377-a57b-551d00971ab2", "comment": "Malware payload (AgentTesla)", "value": "1c8c98c3d7c0b0a8721894f662f6aeba484a8b4c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679059561, "uuid": "1583651b-579a-46f2-8a07-c46b6837d259", "comment": "Malware payload (AgentTesla)", "value": "63f87de2ece9a632db9b7615370be5ea7cd3f607870c558ea0f5d2b5e89631bd6e8113e9157461a4b271c668fe1f6c03", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679059561, "uuid": "5dc6d82d-24e2-4f70-b780-88e66e37ae7c", "value": "T1A115124C62AE777ADA3D33BA90A1140443F1AE21A616F35F1DC261E30DD3BD6D842D9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679059561, "uuid": "a89d177e-dc1e-4b63-b138-7cd91a7f96bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679059561, "uuid": "fc54b3cf-4efd-4296-b344-9679e7bb7c79", "value": "24576:PA2JTJXQmKVwILgfAmtPJIU+mzDOBWs7x:PhFJXjKyILgf9JI1muBb7x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679059561, "uuid": "18b06a6b-16ed-4ace-9d80-cc42ebbb655c", "value": 929792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679059561, "uuid": "664f4a49-5e84-451a-a59e-e5688ea23c78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679059561, "uuid": "440f211f-c1cb-4214-b031-dc3fbb33ada2", "value": "4EJ3mCLR01kwHtR.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d9788a8-c51b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679095764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679095764, "uuid": "1cd430e5-d0a3-4e5d-bccd-f9858386a2ef", "comment": "Malware payload (Mirai)", "value": "ecb37e943c6134fd0abc5d7c66730798", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679095764, "uuid": "f594c02b-f825-4fc5-a876-80008d1aac4d", "comment": "Malware payload (Mirai)", "value": "5a5095b813d147fe677f42f7610ab48e471bef91d33f4b55936fb0df0e55a952", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679095764, "uuid": "d8dc813d-2505-4989-8fa2-2a940c2f637e", "comment": "Malware payload (Mirai)", "value": "14d5a288613a7480071819d1be4dba029022635d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679095764, "uuid": "5b3f42c3-8ba0-41f3-9f39-f16de2512f64", "comment": "Malware payload (Mirai)", "value": "339b97abd6ab032ae94c9fb1ec02a1a29b0efb7b31a5796654afe7be29891cce548525c2d038241bd9c89aaf34fd0016", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679095764, "uuid": "06e617ce-42fe-479d-bd2c-7bd8eff3ef53", "value": "T1E3D22A51321C0E9BC5A72E70263F16D087BFEEA131E4F684625F5B8B8635E730586E8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679095764, "uuid": "90cabb5a-7b17-4e26-8b1a-c73913237b54", "value": "384:AKz5NdLFB/vRfqVL9CaKF5UoQ3LYSlTZGqXUHSQvDkW+6dga0tkDlD2KPE8t6+fX:V5JBvRfeCvaNdEHnOdVKJtt8J/BA1B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679095764, "uuid": "88ca2275-ca23-4b7e-9bd3-942d2df00cff", "value": 30824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679095764, "uuid": "d7065ca5-2ed6-4cae-975c-c5cce78d047c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679095764, "uuid": "13040a1d-cccf-4f64-b5b2-eb26736306d6", "value": "ecb37e943c6134fd0abc5d7c66730798", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d54796c7-c488-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679032749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679032749, "uuid": "abe5a06c-8edc-456d-84ba-d1c3c9f34357", "comment": "Malware payload (Mirai)", "value": "92b10f681ab2f6e8ae217fb12b6d9c62", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679032749, "uuid": "5de10d44-09d8-4385-9a9e-231480f23c31", "comment": "Malware payload (Mirai)", "value": "5a637c9964521a75fdb16b6578e2e34105e9e1ccbf50ce8f9fdf56e60acf788b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679032749, "uuid": "bfa5ea15-042b-47e8-8d03-0c7d2f6630fb", "comment": "Malware payload (Mirai)", "value": "b9a8f26c00baa9f2ddd09c6c528cf19901ebe5c3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679032749, "uuid": "1732cce8-daf0-42ca-a365-3e85e315f04d", "comment": "Malware payload (Mirai)", "value": "c420c558f86b2d859ca4f267615e065194129eb03f8fed1b0af6b9d7f9d39bcc55f069f4e3e7cbd237a39647edcc7663", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679032749, "uuid": "c8e6e603-0b47-4461-a387-f4f964a1affe", "value": "T1D0C2D030269B51A3F270497A8DBCC90B770A6672F0E635E737424654CA9273A0BFC74B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679032749, "uuid": "89825947-eec6-48d2-be35-61810f0702a3", "value": "768:QxJnN5wwUcgxbm9h57/GFh9QpZ+pv4s3Uozhg:ncjzp/vZalzhg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679032749, "uuid": "b2644842-d520-4b07-a412-1783dde3addb", "value": 26776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679032749, "uuid": "c6db5b99-679a-4c1f-bf89-8a872ba2bba7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679032749, "uuid": "9c6e0644-38f9-4bc4-9575-fc93c44809ad", "value": "92b10f681ab2f6e8ae217fb12b6d9c62", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83a2bc6a-c4a5-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1679045067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045067, "uuid": "1b69334f-a3bb-41c5-a4c1-ac68b30d46fd", "comment": "Malware payload (AsyncRAT)", "value": "865f56a97781bcde44902cfe823d2f92", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045067, "uuid": "64604e89-e900-4b76-a08a-bfe947b5bd89", "comment": "Malware payload (AsyncRAT)", "value": "5a9436052ba16ec5387d5d029eac2adec32e21747e35ec4774aefc5cd566b06d", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045067, "uuid": "e10f4f4c-d6b1-4324-8481-ef9cf9ee3406", "comment": "Malware payload (AsyncRAT)", "value": "0a2b52cbdd7c37bdce9ed9cad5dc6c7c2c8ed0bf", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045067, "uuid": "44de0efa-7cca-4183-93e8-06b0b9e793bb", "comment": "Malware payload (AsyncRAT)", "value": "0d3675aaebf4087afc4c2f4223a2d0e4d906a95e4338ca5cd2d0afb8344b139bb9a4a0521d3501f37f40ac5eaa21f7e2", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045067, "uuid": "100f2a7b-5831-4b3c-b48f-2d6f4a4e1588", "value": "T148C1CA415FEE50DBF227073027E6B37716A5F8B1552E62F874848A589F30BD0C862EB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045067, "uuid": "0a3298b8-dfdb-45b0-a95c-d094f424fca2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045067, "uuid": "79189d74-0859-4bd0-bde4-9e3bcad89573", "value": "96:Ps793KCFQyIeNWL4xG8Fq/5yZZUvfd3oj7rl:S93RFjNWLsG8Fq/5yZefde", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679045067, "uuid": "1553b3d6-7244-4df5-b840-775a2e2490f7", "value": 5632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679045067, "uuid": "0019e758-cec2-405a-9610-ea253d889855", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045067, "uuid": "dd35e4b0-c936-4acc-987d-65bfb024e3b4", "value": "865f56a97781bcde44902cfe823d2f92.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6a5f4c7-c4a5-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1679045126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045126, "uuid": "c4e2a71d-bbd3-4a4e-9931-5253e757fca2", "comment": "Malware payload (AsyncRAT)", "value": "9549168790bc8b01d0c889fccb01bd73", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045126, "uuid": "b7e3a894-cee4-472a-b9f0-9f9c00a404ef", "comment": "Malware payload (AsyncRAT)", "value": "5ab1b5c6441512297d7523334bdb92dbee7f35ad76901d7f199bc9d5a1223457", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045126, "uuid": "ffebf260-abe9-4598-90af-8082b2994705", "comment": "Malware payload (AsyncRAT)", "value": "3e0091a6e3d0e793c28056a19bbd882ff6992dea", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045126, "uuid": "25c0e288-b7f3-4322-a1ed-bd4176b47055", "comment": "Malware payload (AsyncRAT)", "value": "98fa1a5c866659dd9ab4d6f271424e5cede0e60b45f349c67514e413461a30544c0d978b3f6249747458cce8e87b324f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045126, "uuid": "f5e1543e-9c89-4b79-96ca-0c70354b78f6", "value": "T153C1DD015FEB50DAF237077067EAB3B71566F8B1552E62B874448A585F30BC4CC22EB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045126, "uuid": "f37e488b-1a59-45b1-8599-ad9e53f8ea27", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045126, "uuid": "62689333-10f8-4fbe-a84b-c0e1a64b8226", "value": "96:pdr479SSCFQQQ+tpwvk+JcAY+sGwvk+JwnSvFd3ojdrl:pdi9SZFVHcvk2YgwvkLaFdw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679045126, "uuid": "f7f8c357-be02-45f0-8bf0-815a5153721c", "value": 5632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679045126, "uuid": "23cc6ab3-2ce8-4fc7-94ee-d975583e4b70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045126, "uuid": "5263101d-f756-4e44-a11e-92fb36e3c909", "value": "9549168790bc8b01d0c889fccb01bd73.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27c3e79e-c4a2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1679043624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679043624, "uuid": "24fda044-5042-4ba6-b588-fffa33eeebe0", "comment": "Malware payload (Gafgyt)", "value": "edf0ac050f0cdbb955592d2f2a82de5f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679043624, "uuid": "b8e85019-a160-4d9e-86a8-f9186efe13c1", "comment": "Malware payload (Gafgyt)", "value": "5ad6d96360e2f1a73ef5ad9d79796de92257e7dbd7440761c1c473caa7b7dc68", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679043624, "uuid": "b596c795-98ae-46d4-be93-e983c7c0b6e5", "comment": "Malware payload (Gafgyt)", "value": "dedb091427bbec8d6e4853a26f5add5fdd509dfa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679043624, "uuid": "e2f7a880-0579-445a-a571-0716d4164a17", "comment": "Malware payload (Gafgyt)", "value": "a6f5d79fd3b79da4a37edd4d098f94614a738c8be691418efa4012eea6faf8429b03b574183444e373fdbf0061b41f1e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679043624, "uuid": "225ec038-75d8-4325-8076-be5550ac597d", "value": "T10B9329277B230E63C0CA54B112E30731BBB5D74938B94397B9E06DAC2F16AC439567E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679043624, "uuid": "345d73f0-0e35-4318-8880-a09f3bd64073", "value": "1536:NsN/RN40btLqnb5ctpEqHsehZmPyFqR42One9S:4pN40bNq1uE8ZmPyFqR9One9S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679043624, "uuid": "7a6ab4bb-d235-43d0-bdd9-54109dc0c65a", "value": 96078, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679043624, "uuid": "23dcc70f-d718-48fd-a3b7-dd2edff8a33f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679043624, "uuid": "7426c6b7-a854-42af-906a-7e2be66dcf6a", "value": "edf0ac050f0cdbb955592d2f2a82de5f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07c8edeb-c4a4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1679044430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044430, "uuid": "cb0ae208-b665-46b4-bbd1-4920dcff3c02", "comment": "Malware payload (Gafgyt)", "value": "d2474e38f8ee9098b2e4a294fb0dc7d9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044430, "uuid": "c40cbbbf-63c7-4499-bf2b-fa2677c2ff42", "comment": "Malware payload (Gafgyt)", "value": "5ae3073876aa4686ed96fdab60ef53765d9c86c1acb13a79c8b06b49fc2e1d40", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044430, "uuid": "2014a34a-ec31-4b65-9c27-616d1f8212c3", "comment": "Malware payload (Gafgyt)", "value": "a6b47d7310810e9aa27e2709f0ac66cbd9792e91", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044430, "uuid": "5494df40-cc0d-4a20-a084-5bb7926ac5c7", "comment": "Malware payload (Gafgyt)", "value": "644b6d164431af8cf0cd86b07751f00ca98a339e4815979b78f40b89f6c2cb7b762a4693d133e1cdd092269ef781a9a2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044430, "uuid": "00715e9a-3c91-4449-87c6-3fcbf582b4c4", "value": "T18EB33B4795A89EB3C086BEB525EB59300722ED120F2F1A9621387BF4437F5CD741EBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044430, "uuid": "bfed4fe9-a5ef-4fcc-8619-76009433c2c8", "value": "1536:Aq/W65rWXAiP5dfK4EBbkb25lyDQnAjCJB5+TjgkHmmycgYVLu1IPYC:R/vp+9C4xb2MjK0j/HmDcgYVy1IPYC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679044430, "uuid": "7b547134-22b7-41e2-aac1-97f99a0ca75a", "value": 108486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679044430, "uuid": "c002542b-d640-4ed8-92db-81243a6103bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044430, "uuid": "18f2cec4-2c21-41c9-8b4a-11439c832ebc", "value": "d2474e38f8ee9098b2e4a294fb0dc7d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d17c713-c496-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679038426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038426, "uuid": "8ffe9ad7-24c2-40fa-b624-eefb3d66b50f", "comment": "Malware payload (Mirai)", "value": "79b109349de9c2dcef20bd811c92b9ea", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038426, "uuid": "de9821a2-62c0-41d4-97f5-09f46c500246", "comment": "Malware payload (Mirai)", "value": "5b1a9229a68f1da2c030073e6c92ac0144c0e1d0a239656485dd65fb7fcf16b5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038426, "uuid": "ffb979dd-6955-4d53-8962-9220cd2322ca", "comment": "Malware payload (Mirai)", "value": "d2798e7b86b6fb0578d7faf25f771cb3f69fa141", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038426, "uuid": "aca34c5a-32a4-4657-8fe4-b494e9fda5c7", "comment": "Malware payload (Mirai)", "value": "4aef4e91869a4bc86d53edbe697240e113e3f23747e97a85fed9ecfc582069ae286a0d693c4f8c1031412a1a3c7bb03b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038426, "uuid": "2f4a1ceb-3752-49de-b6b9-2c1e4f357d5b", "value": "T19EE38536B7619E77D80ECE7305A985121C8CD98702D92B6BB2B4E51CEB6BC4F08D3D58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038426, "uuid": "a30f6efa-d8e6-4122-83f5-591456d9684c", "value": "3072:dgZc9h1jlnLA2PiXYeyCcFVNMVGuo9mrThPaLEnvPrNb:dd7lnLA2PiIeyZFVWDo9mrThPaLEnvP5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679038426, "uuid": "4c44ceb9-21bc-4990-b33f-22e18b726029", "value": 155476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679038426, "uuid": "af2e4de7-b135-4dd3-845a-fcca530bd791", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038426, "uuid": "cefcc25b-1602-4edb-974e-e88f1f8ffa58", "value": "79b109349de9c2dcef20bd811c92b9ea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "092a848b-c4af-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679049157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679049157, "uuid": "81b14956-002b-4133-8194-dbc05809839a", "comment": "Malware payload (Mirai)", "value": "e4c15258cd5cc9918bc0a1aab1216116", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679049157, "uuid": "8f4bd1d2-5548-4fa9-b344-85ce95bd3530", "comment": "Malware payload (Mirai)", "value": "5c2199f373a9f0826cca6b9d6fe1b572da0dd38958cb2573cf9f904b00cbe108", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679049157, "uuid": "2e8b2532-9279-4279-aed9-ab9e631f8677", "comment": "Malware payload (Mirai)", "value": "d5aeda0485f62d94d67e2042044158e9b4219c20", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679049157, "uuid": "2af6f2a1-b81f-4c72-b0c5-bd9cd4610c56", "comment": "Malware payload (Mirai)", "value": "f48704ddc124c4831a03543864090c05ab8b7db3e709cd0505b09c0af170c54cb349e599572ab36a7dc9d06879f5d17c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679049157, "uuid": "6008fa5f-155e-49b1-9c79-455a8c6e84d4", "value": "T175336B36E4299ED0C5960234A4E88F751F13F1C883136EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679049157, "uuid": "1cc17ecc-bdd1-4f6b-85e4-60e62cfb435e", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/91PhhGCZQoVjfjmCozw:Oa4U7G7SvT6ftBwPh0KVHmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679049157, "uuid": "0740e7b7-1056-41eb-8633-75f3f83c2f44", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679049157, "uuid": "bfef9202-dd5e-4075-bc40-75602ba1ad48", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679049157, "uuid": "abff5886-5835-4347-a710-8d17ff12a89e", "value": "e4c15258cd5cc9918bc0a1aab1216116", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeeac620-c468-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1679019048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679019048, "uuid": "8bb70b50-d546-4c3b-8383-5f0e693fbecd", "comment": "Malware payload (AsyncRAT)", "value": "90bae19f5d9715b30623939296dfd688", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679019048, "uuid": "664230a0-ef49-44bf-a0b9-e8b29918f076", "comment": "Malware payload (AsyncRAT)", "value": "5c416c3e68e89ae3a9c9b65b8414747fa6214f9eadc1ca9062b02a157f785345", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679019048, "uuid": "a4a7234d-4d26-4132-adac-388cb3e39e4a", "comment": "Malware payload (AsyncRAT)", "value": "aaac48f4ed7e946ea4f53148df8265a7e632d9ee", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679019048, "uuid": "e6bf56c4-192c-403c-9fb3-06a2f5b47ab1", "comment": "Malware payload (AsyncRAT)", "value": "070545df33982dff05ea3bc801022a423a38878a3000a35ed08bc5af64380372b5c7d71fcdba5b3cada823bf18e05b59", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679019048, "uuid": "b1d6478c-381d-4c35-8dcb-b984070661b5", "value": "T1FF759D313A6180B7C27F31719A4EA7B9F2BDD6709E39125352A01F382F74592892C76F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679019048, "uuid": "970f2f42-78a7-46c3-8152-e362f004cf3b", "value": "afad4d339b7e9c522ce7030d9aab5db1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679019048, "uuid": "b0f769cd-a7b8-4054-9fad-cef36f21aa18", "value": "49152:cyF3qBsLNJBaGB+V3dZAVHdXWolM/5bxb9EnmG9o8GiiUTmVU5ZZH:NI+LNJBaGQFdZyHdW/5bxb9EnmGrZhTv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679019048, "uuid": "27d100a3-0cd2-4115-b6dc-19947f26dead", "value": 1655296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679019048, "uuid": "0e82d73c-564d-405b-b742-2094f2c6c509", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679019048, "uuid": "9efdc457-6d0e-4480-a215-6bfc7eb85bec", "value": "Sysem.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b0c8379-c4a5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679044865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044865, "uuid": "ac0c9cba-74c1-451c-a592-fc3122b67af9", "comment": "Malware payload", "value": "230099a7543b22b06a393e6e88203ab4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044865, "uuid": "b9baf410-7726-494a-9d86-a2482bcea891", "comment": "Malware payload", "value": "5cc389d5fcdaa27d256bbfe07a7ea27b6478ab1aaebcc154cf0837f90241affa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044865, "uuid": "0e3b7695-c9fc-4979-9c61-453bd80f3736", "comment": "Malware payload", "value": "92e9d4b3f50b9179e0f380ea59de3873ecb13cfb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044865, "uuid": "652452b7-e125-4df1-891f-98285f394fcc", "comment": "Malware payload", "value": "47f16e5a1d302cf902d247d071b38d70d902bb0fc5e17570830275221fec463e249c3187b1b1fcd511c970942ce6245e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044865, "uuid": "29961f38-c349-44c7-9c2b-915b6dc6b652", "value": "T13E2633021E2C5FB1C2781ABDD5798DC41BB957BC018B7B0D6440AAB197FD4EC922B85F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044865, "uuid": "3fe5c030-850b-4ef1-ab93-0f7fafbf7d4c", "value": "9aebf3da4677af9275c461261e5abde3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044865, "uuid": "4553b5c4-360a-4229-ac00-530b583a5afb", "value": "98304:loycFtxTdmSeBQ25ivC5G6Q3o/MINgh6H19qAgmD7/i/uVHP:loysJmbOH2NQ3o/MIIQqAN/i/mP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679044865, "uuid": "d7ee92a3-6bfd-4e9a-afa2-71bde3f682f9", "value": 4509696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679044865, "uuid": "560d2129-09f7-48a7-824e-6fe89f0f0f92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044865, "uuid": "9f12cef3-a586-45c7-add7-66c8d90e17c3", "value": "230099a7543b22b06a393e6e88203ab4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbe2d8cc-c4c9-11ed-88f6-42010a9c006e", "comment": "Malware payload (DanaBot)", "timestamp": 1679060731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679060731, "uuid": "8872cc03-3f18-41b8-bc18-2945ef0f9c72", "comment": "Malware payload (DanaBot)", "value": "50b28c8b39d65e49be2873ef4fae4955", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679060731, "uuid": "26e14fe7-918c-4f4f-836f-45cd83eebfd6", "comment": "Malware payload (DanaBot)", "value": "5daeae2494873409b8b59fd1adde883ce972d9a1d9616ce7d9067aaa3527ed7f", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679060731, "uuid": "7cb6c775-b592-4784-ab49-f7b1bace897d", "comment": "Malware payload (DanaBot)", "value": "a13c4d71e4add3ba31d6d1b10cc927c953676455", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679060731, "uuid": "f5e502fe-ce99-4c18-b7e7-9168fa3dfeca", "comment": "Malware payload (DanaBot)", "value": "47b481564537502c8a241ad1be7e74d26b3f4857559fe42a79ff488368231dc8d7e55786556eaa9f93d9965040e31d11", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679060731, "uuid": "4550e2a5-bf54-4ddb-9852-5d5babfd9ba8", "value": "T146D52203C6E17C85DA258B73AE1EC2E4B61DB5A1CF1877F62368DE2B05B10B2D173616", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679060731, "uuid": "01820984-aa3f-4acf-9e4b-b59930e35169", "value": "e363d5da20c70258bd1c7ee5e97f31ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679060731, "uuid": "bb6a1c49-7ec7-454b-90aa-c523f767418a", "value": "49152:4kKEnVVYyTxwZCpm/roseFEFhuhLmHGugnc4tNz+EldRXDZU6hKtAV7hh:4tEVimeYpm/rostFwYHNgnhmKULAV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679060731, "uuid": "7e3cdb0d-872d-4496-a2b9-c5553c6debfe", "value": 2806272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679060731, "uuid": "ee67243e-613c-4bf0-be72-7ef3ed41f36a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679060731, "uuid": "dcca8bea-8bde-443d-af1f-ce9a80679c69", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49bfe49a-c4a6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679045399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045399, "uuid": "0b0cf3f7-1d16-48e3-a1bc-89e87aac0e4d", "comment": "Malware payload", "value": "8f27797e2a47f0ffc30c5046cf217836", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045399, "uuid": "0f1dcd53-68d0-49c7-84f1-10391a216e6d", "comment": "Malware payload", "value": "5e7dc8a804e4791fd73261b21b90535b685296354b6a5c612055ae854e2bc6b9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045399, "uuid": "7669c1c8-3bdb-4056-9f6d-e3ba0f9f0209", "comment": "Malware payload", "value": "bf5968eaed64fd0156343636d55002629fc32d2d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045399, "uuid": "d4c5a21e-a566-4016-9325-19ccabceb855", "comment": "Malware payload", "value": "237ddf1544496628f655e75a10bdf57de0d9b60d0df76561967d4b2dfc334a82fac8dcc4dda4199dd734aeb41b1b3934", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045399, "uuid": "c28ffd24-2b60-42e6-88fa-2b4dcdfb3fed", "value": "T13013F198F116CC02C95667B0DD626AC24F5C9E4FBB4767F0A2256F04C49313E3EB2AE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045399, "uuid": "92fe6558-e4f9-4776-aea8-25c8dfc58808", "value": "768:GOjhJKecVdgSlNCB3Zgi+ncVdO3odcdpG6NiTVJU7LH1Ptp4uVcqgw02NWXVEDcB:GOtxcVdgoA3ZmnSOYCuUuVJs3p4u+qgJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679045399, "uuid": "1e708b4c-a091-4055-b718-0b6eac444452", "value": 41484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679045399, "uuid": "cbbe4707-d94c-46b1-af40-48b0da2b278d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045399, "uuid": "d9e3d24a-ac75-449a-81cb-63b2c85fac53", "value": "8f27797e2a47f0ffc30c5046cf217836", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a0d6b1a-c4a5-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1679045078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045078, "uuid": "7c098256-bfe5-448c-86e4-bb9716350e84", "comment": "Malware payload (AsyncRAT)", "value": "e04c47828b28e33be2b5ebc75172901b", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045078, "uuid": "a3a188e2-e182-4d7e-b2b8-ecac2aae5dea", "comment": "Malware payload (AsyncRAT)", "value": "5e7e694998fed28369fdcc8aaa3ca2fccc981f9ec3598e40937ddc3cc633408f", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045078, "uuid": "69e690ea-1098-40a6-9d92-ed838146871f", "comment": "Malware payload (AsyncRAT)", "value": "370748db9d1a677787a72a1c785307be60d56801", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045078, "uuid": "d9f68d69-d66f-4d1c-9e86-e58e7aeb4fbb", "comment": "Malware payload (AsyncRAT)", "value": "44a1f9e734e1d2abecd24b2ba5f91e6b19b98042f00d5f93f3ce32a7a2c654fd9a7c2271eb4f2366ce5caee9e9d9e3ce", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045078, "uuid": "72760e6b-1b5e-4344-8bca-d0af352ad033", "value": "T15AC1FD015EDE50DAF22707702BD7B3BB1266E4B1552E62BC71444AA89F71BD0C862FB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045078, "uuid": "a16f0e43-1233-481c-aab1-1ac1cce9cc73", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045078, "uuid": "98c777b8-484a-4fca-963e-a6ec434fa0ff", "value": "96:Cossn579oll3VI2P1QYUUqHM/tPNtUqNM0cvHd3ojgrl:g49o/33PlUUqHsdNtUqNGHdF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679045078, "uuid": "37871ac0-b959-4165-b128-dfb72145a505", "value": 5632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679045078, "uuid": "a8c54917-b2ad-4a1b-bddb-6c952eb5cbd8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045078, "uuid": "2f10e5a0-d625-464f-b7a0-d740e8d9df69", "value": "e04c47828b28e33be2b5ebc75172901b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5d32f71-c4e3-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679071887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679071887, "uuid": "efd5aa3e-9a5e-456f-805f-cbeba1283ed0", "comment": "Malware payload (AgentTesla)", "value": "b4f0d277dc1cc2572cad4a2e9bed5a41", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679071887, "uuid": "dfcd4d87-ac1e-4e23-936b-5d2a6bf71504", "comment": "Malware payload (AgentTesla)", "value": "5ead61f612d6339968a7a9f0dc439cea07bec0fe7a06775545760c021a40c219", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679071887, "uuid": "50061538-1fab-4a6b-b241-504e4ab67895", "comment": "Malware payload (AgentTesla)", "value": "7b13178eab2c48a3114dc676cf3ef64280411da1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679071887, "uuid": "d0a67e81-6a74-43b9-b244-e085fc21883a", "comment": "Malware payload (AgentTesla)", "value": "acf4e09517f3687720b12d00bbaa2aaa3188ad142de2d61170e9c956c3f292199db8a4b1f56254cc8dfbdbf190a67dd0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679071887, "uuid": "b93eab75-f14a-4e40-927e-82bd6de48c1d", "value": "T10F45F11FB104DF4AC6068BB86E17F9E8520D7D54ABD4B1873681BB1F2F351A26AC35C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679071887, "uuid": "bffa6895-006c-4f2c-8e98-f35e353b8a07", "value": "24576:vLKOWQmmav30xiSdP1SdPwdm51CpI1PRsGoWSXivNB9:vLKDQmmQ30bDGoBXiVB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679071887, "uuid": "ded0459c-a5f4-4b23-88c0-2ca79ff49dcb", "value": 1224192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679071887, "uuid": "d85e679c-2494-412f-a701-00ce57a4b964", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679071887, "uuid": "5f29c1e1-f10e-4ae1-af0e-5dda661a6473", "value": "RAINBOW FAM TRIP 0317 ROOMING SUNBEACH.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae99d549-c4ac-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679048146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679048146, "uuid": "0cc691cf-0d50-4042-892a-ababc922faff", "comment": "Malware payload (Mirai)", "value": "8f5a0f532ecede16cac2ffe2d69c5166", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679048146, "uuid": "d7108b0f-6464-4e6b-8ce5-839fe7bc521a", "comment": "Malware payload (Mirai)", "value": "5f0f215fd73889f7f0e60d7fb4c20b7486d193663561717cf6f283f3fbde5e75", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679048146, "uuid": "b6976b52-d0f5-4390-b607-5f252e37555d", "comment": "Malware payload (Mirai)", "value": "9764604bc98f6c4347cf202f909e582726cd18be", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679048146, "uuid": "988e690f-64bb-4801-9f18-b5daa8e58c4d", "comment": "Malware payload (Mirai)", "value": "cb58ea10b64b99fd35ccdc4821e5ada3e208a710abefbe4382b574e98eecc96b7c337d8ac278d7aed5decf25c0a0d8b1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679048146, "uuid": "4ff012cb-6e31-4dc4-b3d9-dca6a72175f3", "value": "T16AE35C8AB4024E3CF987ADBE94620E1AED61935161D3072B616BFEC37C3316B9D07D85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679048146, "uuid": "c39f084c-1f29-4981-bf08-7ea0a06702ff", "value": "3072:YFMlYyCK2BRbbzsS1yR/ipiEIIqhoHgH/RHgOO:9gDs4aipirhoHgfRAOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679048146, "uuid": "e93262dc-4a0b-42c6-a56f-1ca6e4e261dd", "value": 153004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679048146, "uuid": "491ef26d-c6d5-41ed-a704-4f795ce454f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679048146, "uuid": "937adc8a-5057-4e71-b539-9336b29ef9ce", "value": "8f5a0f532ecede16cac2ffe2d69c5166", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a60f551b-c4e9-11ed-88f6-42010a9c006e", "comment": "Malware payload (TeamBot)", "timestamp": 1679074331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679074331, "uuid": "4db766b1-b74b-4157-b04f-d892a15d645d", "comment": "Malware payload (TeamBot)", "value": "06c1e142d1c9f438103774ec50d9b348", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679074331, "uuid": "2296c64c-c741-4c16-8b3c-733ccf3121ba", "comment": "Malware payload (TeamBot)", "value": "6038c92533b13adb82e64552b93c5a536a98e09b4306fd7790cb47d8aaf67dd8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679074331, "uuid": "09ee0fdd-e953-455c-afc8-66a6bb33dab6", "comment": "Malware payload (TeamBot)", "value": "70581fc0ecaac1d2fa4c89442b6c1207a6a98fe3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679074331, "uuid": "4e466189-9d32-428e-afd4-3c5132b786c4", "comment": "Malware payload (TeamBot)", "value": "a34198a25dfb247b0cab16fcf1eeaca2ee639b3ed7c5b8e463078d88e092efaf23681da791d576917d6464d2809bcb5c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679074331, "uuid": "ac2c8bca-ac38-4be5-a5fd-c375b8b97de1", "value": "T12454194396E17C48EA268B72DE2EC6E8771DF6518F89776532189B1F04F2272C163F90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679074331, "uuid": "c6690e12-c97d-40f5-8ec6-06a487ac9a77", "value": "6e76b494f1a9946f83b6b72033f310be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679074331, "uuid": "70a27f4e-bdbc-4f06-83ae-11803fa8379a", "value": "6144:B2g5L/BOD5RAX/sxOuWq81XZxYw/BsE0u:sg5LBOdRS/ARYJzzs1u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679074331, "uuid": "cc0a31c7-bbec-43a1-b442-1f9d13979924", "value": 304128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679074331, "uuid": "837d9467-4afb-4bc1-8d7e-72fdabed66fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679074331, "uuid": "a32fc634-3c20-41fe-b3e0-88577715c339", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9a8ed07-c4bc-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679055143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679055143, "uuid": "6c16f741-29c2-4ebc-aa63-b8c0486b6aa3", "comment": "Malware payload (AgentTesla)", "value": "902b7c8a45214788c1ca73a3b1cbfc41", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679055143, "uuid": "d3142eb6-317a-4408-8d45-d926794bc4cd", "comment": "Malware payload (AgentTesla)", "value": "603d73a60623144a16205cdf6c4f9b40f7c7fbd0d1934811357767f9b2c0a02c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679055143, "uuid": "aafd3bd7-81e1-4e80-bc9e-8b6520afbec1", "comment": "Malware payload (AgentTesla)", "value": "83e26c79e8cf6df0e66f1f1b0f5f9863a03f3663", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679055143, "uuid": "41383754-17ad-4c90-aae3-7ba65c600806", "comment": "Malware payload (AgentTesla)", "value": "56d99f3742d3d9ff90da2ff74f768fb60826596fd91ae4835e92d75bcaedcd755ae532a1ac3771168a3b88ed0fe187dd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679055143, "uuid": "97e4ab9f-d9b2-4350-a10e-04d851eeb40d", "value": "T1C7B46752F462FC28EE244E3E8C4F5A410DFE1EC5B4E6461BA448F6C24A766B6C45BF0D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679055143, "uuid": "8fe8f329-21fe-4b60-942b-0c667b2b664d", "value": "6144:jszno/RDE6QYXUCxzK0b99RtteJa3NZX:CoJDJQYXZzProkdZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679055143, "uuid": "ded33c4f-93e4-4ed6-824a-9dba273d5ed1", "value": 512000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679055143, "uuid": "8b496d35-1bd6-4131-877a-a4a395d3bd9c", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679055143, "uuid": "26f975d0-dc66-4af3-a587-9052bfa53eb1", "value": "Bestellung_(PO4703392)_doc.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4ff1120-c4db-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679068396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679068396, "uuid": "03dae33e-1687-4a66-a119-dd37cdee764d", "comment": "Malware payload (Smoke Loader)", "value": "02a78b42fa0ea00d5d2c36542a54f747", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679068396, "uuid": "8b9951b9-6b8f-4d17-b68d-e07b3b51b4c7", "comment": "Malware payload (Smoke Loader)", "value": "60a9e65cdfe4df3b81c70eedff235fcfae330d85b346412c962efa6ad877a4c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679068396, "uuid": "282c9c0b-aba0-4340-b532-8127e8b3c1a8", "comment": "Malware payload (Smoke Loader)", "value": "ab347fbba12136351920fac13cc1ab5f124732f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679068396, "uuid": "25fcf94a-aab8-49c6-9537-27931e868daf", "comment": "Malware payload (Smoke Loader)", "value": "66b2ded983619cb6c647bb3568d577ada7d34a7ed8fe965f24abe1051e0b46e5b17a0ecdaa77e403648ddea0474669da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679068396, "uuid": "e18721d9-7ed6-4602-bf7b-51f17dacd1ee", "value": "T15B54294393E17C48E9268B769E1FC6E8771EF6518F897B6932189A1F04F2172C163F90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679068396, "uuid": "c07c2f6e-958d-4809-989b-929a42491c6b", "value": "6e76b494f1a9946f83b6b72033f310be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679068396, "uuid": "bf73b204-ec1c-443e-b45a-ee121024ae72", "value": "3072:5U2nrwDLydWcA8sATeM98lf8AWQ3kJHzcdKriWVCmiSnI4yVftueURuM:CmwDLyMcAMej0JCzWAmiSODURu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679068396, "uuid": "2c5ddb12-f191-40e1-8d82-1d53c51b2da2", "value": 302592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679068396, "uuid": "838eb32c-8eba-4789-a333-8218ab271295", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679068396, "uuid": "7ad210e6-11d3-45e0-927d-96f48d0cb1ce", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "534ec08d-c4b7-11ed-88f6-42010a9c006e", "comment": "Malware payload (AuroraStealer)", "timestamp": 1679052717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679052717, "uuid": "c8a9fe87-75bb-4a1d-8277-81b58de23145", "comment": "Malware payload (AuroraStealer)", "value": "1431d295525534f244dd34a8a311b87f", "object_relation": "md5", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679052717, "uuid": "838f0570-6bcd-42ec-91c3-783ca209b581", "comment": "Malware payload (AuroraStealer)", "value": "60f5cf24370600410d431405a2af891db1e19396a73d437b33f2e9c01e9fb27e", "object_relation": "sha256", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679052717, "uuid": "70d4563a-87c8-4bea-8a60-dc45d7d0a538", "comment": "Malware payload (AuroraStealer)", "value": "2d0d2190ed780bf8dfed135bd1d12cae53860ebe", "object_relation": "sha1", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679052717, "uuid": "c879ab69-b443-4932-8918-93f637372dbc", "comment": "Malware payload (AuroraStealer)", "value": "46d664c6c08d2bafff50c103396b645c289178863b774fc1428e71bd9236be0122a191c723893b0146c0e60450f26619", "object_relation": "sha3-384", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679052717, "uuid": "17d6587d-090b-447a-81cc-5b782615441c", "value": "T14386BFB979047CE6E66F427BCA96ADD8137139224F9766CF4060B7D709733E4EE22804", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679052717, "uuid": "e4e93e13-3f9f-4a19-afa7-3aac75c41fd3", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679052717, "uuid": "78923045-8517-4e0e-8d3d-65f3a628a3db", "value": "24576:2H5qGTyaJEUcmADwRqPACrUJJiILBCR5LpWKMuy1rnwNnNQx/PEEDnpfuZWI9pIx:4qGTyMEQADwwACagk+lKo83Vz1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679052717, "uuid": "8e5c0cb4-92c7-4cf3-8b7f-1f6e19636ea3", "value": 7854592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679052717, "uuid": "67810e3f-634e-4fa7-ad93-9f36738ab3a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679052717, "uuid": "385eb0d4-bf55-4255-b307-fe281c9a07f3", "value": "1431d295525534f244dd34a8a311b87f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc061586-c47b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1679027123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679027123, "uuid": "6099d39a-27b8-4aba-89da-790e3e28464b", "comment": "Malware payload (Loki)", "value": "7c88a0b034e6cbed51defbc9a35696df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679027123, "uuid": "c517c064-e0f1-4996-97f6-70e647687513", "comment": "Malware payload (Loki)", "value": "6105d248835d8e8d086422b374263cbf2325b914f6a0b6f73f9c134bcf384526", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679027123, "uuid": "5fe45dea-62e1-4387-aabc-d3ad45e6c377", "comment": "Malware payload (Loki)", "value": "bb8c7c5a7d8f7b3b257f99b5c68960c412733432", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679027123, "uuid": "a92bda43-8551-4edd-b1c7-1a1a77b299f7", "comment": "Malware payload (Loki)", "value": "7367c4aff7350fa85d240c43b00f1b01fd5891a3304e81201867307a2f2e4e5f52f234f289ff6c57cfd4835a5e796ea0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679027123, "uuid": "bedf518a-e30f-43b5-912f-6c63524f22a4", "value": "T11CB4BFA1B75BA180D84DB1FD18F202772AAFD460C25B918B3F8E579D2CADD530A9F5C0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679027123, "uuid": "f2514925-e5f2-4528-9e4e-4149cd926417", "value": "23829e0b0c5f57a4053c62032103894d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679027123, "uuid": "517292b1-b5ab-4681-b217-9b8e2f3033f2", "value": "6144:Ll1/Cz6eN/SXXv00GZJBh07/7p/3H/ph/X5/xL/3D/3L/L7/5X/LL/jX/zJ/Db/Z:Sm1QJShDCKltNOBijcFzsePpi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679027123, "uuid": "5b627431-c510-4c22-a403-c33c7ac0b610", "value": 499712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679027123, "uuid": "76fc35aa-9086-4e46-bf30-41a16f76ef1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679027123, "uuid": "6fe66f84-96f6-4c86-b087-390fd980ce92", "value": "6105D248835D8E8D086422B374263CBF2325B914F6A0B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dd13775-c46a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stop)", "timestamp": 1679019529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679019529, "uuid": "30a83b95-ba4a-4836-a185-f88bc740a723", "comment": "Malware payload (Stop)", "value": "f9271357824ce6ebd0b08ca26e69f4ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679019529, "uuid": "a38bbf0a-a3ca-4db9-928f-756462c9c1a3", "comment": "Malware payload (Stop)", "value": "611555ad45f406141e18bf4a8611d2a8028d7f637090c1e95b99882884a1656b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679019529, "uuid": "7618ec03-ce95-4256-9cf0-b224049482aa", "comment": "Malware payload (Stop)", "value": "f79d25ebda44e5d4f0223057bad6a19da6c84906", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679019529, "uuid": "e3e41c7a-524b-4a81-9048-bf91614f5072", "comment": "Malware payload (Stop)", "value": "b7ed95084780ba9c3a659d3663764d3959276e45536a49d63e7d6aefff8d8585f7f0b39b35ee6fb81211914aea0a3d8b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679019529, "uuid": "a12cd24d-41bb-4d4c-96fb-639f1dcb54d7", "value": "T139E402035BA5AC21F919CB398E2FC1F8761EB5238EA56F2B125C5A2F04710B2D57F721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679019529, "uuid": "55217722-80d1-4e8b-948f-c75161f3d6d5", "value": "4b2faf5e2157c756cf2fd31d6cfd3d44", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679019529, "uuid": "c77f9b41-7fc5-4141-93e3-8d1f79401ced", "value": "12288:Dm53qc7LR6LvsUGoYA2FOn8zax4y2HPpy6nhBMYf4:nwLRyIoYxFzaWHxyyBMYf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679019529, "uuid": "b14aa16d-43bf-408b-b039-15cd09ca4119", "value": 698880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679019529, "uuid": "1637f9df-98b8-4d4b-9de2-135dd55952cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679019529, "uuid": "7811bf85-3241-4ec7-a34e-5eca87d92986", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f4e260e-c46d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679020954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679020954, "uuid": "b472b453-c0b7-41b7-98c8-bca0cec3e628", "comment": "Malware payload (Mirai)", "value": "0ba850e0b73bb1380b73d7dc6ac84b2d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679020954, "uuid": "84e399aa-dbb7-4bd5-89e4-778d7f19b9f0", "comment": "Malware payload (Mirai)", "value": "6138c1111bc7405fd2a3d22c4b5114e90bab81828a7066500becc37cf1a72f57", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679020954, "uuid": "85e0b028-ac98-400f-a097-d220c6df965c", "comment": "Malware payload (Mirai)", "value": "dff7ef87fcdbb9af84cb4c3bb7add91262c552c0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679020954, "uuid": "ce0fdb85-fa80-494d-afa8-f42e1425b82a", "comment": "Malware payload (Mirai)", "value": "5402f04ff0ef872925c4a8a47fc7f9ce05d6d3d016587518cc8961fc978850d56ef161811fabe8cc6ac59e2855388a01", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679020954, "uuid": "7cb582cd-cb14-401b-ba83-e123cb260133", "value": "T1A6A2D030E394AFA1DFFC6D604B9292837BB10FD1665ADDA366DA9E04710704BF244ED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679020954, "uuid": "8f4c7684-fcf4-4d5a-afae-a3e0a4748ef2", "value": "384:2/JywWc84Tp2YshxqlDKo0CGYkMmUW2peHlxXmyfM4uVcqgw05VxJo:2RxsSVsMDd0CGJVUTeTW74uVcqgw092", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679020954, "uuid": "a4ed6f1d-1eae-409d-b208-28126ee9e46d", "value": 21876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679020954, "uuid": "a9d3feef-d497-4e6b-bdd5-c0da294319af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679020954, "uuid": "91628958-63f9-4d4c-b18d-31d914c85b72", "value": "0ba850e0b73bb1380b73d7dc6ac84b2d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "691955f1-c4e0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stealc)", "timestamp": 1679070363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679070363, "uuid": "a0449f27-bcec-4c99-952c-7781e0c508a5", "comment": "Malware payload (Stealc)", "value": "7b4a2a3b79f2550149cda6141c9fcbba", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679070363, "uuid": "d441e26f-5e4f-4cc3-94a8-0418e182df70", "comment": "Malware payload (Stealc)", "value": "61574da5a4ce85b7e4ab4456a7cc4410c281a1fa6e4144b8be7f6d0b7679fbcd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679070363, "uuid": "32e9e764-2ccd-4540-a236-60fcd72de58b", "comment": "Malware payload (Stealc)", "value": "ce4641a31e538ea05a53574de2c12d5ab2cf580d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679070363, "uuid": "1cacb16a-0a26-48b3-830b-ebf46085a5fb", "comment": "Malware payload (Stealc)", "value": "c3fb9a381f1c27aa5e1d0b9b0f75521c7ef8f63f9725fdd2d628c4abb3fbb9f17589afda80e64ed327c011ab3584d35f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679070363, "uuid": "a6d3c288-e643-4ff9-b453-207dcf10c5ee", "value": "T12954394392E17C48E9268B769F1EC6E8771DF6518F897B6A32189E1F04F2172C163F90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679070363, "uuid": "27c50a83-3a26-4f8a-a4ff-a67bb9061d54", "value": "6e76b494f1a9946f83b6b72033f310be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679070363, "uuid": "cf2caf78-1ae1-4537-aa1a-e39bf96f1876", "value": "6144:GcwSLJmySBx5DhTkxjgN1pOnaloCtDnu:jwSFmykPFgxjgNIqnu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679070363, "uuid": "905dfb85-b184-4789-8215-026644fcd01a", "value": 303104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679070363, "uuid": "e7541523-878b-478d-a5f4-bca981bf3c6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679070363, "uuid": "d7caf8cc-72e0-4169-ad76-28fa1ef1cfa9", "value": "7b4a2a3b79f2550149cda6141c9fcbba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a42795c-c51b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679095786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679095786, "uuid": "01a866cc-9a9d-4cde-b25e-de7544897cb3", "comment": "Malware payload (Mirai)", "value": "fc48a7b2db177314b201e424c17a230c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679095786, "uuid": "9ff2eaf1-ce14-4e51-b2be-abd348741503", "comment": "Malware payload (Mirai)", "value": "61908b2f9d776b63a1fe8da5b310b645873b72465c9bf609035c7190be7c00e1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679095786, "uuid": "29fd7b6b-6b30-44ac-9714-85714ba5a6d2", "comment": "Malware payload (Mirai)", "value": "583e43949f3e35c1593d75e119aaa28df09d4ecd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679095786, "uuid": "8fb4524a-6626-4785-a9a7-bb8e7787c632", "comment": "Malware payload (Mirai)", "value": "e81b2e69c932da9b8b44e30ac2785ea3e6842aa65e98be0b174cf228d37b8cbfd037499c7a931a5cb05fc6728a5b92d2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679095786, "uuid": "db06c9c2-529c-499b-ba18-842fbb563e26", "value": "T16513F2DC6F273005E23D8F35CA252BC62B0555AFAC701262DF112E682CD89AFF6156EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679095786, "uuid": "9a1ef05c-f39b-43ee-9df2-8838a605e6da", "value": "768:eECGbsIWo1dQV2gYZ3YrQdidz3fv2Xgh5ByenumNCTbx36PEQXTtorJdeN0g7CE5:ejoH22TVYrXLf+0yVHx36Pz2rNE9n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679095786, "uuid": "073acd8a-7a8c-4e21-a5b8-5da622099b62", "value": 42796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679095786, "uuid": "41de73f9-85a3-45db-b6ee-3ad34c420d44", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679095786, "uuid": "d21314ea-8313-44f1-8069-6b7b44bb3348", "value": "fc48a7b2db177314b201e424c17a230c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac9a0e99-c4b9-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679053726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679053726, "uuid": "e4d0f84d-6588-40cf-9c3b-22bf6cb12fb8", "comment": "Malware payload", "value": "4c77f38a3e2bd6385817d68d94653580", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679053726, "uuid": "05234d37-e363-4651-a39f-2b2b51998e67", "comment": "Malware payload", "value": "61bd2ecdd20b5bf59fbd62b5bf0ff9718043a86c05e7f57eb22bfcb3ce013085", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679053726, "uuid": "5fb8dc6a-dd64-4681-a314-456d2c547f84", "comment": "Malware payload", "value": "5a606d29f68c0f70070c2f5081a6d62b5c66e88f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679053726, "uuid": "19a682df-f538-46b0-953f-c544a9113865", "comment": "Malware payload", "value": "469858525b846025e66d1da58721225990b4d2e57130b4f259ce7885cdb019d607adcec10420b4f3ed6dd92b397baf3d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679053726, "uuid": "e2449819-b38b-4107-ab06-0f8bd23d2519", "value": "T15DF311EA7A923F5E15F617539742E662BD2700A809012188642FFD7BFCB56315338CE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679053726, "uuid": "3b2bf3cc-a4a6-4cdf-abd5-43a69437caa2", "value": "192:/GGGGuGGGGCGGGG/OjGGGG7GGGGcGGGGGT:4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679053726, "uuid": "a1dc801a-4c9d-4adb-890b-005151e61dc3", "value": 160285, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679053726, "uuid": "577ed157-3726-4a5d-aaff-d52e9620e1ed", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679053726, "uuid": "1e1957f2-5164-4b12-9222-3024da8db17c", "value": "hindi.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38720d46-c4d2-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679064268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679064268, "uuid": "8e92e9e5-e86d-453d-9eca-af82f0fbc43a", "comment": "Malware payload", "value": "fd7fa3b28f9c31b0fa9e674343b73ee5", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679064268, "uuid": "b1462e6f-cca0-4b18-badb-00caecf2fb18", "comment": "Malware payload", "value": "61d8cd60a32769b765695139d530bf1110a655a20d7e9b96327f43c779d10ad2", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679064268, "uuid": "9b1f87dc-970f-4543-9dcf-1f95a8a42362", "comment": "Malware payload", "value": "764b2ba2ccca8d79dfe7f38ec706485d0bf08267", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679064268, "uuid": "7266abb2-d1a4-414c-be19-b6b2cc2554d5", "comment": "Malware payload", "value": "1b1a87007408a9ae996930997e3649b33177d2b850a89b7a87bd5e93e55a89e5ba58a74fd865be0990b7cc3c5c02a88f", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679064268, "uuid": "a852cd5d-aa26-4dc8-9bd4-ed52b5dca848", "value": "T17D2282370FCB73151F5361BCA33B91CEDC94A0C17325D72EACBB826BA548460A932697", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679064268, "uuid": "6da29fd8-9bb2-4cd9-a0d6-d83d9b143fa9", "value": "192:zxb39IbdOeJfWavAv8cGeijn041MFEoL77bU8EIIZrla6Nx8F:3IbdOeJfvY8c9ijn0eWg8EDZrl1Nx8F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679064268, "uuid": "948b1e62-4087-41a1-8ce4-6925e21e9190", "value": 10157, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679064268, "uuid": "ddd31b3a-f63b-4bf1-9004-b06b1c925fd1", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679064268, "uuid": "f192fc29-c901-4997-bb21-c21cd25e1759", "value": "Vero.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd85d566-c48f-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1679035823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679035823, "uuid": "c467c596-1df0-4c7d-be2a-38cbfb89d149", "comment": "Malware payload (njrat)", "value": "e11aa2c789dfd4b10e77090c4c3e448f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679035823, "uuid": "e09471a4-5b36-4598-b2eb-856966be49bf", "comment": "Malware payload (njrat)", "value": "61f6d97939e73cf2a5c172bd2a19ae50e5b4c76fb5426cb30d062e1a0bc5071d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679035823, "uuid": "07243e4c-cdbf-4b40-8a36-4add6cd9a667", "comment": "Malware payload (njrat)", "value": "ea62417c208415661cbcace3984f493f55eedaa8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679035823, "uuid": "a2691a3c-1d2d-4cf1-b550-365731deddf3", "comment": "Malware payload (njrat)", "value": "50c2ff013eea56c8413950e9815a839be3c7775353889e66bd3371a0556b53d58cd38437e8e7ce16892e043e1c498064", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679035823, "uuid": "222ec555-3a27-4bc1-9367-700e76337d22", "value": "T15603294D7FE18168C5FD157B05B2D41207BBE04B6E23D90E8EE164AA37636C18B90EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679035823, "uuid": "17e2388c-6ee2-4fd1-a1a5-d22d6e367097", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679035823, "uuid": "43315a4c-e26d-4a3c-8bbc-089f4d38c210", "value": "384:fW/gUiDrblmJEpRGyEfdDPTuWCYqAlLrAF+rMRTyN/0L+EcoinblneHQM3epzX9J:e/yHpR9EfdDCWClAprM+rMRa8Nu/vzt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679035823, "uuid": "5b8f7c9a-c1a9-4439-967b-5f275d51d8c2", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679035823, "uuid": "3308dee0-2c93-499e-a0e5-1e4c284c64c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679035823, "uuid": "4bc79ab3-87ea-49f3-8768-3be4ac711d24", "value": "e11aa2c789dfd4b10e77090c4c3e448f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c785f9f-c497-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1679038935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038935, "uuid": "ed6c3877-96c3-455c-a776-d81a61c02afb", "comment": "Malware payload (Heodo)", "value": "1d8924fe889061cdbefe4d49efffee88", "object_relation": "md5", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038935, "uuid": "ec139e51-54f2-49b4-9138-2460c65da083", "comment": "Malware payload (Heodo)", "value": "623cc4208027dd46a3cd438e021b2b987efc550c5ae774568e129cd69e11b8d4", "object_relation": "sha256", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038935, "uuid": "a78eafde-83eb-4f61-87f5-3eec74fd1fe5", "comment": "Malware payload (Heodo)", "value": "722ffb7b718c4d75e18d81bb52512920963354d1", "object_relation": "sha1", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038935, "uuid": "6f8cb44a-5760-494d-93a8-4177b0c4eb59", "comment": "Malware payload (Heodo)", "value": "1f0fc13a5f46f7fa20d09fd8ab9b3a9a62ff45a8b9dd8e0e686cf62e2e14ba258c807c68f882651331514576b084c16c", "object_relation": "sha3-384", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038935, "uuid": "78fc524f-f7c4-41cb-9e66-275decc763ad", "value": "T160E412389E26A030E27CC1782DBBD7C6E7B23B7C904DA6ECF559456C8903A152E71D1E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038935, "uuid": "ac34f615-bf4d-4197-819d-83a6a6ba8084", "value": "3072:XSgWiG5Z++yxJU4djtxx0SA0cEaEwj5hsXk6h4x3OOPi+RA5KYncoJMZ:XSXvl4djtxx0ucEaHiXkllOU9o/AZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679038935, "uuid": "1314d22b-db86-41d0-acd8-d7707b8d5170", "value": 700620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679038935, "uuid": "08459ba2-fb7b-4cb4-a90c-a30184c5180f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038935, "uuid": "162a33a2-51d7-48d0-84c0-d294c91636af", "value": "842-2039340.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d14564af-c49c-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1679041332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679041332, "uuid": "bbce81d9-986b-45f1-a371-8c0ec89479dc", "comment": "Malware payload (SnakeKeylogger)", "value": "99231f4e730c8f29ecb938b660a39f7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679041332, "uuid": "f50d2a69-33a5-4959-b8b2-93436c6ef992", "comment": "Malware payload (SnakeKeylogger)", "value": "62758894e98e720e0ad4e1badce4dd3322af60e4659a243694e057358b0fc305", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679041332, "uuid": "c374da38-f3a6-42a8-a8ff-ca79bf25f572", "comment": "Malware payload (SnakeKeylogger)", "value": "402707ad3db26f9f4a59d7f046c4c6588f06a6ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679041332, "uuid": "ba38227d-d86b-4689-9fc5-1683b7ba26cd", "comment": "Malware payload (SnakeKeylogger)", "value": "8a1cda47503ff3858ef8f3055623759a2e32b9a253afd0d0144783b1e762da111613b8b2a7a6a62c5e4a0227f3ab11ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679041332, "uuid": "8d224802-9c4c-4112-bab8-deaa48180942", "value": "T1C7441211A1D0E9EFC0A22A72187D9FA96BB9780F5878531F77012E297723851CB4E3E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679041332, "uuid": "5b80e97f-62d0-4fce-847e-492e53344345", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679041332, "uuid": "42d3b0e0-2720-4c38-8955-ca068015dcc7", "value": "6144:/Ya6+GVkoUtP6RC9zPLQ45SjandjFnINb6b3:/YAGT4P6RCL64jFDb3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679041332, "uuid": "29e79723-dce7-4919-9f98-5424024bd58d", "value": 261278, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679041332, "uuid": "e005a161-0b48-4c52-a368-dd78815b5b92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679041332, "uuid": "13f0477e-6b66-4fff-94f5-e852555506cf", "value": "New Order list.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55d637ee-c497-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1679038977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038977, "uuid": "5535bb9e-0d54-4dff-b811-8c7c1fe2e00d", "comment": "Malware payload (Heodo)", "value": "ff762b2f28c3bcaaabcc6f7656f92d50", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038977, "uuid": "1f743f1c-17fb-4edc-8c58-9e20d644669c", "comment": "Malware payload (Heodo)", "value": "62ff7b52aeac2e32e59d8168cd55db1522de07833d476c8e26b36f40724bbebe", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038977, "uuid": "5e0d93b8-2c2e-4a91-a353-41ccaa608858", "comment": "Malware payload (Heodo)", "value": "9448c2d43c1e7155a4003d513c95f42fd29a2b7f", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038977, "uuid": "f9cb35fd-07f5-4877-8994-cd4362388000", "comment": "Malware payload (Heodo)", "value": "09f34d8c38dfd6f4eac1e6e971a065478e5484caf5053a79336b4f094f686cc46080740f616f90bec2b1494d79c005e9", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038977, "uuid": "f1f077b9-5633-4f2b-b717-7123973628ab", "value": "T196C33BF1A8025C0AE123C976B1FB661399D052ED42283B2BF87D507DD978A20D5DD8EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038977, "uuid": "cedef87b-272a-4bba-875e-07204ec15178", "value": "1536:RDBoTVdaeNtuXndCrJJmT4HVnteV4FrdMiYcx7bfCb6HPdnX7:1BoC+tCYvSMVnte8ZP1Y6JL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679038977, "uuid": "d8c50e81-99ed-4402-a0ff-937608e8646b", "value": 120428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679038977, "uuid": "b6b7f398-e10c-4135-8f5d-8779a25fad40", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038977, "uuid": "ba745753-bba8-4912-b532-c291e1f9d830", "value": "Insight Medical Publishing.one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63ffe9ad-c4c4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1679058328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679058328, "uuid": "5973dfc6-4db4-4337-9f56-7882a683c11a", "comment": "Malware payload (Gafgyt)", "value": "7aecc52b9e9e079a5680624af29a8e9a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679058328, "uuid": "4d50706b-6712-4d66-a89d-e30502e90ee6", "comment": "Malware payload (Gafgyt)", "value": "639c421f9fe6d3d9b4d854a24ef946111377cf138cea4e96de9cb86e53f9d863", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679058328, "uuid": "a361d7f4-dc2f-4a65-a2ba-2ab32afe71f1", "comment": "Malware payload (Gafgyt)", "value": "65581c121d3d8a7d2b88a498b5ccf65567808c91", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679058328, "uuid": "ca13c1f5-8cd0-44d7-9fb5-ded1e851d854", "comment": "Malware payload (Gafgyt)", "value": "938de50b928c5ae8bee5ba88b9699c4f15e327206988aba61e02943d73eb88b8036a7f114815f62b7a5394594f0a4f15", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679058328, "uuid": "4969e9e2-47e0-429b-9310-eb133e974c6d", "value": "T13E73B449EC51673BD3E23BBAF79942CE73381E842B873341962839F45BF4B995939120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679058328, "uuid": "c7639d54-bbcc-4cdf-bba2-30c3a7ea2826", "value": "1536:OyOOdKecG+mW0BZKPcxiupuMmMpR3oU75dly8IE684tXwnD2YkQYijj+XJ6E0Osm:FKecG+mW0BZKPcxiupuMmMpR3oU75dlS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679058328, "uuid": "fd351df1-11ba-4b87-bdb8-406222a2f528", "value": 79780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679058328, "uuid": "34406b65-9b88-49c9-bf62-d2cdf7ce5bab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679058328, "uuid": "33b3b048-43e0-4636-9649-d08a160ee620", "value": "7aecc52b9e9e079a5680624af29a8e9a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84f21bb2-c4f4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1679078999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679078999, "uuid": "fba7b70a-545a-465d-917c-c86988fb45a2", "comment": "Malware payload (Rhadamanthys)", "value": "acd3c002dd883ef7b129b89f189c96e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679078999, "uuid": "9dfde21d-a521-46e2-a72b-46b7b67295eb", "comment": "Malware payload (Rhadamanthys)", "value": "64185e173d29c3c572c8ee4d0091aa8f500abf4c6083fd4a1596eb07420ed526", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679078999, "uuid": "1dda211d-2a16-4740-b59c-6775cf6136da", "comment": "Malware payload (Rhadamanthys)", "value": "f402a77a8abe3f9e1a3d6362be774c78449b6afb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679078999, "uuid": "1b713ce3-8024-4060-b73a-339e1c00b55b", "comment": "Malware payload (Rhadamanthys)", "value": "2728d1c4443e030be904284f86c0f2ca5c88f377cde1e6e79266c8376b53aae8ba4edd08c335e1d8f8760e8dd8c8a6f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679078999, "uuid": "d01835f8-c7d4-47a4-8681-41c51e8fd150", "value": "T1E9744C0392E17D58E9268BB29E1FC6E8771EF6518E49776932289E1F04B3172C173ED0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679078999, "uuid": "8a083048-0b01-4e09-bf03-a04ef0ccbf4b", "value": "6e76b494f1a9946f83b6b72033f310be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679078999, "uuid": "4c9a8f5e-258e-4c5f-b82b-0edfc754630c", "value": "6144:eSJ7LoD4/9hHBxjItFphQ0LHY9DHjwjirCgGRvBUqu:hJ7i4FhHrUFo0LHYBjwG9Dqu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679078999, "uuid": "72322442-a1d3-4c76-a71f-35169443405a", "value": 367616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679078999, "uuid": "34a1300e-cfe6-433c-b62e-7717ce9dccbe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679078999, "uuid": "635c3b56-f0d8-4fea-a26b-cde10d226f2d", "value": "acd3c002dd883ef7b129b89f189c96e9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82d3745f-c4ac-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679048072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679048072, "uuid": "20d0662e-1aa7-461f-b71a-f9b6c23f68c9", "comment": "Malware payload (Mirai)", "value": "379f6cf59a69e45dbc6ee2c03ed81894", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679048072, "uuid": "7693a150-29aa-43df-93ca-b144c81a08a6", "comment": "Malware payload (Mirai)", "value": "652655dd5b436827a67317badf429dc87625507e2a59931a5c31e51b6d951c46", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679048072, "uuid": "5bee20e4-fa79-4405-a78d-64ffec9d25ac", "comment": "Malware payload (Mirai)", "value": "227a0d6d56e1452cabf5027acbe18a8fb260c6d0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679048072, "uuid": "a6a5cb3c-59e0-42e4-b99b-996616d6ac31", "comment": "Malware payload (Mirai)", "value": "0267ae23cb338a8c7f98f51ba702e1f681054a176d124617ec0309ad71c1754a9df4959b31fe9e97bd80a6a7d068fd65", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679048072, "uuid": "d34cb0b1-a720-4f59-b21c-5cb2c8cc06d6", "value": "T197B31877A4654F73C045A5F125BA9A310F12AD931B1F1A88763CB6B04A3B4CEB84EF58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679048072, "uuid": "f2504df2-8810-42ec-a97e-1b48af90d5c5", "value": "3072:MDVLSItJP+Xsp4JlN3HSjmH1cuEgvniuN/:MDV+ItJH2l3HSjmH1cuEgvniuN/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679048072, "uuid": "06b8a36f-f484-4dd4-acb2-8aa68ad74a74", "value": 112633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679048072, "uuid": "5633f9d4-f2f6-4db7-8886-b946668a353a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679048072, "uuid": "113306ca-79be-4b30-aa49-38efcf5e1c3d", "value": "379f6cf59a69e45dbc6ee2c03ed81894", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20b2260a-c45a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679012689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679012689, "uuid": "11106b39-6495-4997-ba06-015731165722", "comment": "Malware payload (Mirai)", "value": "d0432569a005014607c1cad8e7d6805c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679012689, "uuid": "c307dd16-1c09-49a6-b2c3-852b6313c10e", "comment": "Malware payload (Mirai)", "value": "655fd0f2d7259398c2a0b8eee008ac117edc6b99855a35267098f3828d13f3b1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679012689, "uuid": "5e828089-7648-43fb-a1bb-b41e83edd8d6", "comment": "Malware payload (Mirai)", "value": "857bcaf52dcd59b8bd22edebf16f9410c530820c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679012689, "uuid": "66147af5-41b0-4c26-861e-f7297bdeaecf", "comment": "Malware payload (Mirai)", "value": "4d2bb5b30c832abce69a7444d920be435224a1a341d675bf8b43c0d83c6a726d02c6f926fcf510b67b0a9fd37bd5afc9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679012689, "uuid": "1617409e-ba9f-440e-a6e4-8dae32d1ed92", "value": "T14CD2E1B1499048A0E870AC3BF6EB9C8663E045F9C3DF61961914D3FCE6C558DAABD702", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679012689, "uuid": "fc147345-42b7-4831-9ed0-91b979ed3790", "value": "768:POaI76NPhbT71BFI4tiI58m+3rJDirj7s3Uoz6:2anNx1BFBt/58DNhz6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679012689, "uuid": "57f2f657-c855-436b-ac78-b8326547634c", "value": 28840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679012689, "uuid": "70dc61f3-930c-4258-b4bc-a276ec688cf9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679012689, "uuid": "927533fb-ed4f-4c39-a804-e36c409edf1e", "value": "bok.arm5-20230317-0024", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82a90482-c4f4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1679078996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679078996, "uuid": "f381c0e9-1bef-4847-8d29-3652169d8bfd", "comment": "Malware payload (Rhadamanthys)", "value": "686ce224ff1e699b91e659f68d7af79e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679078996, "uuid": "058a76c5-60c5-4632-a7e1-67efefff4fec", "comment": "Malware payload (Rhadamanthys)", "value": "6587e53011210f12f8d020923dd79268f8245df0a700e7d76f9cc5a2eb251468", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679078996, "uuid": "f45f650e-363f-44b1-a899-38d0f901f30b", "comment": "Malware payload (Rhadamanthys)", "value": "0e04e29fb32642071819dd73e07c21d4081c9d16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679078996, "uuid": "d0e914c7-f66d-49af-a48f-08036c9592b1", "comment": "Malware payload (Rhadamanthys)", "value": "15ad9cb2ce3671e5cd22a594d499b965b4de1b1f5b3404c959a6c129aee4dc5ac746439388075ffcd8c14d6bcb697f09", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679078996, "uuid": "0e2c4b8c-8228-4c8d-b6b1-329b3b69370a", "value": "T1C5745B039AA17C48E9268B729F1FC6E8771EF651CE8977653218DA1F04F21B2D163F90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679078996, "uuid": "76c84a23-c8bc-4e39-adc9-e34263dab1b4", "value": "967eb4f66af509da0d8ad27d2261daaf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679078996, "uuid": "9aaa527d-7dd6-436c-b9b5-bbd7b5f11a4d", "value": "6144:fVJLLIVve9CYS8ZqT+hHueZbHFSxUWerIkwq1btgu:9JL4vSc8Zy+VlSaWerITq1Gu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679078996, "uuid": "a5c4ee0a-5c70-4fb2-94c1-67ef37e38f40", "value": 367616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679078996, "uuid": "5c6dcceb-b982-4a11-ba11-8195739e0ec7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679078996, "uuid": "e58622ab-e50b-40a6-a0c6-0c05d75f0f4d", "value": "686ce224ff1e699b91e659f68d7af79e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57b503e7-c4c5-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679058737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679058737, "uuid": "e09f325c-05d8-48ef-846d-0ce81c47ba26", "comment": "Malware payload (AgentTesla)", "value": "4d5cb7f73fc9d140b1e1eb1f8ae31229", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679058737, "uuid": "141e9e22-8c96-47a9-bd65-21ba205e663e", "comment": "Malware payload (AgentTesla)", "value": "65961141ef07880ed8dcf33293808d3969b956803cc5ec255ad060c38dc3b797", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679058737, "uuid": "69fe173c-c15b-45ff-bb98-befd9e19558f", "comment": "Malware payload (AgentTesla)", "value": "e39dd6a1cc2c082c630f78cef931d99f687499cf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679058737, "uuid": "24e76986-1ae8-4b71-82d3-0fbeb7a92943", "comment": "Malware payload (AgentTesla)", "value": "164868b2b1e6024c566a03df88a957fcd24050e966d5a4f5fae4ecf76061489b0a51d4326c84fe654d76cab0bed2e5af", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679058737, "uuid": "6df858f3-4a17-4570-82f9-b353713e032a", "value": "T173B4122073744B2ED9FB87BA9E69A00213F27821FF33E7461CD561C628A23414956B7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679058737, "uuid": "7f0090cf-5b21-4a02-9aa3-13c349f21287", "value": "12288:WJvqVQNkLN8Be6McYI7j6GPkb8ff/pQhIRYJAWD:WJvVNk5zDctiukb8/jRYKW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679058737, "uuid": "b89c55ce-fec1-4864-ba52-22b9bd2bedf8", "value": 505344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679058737, "uuid": "cbc7ec03-1bb8-47de-ad91-74c782437d68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679058737, "uuid": "ab78fb73-348f-494b-ad50-59fb02e64cd3", "value": "Pago 202303078008.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f33c6ff5-c4c9-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679060716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679060716, "uuid": "384e5d28-4241-4e68-9dc9-a7a84d1692cd", "comment": "Malware payload", "value": "57a7e6d6937cf04f72f301d16643660e", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679060716, "uuid": "c67ef9c4-57e6-4928-8d16-211500fa4242", "comment": "Malware payload", "value": "65a73b946adeca7edc624d85c9af02b3d607e1e65df2580a32fb143b9c40fc7f", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679060716, "uuid": "99b0836e-1008-479b-9f43-c6f7dc1f1e22", "comment": "Malware payload", "value": "19b8e3549404bfa9c50e77ea762dc58394393ac1", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679060716, "uuid": "1f9cdae8-12d4-46d0-ab4c-186f7fbb0428", "comment": "Malware payload", "value": "dd8183bf03298bce52ab532733b6cb27e4945759d2ecf73e40a55bbb076f0be97204d3fb83fa999c4a508ac0a79aa926", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679060716, "uuid": "f724110b-2c15-4b5f-9428-33da82529c32", "value": "T171A5025813D88A2AD1DE6F77ECC16748C3B4DC4CAA0AE70FA9C47DD82D1A79948421DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679060716, "uuid": "9447c0d6-7891-49f0-aa69-65dea9c44d54", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679060716, "uuid": "9220706d-ec63-4057-926c-12836098cb36", "value": "49152:h57GQzkInZDKSA//Hx6x53+8uHnYZBSRQfh2NaIkGWcLZ:tiXHAxBZwYrYQfh2Na2WcLZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679060716, "uuid": "50b8d944-85ec-46b6-88c0-4dd2aee52027", "value": 2193920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679060716, "uuid": "5936bc71-9a2c-45bf-8ab3-2d7faf056738", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679060716, "uuid": "a56e4f81-3a26-4e77-8ccf-7d410e7d2584", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de83a9c0-c48c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1679034482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679034482, "uuid": "789e820a-6bdd-4039-8771-3d1e2655ab82", "comment": "Malware payload (Formbook)", "value": "bc5990cf2de459a2dbaaded72599b152", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679034482, "uuid": "5884ed22-a834-4c39-976b-23eb58c5162b", "comment": "Malware payload (Formbook)", "value": "65ae1550333eb53329dab317b8f238dc060368d982b30a734ebdf0604d61a06c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679034482, "uuid": "67a2e35d-9bbd-40e4-9a70-0fa5586117fe", "comment": "Malware payload (Formbook)", "value": "9de77b7d7f25881781add6a24d8255c921575872", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679034482, "uuid": "932eda92-f1a8-4ca0-971a-43a90879ee8d", "comment": "Malware payload (Formbook)", "value": "08242a42885161c300409e43554b6d8c29ec9d04e92c404a27b334ce5152b51169a5b0263a966b84d0508fbdfecada99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679034482, "uuid": "fbeea29e-da1b-464f-9e0e-c111a7468fed", "value": "T17E25DF68B72DFB30C6FA53B9ACF124D643E39C5A5625E2485CDD74EA3732B61840384B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679034482, "uuid": "cab1eb57-6872-4124-a465-9de11c7f74d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679034482, "uuid": "ef24b89b-5eae-430c-809b-211b585f005f", "value": "24576:6jjkj+caRJ+SSx0hLaAe2lmSiWQc2/CiM:6jjkSPQG2AVSCn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679034482, "uuid": "2171e991-ba75-42ca-9528-925a2bf465ec", "value": 986112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679034482, "uuid": "c2eaf046-828d-4d4f-9d6f-449af81f2d39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679034482, "uuid": "68af195f-0b9a-4699-b667-7629060de55f", "value": "SecuriteInfo.com.Win32.PWSX-gen.20725.32698", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c5d89d0-c4a2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1679043632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679043632, "uuid": "a90f97ba-19fc-4f78-a7e2-085518e07863", "comment": "Malware payload (Gafgyt)", "value": "8e835bac581417cd3a9674dcef2fde62", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679043632, "uuid": "899d3a70-f82b-4817-94cd-a3634fbcf252", "comment": "Malware payload (Gafgyt)", "value": "65b7e106c0cb4571fc5541ba6eaab9f5bcebee215bf16db209d86c64f063d6ca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679043632, "uuid": "aa3e46ae-13c8-4062-b1a5-626479389214", "comment": "Malware payload (Gafgyt)", "value": "66b0478f4dff41303d8ea6d49978dd12caa1d668", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679043632, "uuid": "3fadcbac-74b7-412f-b268-1598f1371ac6", "comment": "Malware payload (Gafgyt)", "value": "8f99843b2bce969049eb4e8fce1d0791d32277f0d8be07e4859b9d63dedce2d2c251647551f565dfb00f1f9c79ccd74c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679043632, "uuid": "113ce322-aa69-4e8e-b2fc-75e52a310315", "value": "T1C3B3B517BB619EB7C85FCE7306AA4501208DE04612E87B6FB2B4D96CE74B94F08E3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679043632, "uuid": "65cdc166-377c-4f97-9c5d-cae6b9377ee3", "value": "1536:aWHeT6JgQiRYSIlZHWyhXqyxUIeXyJwOJdacR5Cugm1+XFBk/1P2wv:RIcMtGwU4Ehgm1+XFBktP2wv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679043632, "uuid": "cc20a484-028f-4e0f-ab0c-6190eef3301f", "value": 113663, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679043632, "uuid": "388a45a2-8a22-4ea0-bbe4-9c14891f6910", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679043632, "uuid": "eb1f68b8-9fbf-43b9-a36d-2832ff7c0b29", "value": "8e835bac581417cd3a9674dcef2fde62", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a0039fd-c4e8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679073693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679073693, "uuid": "14c774d5-cf7d-4d27-855e-520c8463adff", "comment": "Malware payload (Smoke Loader)", "value": "ba9031fda852359a25f523add938f3b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679073693, "uuid": "ab5318e4-f648-4556-b75d-87093e5c814a", "comment": "Malware payload (Smoke Loader)", "value": "65c4466e69c4b05caccf5c56be42676b0fbfa9bf7c609aedcb34145dfe3c7100", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679073693, "uuid": "1a5015b2-b476-47b9-b3c8-92735343eebe", "comment": "Malware payload (Smoke Loader)", "value": "1a745a18138d437f3a614f6271f9cd78053c5953", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679073693, "uuid": "28f7b8e2-8da9-4314-a848-6ed7484f81fe", "comment": "Malware payload (Smoke Loader)", "value": "33f852ce9bb961a3de1dd6847848a1ff12accb8ed460e8d940f223e9a2ef3fc69f94e571af30ac14d525801ff6b2c599", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679073693, "uuid": "69e8d1f3-0d19-4e43-bad9-9e02dc0f80a6", "value": "T1EC54294392A17C8CE9268B729E1FD7E8771DF6518F89776A32189A1F04F2172C163F90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679073693, "uuid": "25d1d40b-02d2-4446-a1b6-4db6dc771883", "value": "6e76b494f1a9946f83b6b72033f310be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679073693, "uuid": "e91b8d9f-0f8a-4191-9bde-6042c2771230", "value": "3072:K0dnLgZLyVGudtLal4ZwDtQ0SyCADID7B2sLOAtJ1EP0+9I4yqitZuM:LZgZLykugOwD3SyClnQSOAtJ1E8+0fu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679073693, "uuid": "60c66deb-5acc-4707-87e6-3fd143035baa", "value": 304128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679073693, "uuid": "d499c581-0726-49b5-8cd9-cc7564c31783", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679073693, "uuid": "2c527e44-eb76-4bc6-94ed-577f5d1668c8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36db6bfc-c4a6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1679045368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045368, "uuid": "598ac4f0-48e3-4d37-9b9b-a7e019028c9e", "comment": "Malware payload (Gafgyt)", "value": "28adba68b28adca4c4c470582b2acd52", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045368, "uuid": "2f66478e-0cca-4571-8a0d-3645c5f4e46b", "comment": "Malware payload (Gafgyt)", "value": "661e2400c7619e5085a689f92d2b511cb24d8e4f4f3f354565333e9b45b8351f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045368, "uuid": "61a19dd8-c496-4499-9b02-7023e0217ff5", "comment": "Malware payload (Gafgyt)", "value": "18102ecbf0809417a27ae2ae7ab5679f3b8a87b4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045368, "uuid": "0bc05a49-13f7-4cd1-b10f-2b02fbfe296a", "comment": "Malware payload (Gafgyt)", "value": "f9f784d51143b7ff4ca408b0cc7e05bfe9d7f44f674396a692927626bf27bc8430acfe88b3d1ce3bdc30b32bb434e219", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045368, "uuid": "0b5e8786-b673-4b44-9324-e176456dccaa", "value": "T17CE33A05DB808B57C1E2277AEBDF424933339B54A3E733095928ABF43FC27995E26116", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045368, "uuid": "e143283b-f012-4050-b12e-dd27d6a57b7a", "value": "3072:UC2M7tBk006JiajmtvHwTC70YMM/9RdmQwfHcQrAN:p2M7tK0DJiaoP8C70fM/9RdmQwfHzrAN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679045368, "uuid": "71526704-bfab-4f49-899d-b618f2c76c41", "value": 150529, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679045368, "uuid": "a03cd510-57d0-4525-8bf2-f93ade5c6eb1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045368, "uuid": "f4e6936c-6262-4df8-ae45-89f8548ae1ac", "value": "28adba68b28adca4c4c470582b2acd52", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ee5d95f-c4ad-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1679048361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679048361, "uuid": "044767e0-0e90-4e82-a1a2-b4e30a9b2783", "comment": "Malware payload (GCleaner)", "value": "d05ef81ac5b06b66781eaea972cb2f47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679048361, "uuid": "d425d2d0-92d7-4e64-86c3-de3524f6f338", "comment": "Malware payload (GCleaner)", "value": "665687b64c26cd4019dd0e43415dd4978c2ed59c7c897462f3cd64c4920e380b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679048361, "uuid": "d36f9908-90a8-4c23-8181-a61043da878f", "comment": "Malware payload (GCleaner)", "value": "c2f706da55db84c9be7a9ea8a6bd6a7fcc38821f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679048361, "uuid": "c6a0010c-e5f1-400f-8c5b-9989f6027725", "comment": "Malware payload (GCleaner)", "value": "48c24a802a34093015e45c0e99ca4efadbc89371d51d6c5d6a002a627d97c20b8b789b53cd5de0705b66388417b7a7b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679048361, "uuid": "6dd6cc78-b5ef-4d32-bfc1-2ac7e92940b8", "value": "T1C4C5331656D408F6E8E1D9706C0386657937EE13072EA59462DC1ECC0F6F846CEBE2EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679048361, "uuid": "ca7a033b-2550-42b9-93da-45a7b7908949", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679048361, "uuid": "5824f9d3-03c7-421a-9830-2b2d0f4de94b", "value": "49152:EGlJfsRCVMPPVMVY8Mkac1f9/WCxUyE2J5Gpn7DhyMMG999TaP5bZ2Rozh5dlLYp:5vgX8MX6BH+GjG5nhyPG9TTaP5bkWPYp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679048361, "uuid": "9924e563-440e-4ca7-b537-8648e426ef19", "value": 2589885, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679048361, "uuid": "88bdd1e0-3f5e-425f-9e03-7db1b3295376", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679048361, "uuid": "8b33ab59-bdf9-4e55-8eac-4fed6385c9bb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "474424b5-c4c3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679057851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679057851, "uuid": "a90f9dc7-9233-49e0-87d8-855c72c5b211", "comment": "Malware payload", "value": "e6303811107fd9197a0cd5cb29830b01", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679057851, "uuid": "a16cc9d8-5eb8-4c0f-8c50-fa3d44954ec4", "comment": "Malware payload", "value": "669268b2187fe478c76bf4c28e4791b8f76bc331eb2d1330206b3bfe4b12d46b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679057851, "uuid": "1ca1fc38-9f38-45a4-9007-407751c037fb", "comment": "Malware payload", "value": "99e275839df792f9cf44a8dfbfb64dc907fe6fa1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679057851, "uuid": "fd116de6-6dee-4823-9249-0b3e542cbbc8", "comment": "Malware payload", "value": "1fb251f08fcea26c098c64557668e0c745e11f8373a5d83960dd6ea368c7654fc2249e2aafaa053f2c4be9273dbb8411", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679057851, "uuid": "cc149a09-8e36-401b-bf24-c41f12070583", "value": "T1AB85BF737AC3FCDA27F68944E88634844D904CFB932C90A4BCCD617A99F5468EB95DB0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679057851, "uuid": "392e9e25-c35c-4aca-bef1-0f8094aa653e", "value": "24576:gvRVVZLaH2AqQa69fz2Upkhj02Gj0JQd60Qr1SSfc8+K8ASzfNQS0cNEgbCSFn0:AZaUlLnE7XmcNEUCS2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679057851, "uuid": "932a99c3-ef5f-40ba-a67e-5c345ba079dd", "value": 1792684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679057851, "uuid": "2329bd8b-7a8d-4223-94ad-ddba0951f366", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679057851, "uuid": "3bf9483f-233c-4e17-a36e-bde17531a825", "value": "Anrwqjqr.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ed728fa-c4f6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679079714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079714, "uuid": "937d935a-545f-4e5b-8137-8e46ed084efc", "comment": "Malware payload", "value": "7aaac014118ba6b6391bc2b52d2790da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079714, "uuid": "892d0605-8706-4c20-a37b-717daac5e55f", "comment": "Malware payload", "value": "6881828efde486122c37efd3d20ad30300f747ac1ad2bcaf2be62ef7d8add52c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079714, "uuid": "8f72b527-cecc-4325-8d60-72d34f1d1615", "comment": "Malware payload", "value": "a92e9f24859e55ad59d73b833a1142a8dec299de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079714, "uuid": "832288e2-e78e-45c9-bbb8-b1520ad8829a", "comment": "Malware payload", "value": "fae1f8f20ea7471ac29d21b7ffff1f3517451e32d85cf95a29a1f8cc8c467aec63b4a1fd6811cf756c49b6d4fe3ce37c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079714, "uuid": "461f54a8-aeea-4abc-a28a-356c978a209b", "value": "T153D52253C6A07C44EA168A7B6E1FCBE8621EF560CF4A77F61219DE2F05B11B2C163712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079714, "uuid": "cae76aa8-bf41-43a2-a5db-a101ace6c575", "value": "48e7bdebf7b90ec755513d967cfa38a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079714, "uuid": "1879fefd-eba6-45d6-8958-1491efc41381", "value": "49152:Y+t8Il2Zp5WvMMq1QlnpKrWeHqAiRevstycpjM7kXbUepVc:Y+trl2ZrVMq162IaKAoIU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679079714, "uuid": "31860e42-23bb-49b9-b07e-d1300ef600f1", "value": 2788352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679079714, "uuid": "1afa1ad6-d2ca-4fd5-967b-d51982c9b67e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079714, "uuid": "2d82a4ff-276b-4682-9601-132b2156b83f", "value": "7aaac014118ba6b6391bc2b52d2790da.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bb4116d-c4ba-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679053966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679053966, "uuid": "5259d9bf-91a4-4fbe-a2d6-d787a0d8cd0c", "comment": "Malware payload", "value": "f901abba1667ca524cb5d0a6c07b1f0c", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "firewall-gateway-net", "colour": "#3FF98C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679053966, "uuid": "38641d4a-661b-43f2-b355-716064368945", "comment": "Malware payload", "value": "68ee8152af2d5167e0e959f0e2c1a00d7b1c7a09a37f51675bffe634244ff735", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "firewall-gateway-net", "colour": "#3FF98C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679053966, "uuid": "0243fd98-9ba0-4fcc-b7fd-139875ce036a", "comment": "Malware payload", "value": "b027b08b940ad46e4de47c81699978d16fbca34e", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "firewall-gateway-net", "colour": "#3FF98C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679053966, "uuid": "1e1bc671-1307-44ed-b1a3-6f795fbf335f", "comment": "Malware payload", "value": "4cb6d3414e9b9509b1d760a3fe7d75ade812f2c37d88d523c9d266058d5c40fdf035f024364455a45e088c93e2937425", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "firewall-gateway-net", "colour": "#3FF98C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679053966, "uuid": "b33c1168-c79f-4b89-a076-793b15e71c45", "value": "T15391DE347067A2A7D777F310F10F6AA39A3B12C364A1879136A7202E54E700BD53F2D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679053966, "uuid": "a1d3ab35-01ca-45d2-8e4c-5da061fceea6", "value": "96:fJKids5J9bkb2GvbFx661TrdEiHHrk8QmPEdzzWh6QoFG5B:AIH6Xk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679053966, "uuid": "009ba063-7c39-4db6-9d30-bd6e781bfb5b", "value": 4410, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679053966, "uuid": "5140a64a-359f-4ba4-a263-b216366b3519", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679053966, "uuid": "1e3bb760-4638-4cd5-884d-dee4ae0388f2", "value": "ar.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4ee80c2-c4c9-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679060692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679060692, "uuid": "db155bdd-e08a-4cbe-b7ee-af91c7d5378f", "comment": "Malware payload (RedLineStealer)", "value": "54546de4677b45d4027496c700bdcb8d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679060692, "uuid": "e6fea987-d9eb-4f92-bda3-c46755f3f0df", "comment": "Malware payload (RedLineStealer)", "value": "68f84e9ad7e2198c75aad9f36185b83dc7eebd0ed346b242be8394919de4e706", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679060692, "uuid": "053c425c-bbc4-4d0f-9e55-d1906c1e95bf", "comment": "Malware payload (RedLineStealer)", "value": "3ffa475dceee64afe9e171eda6e17dacf4b253d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679060692, "uuid": "2073f4bd-91b9-4cc2-a8b8-0b377ca3e3cc", "comment": "Malware payload (RedLineStealer)", "value": "c83f402d26c61bdabda239e9e2927aa6dfd37e9d47b365e8564f63557f6425ce1c3add9b006b06d475f028866a670238", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679060692, "uuid": "bb10721b-68a0-4ae3-8aca-c131fba0bad9", "value": "T1D2847C438AE17D50EA254B33AE1FC6E8761DF6618F497BB52218EE2F05B11B2D173702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679060692, "uuid": "097b096a-6191-420f-a5a6-9864015ae677", "value": "800c211657980cdb5c72386d0a0450fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679060692, "uuid": "ecd06b49-3e52-492a-8be2-6f303f975c7b", "value": "6144:k5kL8HiVNY+rYPlpeFh0O/1GtAbgewIKkWiYry45:k5k4HiVN4peFhL/1SewkWiY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679060692, "uuid": "bb825b3d-4d36-49d4-a5a3-77ab0f58e8a6", "value": 400896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679060692, "uuid": "41fd9159-ba65-4249-854c-71d6670e9561", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679060692, "uuid": "fa305418-062d-4f73-afda-4eb62ac45e13", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "670ca9f1-c4e9-11ed-88f6-42010a9c006e", "comment": "Malware payload (LaplasClipper)", "timestamp": 1679074225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679074225, "uuid": "1031b02b-2eec-43b7-9b67-41a5f3237c4d", "comment": "Malware payload (LaplasClipper)", "value": "3e59d07d7af4a0b0314ffcbff5fd12d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679074225, "uuid": "8dd80298-e3a4-4061-93e7-d41796a2f56d", "comment": "Malware payload (LaplasClipper)", "value": "69907205fca8a3781a663861c047615c2e0dc3a23118d11b9e8edd26fce6b666", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679074225, "uuid": "0fe58404-cadf-4736-a806-2edfb8e05035", "comment": "Malware payload (LaplasClipper)", "value": "fc32ffaf265d7b38adc59092c967babf1fd92baa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679074225, "uuid": "7ee32fd5-1896-4f66-9802-400b654025d8", "comment": "Malware payload (LaplasClipper)", "value": "e038c08e4b8f3b4e700584334239839f9cd59bf34aa19951bfe0ffc4417fe1f102f45d96c171f580a203fcb8fbafd4f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679074225, "uuid": "b60cd0e6-bce5-4e96-a8f1-6270e52a9461", "value": "T11054394392E13C6CE9268B729F1EC2E8771DF6518F89776932189A1F05F2172D1A3F90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679074225, "uuid": "90706f04-49c1-44c1-9d11-dc7b84193dd3", "value": "6e76b494f1a9946f83b6b72033f310be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679074225, "uuid": "14e71784-79bf-4796-b009-e9a72b59d25a", "value": "3072:K00SrgXL3lGpDb5WsSHACy7jsHx9CXeNyeIJ/EEMnI4yMitluM:LngXL30pD9z7npXeNyeu/ENOZu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679074225, "uuid": "bceed033-e0fc-4ef8-99f5-cf9b047d384e", "value": 304128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679074225, "uuid": "91505c32-8d92-413e-b6ca-80a00dd07e7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679074225, "uuid": "76cf2fa0-4915-4f85-b1ac-802a2a710a86", "value": "3e59d07d7af4a0b0314ffcbff5fd12d8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "815da097-c49e-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1679042057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679042057, "uuid": "d526d056-0832-4442-8e26-fb450eddafbb", "comment": "Malware payload (RemcosRAT)", "value": "c3d2ba2be0d4fb2f6d16de6f9bc4ac40", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679042057, "uuid": "7a923f69-0928-4342-b8b7-f2d991efc8e0", "comment": "Malware payload (RemcosRAT)", "value": "69ad80f83ce94ae00c8f44304f18114d189ee068050262b75eae15ad53380eb8", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679042057, "uuid": "0c43f0f1-a2c2-4117-b4f3-6503db4ed0dd", "comment": "Malware payload (RemcosRAT)", "value": "77ed5252cd6b3fd672cce540b82a6d41a6fb8078", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679042057, "uuid": "036212c8-cd92-49ea-a593-9af5a38ee79f", "comment": "Malware payload (RemcosRAT)", "value": "f1358e9bb6c2425abc65fae2ad28821c5dc03a8fe48082adcdc16702e99c054542e62f949f6ce5c59c13c309cf12488e", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679042057, "uuid": "851ed807-9f2b-4686-afa1-e96785d70aca", "value": "T1B145F12FB244DF49D4068BB86E53F8D9420C7D24ABD4B5873691771F2F325A26AC72C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679042057, "uuid": "294be2cd-89dd-466d-aee8-cbe93ace43a6", "value": "24576:gLKeWQmmav30xnd59d55T92glZoW4srTGb2K+qP4Wk:gLKTQmmQ30CsXGbJ+qA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679042057, "uuid": "6478a3e4-9bc2-4507-869e-ff9c0880c93d", "value": 1224192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679042057, "uuid": "3f00c005-bd54-4aae-a9f9-4a1c174e5253", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679042057, "uuid": "a6327ec6-fdc6-497c-92b6-d600ebe34b53", "value": "16.03.2023 Sarob Trading SRL TOTAL ORDER.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0c73961-c4a3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679044337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044337, "uuid": "e0e31598-3f05-4be7-bb72-062baeb306a2", "comment": "Malware payload", "value": "de5666a98bc07594a7e963d1b41964e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044337, "uuid": "1b32d756-00da-4e89-969f-5ba6908c007b", "comment": "Malware payload", "value": "69dad24a8f1462ac71badad9daa7d50a1bfab5c2aec77d76ffb6b2c84166092d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044337, "uuid": "4b2521a7-6cd6-4e17-ab5f-f6988ebbb335", "comment": "Malware payload", "value": "f293c997602fdf800cd131c16ae43dad27532a3c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044337, "uuid": "d8bc485c-7dd9-49c5-9032-26affc45a02c", "comment": "Malware payload", "value": "f872dd3165b7ee138b2b96a056b948c196ce7190016a875cc5fb9527cf1934b631cf210efd9684048638ec6de9a00b9d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044337, "uuid": "c0a167e9-d02b-47ef-a7b6-3a39532d1fa0", "value": "T19DC1EB416FEE40DAF227073027EAB67B1665F8B1541E62F834848A599F30BD0C862FB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044337, "uuid": "b8dd2e28-b97f-414d-b661-c9f90f827a21", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044337, "uuid": "5196c71e-ce2e-4473-a891-19596fdc383f", "value": "96:I79aXQCFQdTpGwlNK+6z8s/Mlmvxd3ojfjrl:e9aTF+pLlNK+48s/MQxdy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679044337, "uuid": "e0c48f05-4f99-4776-94cb-6f133fdad646", "value": 5632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679044337, "uuid": "5cdfd107-c08c-4494-93bf-8d3712eb43bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044337, "uuid": "a5e04118-c0b8-4a59-8f6a-89c82ca48adf", "value": "de5666a98bc07594a7e963d1b41964e7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88fd322b-c4f4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679079006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079006, "uuid": "ab884f78-fac1-4433-b037-a000791685d9", "comment": "Malware payload (Mirai)", "value": "c632e624ff4d8d04ba071bf79ce3921e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079006, "uuid": "57361a0c-466b-4853-8ca0-d8637f2dd555", "comment": "Malware payload (Mirai)", "value": "6a115dbcb909563249115c03be76ef2b20bafd04a4356ce7d4970c876eb5cc9b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079006, "uuid": "cf4c7cf3-511d-4645-a702-c9457f63efb7", "comment": "Malware payload (Mirai)", "value": "870f8db3f00b8984f8705c2a26c4a7e8f540e33d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079006, "uuid": "6c26d272-385b-4421-b0b2-e50c28086882", "comment": "Malware payload (Mirai)", "value": "6a29cf2dbd21f48bb51105f8877cd3d117e1bb37e580b55af0849a08cf7e0388b07a0b9ec183a0ea6f24aa858fe16da5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079006, "uuid": "a5ef36a4-8fba-41de-bbd0-94094192ec35", "value": "T1F4D2F1B5AEBA460FF48A633C5EAEDCC925AC7C651BBD554A06401E233134AE1A7DCCD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079006, "uuid": "b5f0028b-f6c1-4b7c-8eca-b1fab184b99b", "value": "768:xN8fWlfoQmQAXV7EmQciiRcLprDKjJWqR:jMNXFl7zN4PeX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679079006, "uuid": "61c0f4a0-b5ea-4304-b856-d3d1fffbbbba", "value": 29904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679079006, "uuid": "71b22616-1c8f-42ca-9808-f996aad0efb1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079006, "uuid": "07b54168-8492-4b40-b01b-6104fdcbd906", "value": "xd.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c87223c1-c4a6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1679045612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045612, "uuid": "ab1436e4-77ef-43e8-99e6-bb8f2b8d9259", "comment": "Malware payload (Gafgyt)", "value": "2473b6762a42c578c937072008aa7401", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045612, "uuid": "99ed4a0d-33f0-4ce0-9a02-bb496e11016d", "comment": "Malware payload (Gafgyt)", "value": "6a1be32a96033e029fb7f396b69f1481a9a2a2f2bb0bfa5e60d8d2270fe9371f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045612, "uuid": "90424613-6336-404e-ab56-f2b79a02cbf7", "comment": "Malware payload (Gafgyt)", "value": "63994a2e4532eac4ebdca9a67938100583620dc1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045612, "uuid": "072d4483-70d1-4285-8c8d-c96b760de90e", "comment": "Malware payload (Gafgyt)", "value": "1a79d12664c39746e06cc0dba5460ab9e62a5e09bb08594d90efead49e7e7eabb6378c8d660186928180a19a08cf71c6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045612, "uuid": "c2793dcf-98b9-4e9a-bb16-33a9aa34a030", "value": "T1D2A35B8AD743C2B3CC530AB2124BA66A4621FD3B092EAF49F7197DB09F374C97125B51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045612, "uuid": "8c770fa5-e098-436e-a0c5-9fc0fbddcd55", "value": "3072:4WCjQrLpnr85EdT9Oa8vqbVr7//CEgmqAgcVyZIcBI:4f5EdTbpr7/WmqAgcVyZIcBI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679045612, "uuid": "a23f5c89-836d-437c-a8e4-0b57e7141777", "value": 99084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679045612, "uuid": "4635fbeb-804a-436a-a834-17ded1a4cf3f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045612, "uuid": "78bec5a6-50df-461e-8b46-b02ffa9f948e", "value": "2473b6762a42c578c937072008aa7401", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b14b086-c4be-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1679055710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679055710, "uuid": "05ba0758-4fd9-4873-b023-3ed41a2d575a", "comment": "Malware payload (Gafgyt)", "value": "d282b8c2cf12efb995f40b1261dafd49", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679055710, "uuid": "e0bd200b-a2cf-483d-89a4-e2b74987a0d4", "comment": "Malware payload (Gafgyt)", "value": "6a81e33af9598f1a9db0a9475cf35398aa8c01940dd2e8306f1e1cd83541459f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679055710, "uuid": "51702fb5-eacb-4b42-9abc-54a8afd3d834", "comment": "Malware payload (Gafgyt)", "value": "3f7b54fe78b89165d5b886734828ceb72e75e9e4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679055710, "uuid": "db92d94f-7d61-45ba-90d6-547468c4905b", "comment": "Malware payload (Gafgyt)", "value": "3a5c1a0b783789768f2db62e157d5b5b69477213d5e9ef4e33296df9a2b0c1dd83e667dca3c8f1f14010f3b97bf323a8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679055710, "uuid": "1bd223b6-dedb-4537-a847-26c1ae55c2e5", "value": "T1D6A35B8AD743C2B3CC530AB2124BA6AA4621FD3B092E9F49F7197DB09F374C97125B51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679055710, "uuid": "1f2f64b8-0cb3-4cca-9483-bf7b840e18a1", "value": "3072:sWCjQrLpnr85EdT9Oa8vqbVr7w/CEgmqAgcVyZIcBI:sf5EdTbpr7wWmqAgcVyZIcBI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679055710, "uuid": "a35ba446-5c1f-4b0f-bf4a-23b79491202f", "value": 99084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679055710, "uuid": "887d1ed1-b53a-467d-9878-dc5781d49dd8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679055710, "uuid": "83a48a16-d865-4b8f-b244-9251c773712a", "value": "d282b8c2cf12efb995f40b1261dafd49", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bdad8e5-c45a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679012681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679012681, "uuid": "f608394c-9e18-459f-bdee-5d0a57da5205", "comment": "Malware payload (Mirai)", "value": "cd3d797f721857c432484b57f42173b9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679012681, "uuid": "e2db90b0-7dcb-4529-b277-fdb2e33b0729", "comment": "Malware payload (Mirai)", "value": "6ac1105be5b557f656a1f2054bd40601ba2c8ae1a7c127dce496c01c8b7badb1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679012681, "uuid": "37ea3018-08c6-4d85-8d43-5c26072acd52", "comment": "Malware payload (Mirai)", "value": "650999524a403803b0396234791dc294219474b5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679012681, "uuid": "dc57c402-9b66-46a0-a75f-99e320c8b7ec", "comment": "Malware payload (Mirai)", "value": "a20b07a6cc021b699bc9bb8b6c84cc289e6b82cd4ae7ccb158cbc7ad2afdf964c0aa377628fa53d41f8b15d7574fd777", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679012681, "uuid": "94ce474f-e5ca-4cb6-a8df-b9ef8656c2f6", "value": "T1DBD2E062D19B9A55C84E08376E9F3D1BE090B29E07C0EC758E84B963EC5AB88374C7D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679012681, "uuid": "93ceaefc-2b8d-429e-9d6e-58d534768831", "value": "768:6+lRHEDkl3kdixKRewPbYkDGNJ1aj0147T6ItaYELPnbcuyD7URQRjI:6YRH13+gKgCbYlFN147WItaYETnouy8R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679012681, "uuid": "68910c1e-f69f-42a6-9240-d62d6c2a5b28", "value": 28456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679012681, "uuid": "0fe9854e-587d-4f43-b669-69e3ddab6e24", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679012681, "uuid": "4bc29a92-6df6-440a-9824-1a685a625374", "value": "bok.x86-20230317-0024", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "928bd782-c4a0-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679042945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679042945, "uuid": "156c0aff-7059-43a5-9d34-3a2242fa5c0d", "comment": "Malware payload (AgentTesla)", "value": "ea7c67474859b1eb11434d0c19e03b36", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679042945, "uuid": "a6d0822d-0a12-41c4-a67d-a3d4de0d40c5", "comment": "Malware payload (AgentTesla)", "value": "6b20e4799fda642654bd894ab59c4e4f8be2f1fcc4d8b146b656383219822730", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679042945, "uuid": "49ba3637-a9f0-489b-8c2e-ea0b11ea766b", "comment": "Malware payload (AgentTesla)", "value": "7670e2a91ff2e1bff6cfec546b8572fadc11a0f9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679042945, "uuid": "9c2417f4-72af-4ef7-a757-1a57d39d8946", "comment": "Malware payload (AgentTesla)", "value": "d69f101b8a9e39e0fd8a188a7223d06d43f9c65888c0ccdfb36dcaba069348863940b3ffe4fab703c7c65bdf581c6971", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679042945, "uuid": "1b6b74a4-6d09-4cb3-8650-53c6fd452eb9", "value": "T13624BE9AF21778DEC81BDA72C99A1C249770A7A75303C24FA04B235DDA0E797DF050A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679042945, "uuid": "6f0b831e-d0f5-4dc0-a9f0-72436229a1ee", "value": "3072:w7sY0tPQDDjNWK+s/oh4Fv0tn4uICNefJBZ7G2jl5WokShIbnezycCfxvXX4:w4YkQPjNkReZ8nBICy57RjZ2SEn4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679042945, "uuid": "f30db46f-98fe-4ab7-9245-95f150647e4f", "value": 224328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679042945, "uuid": "de25e3b7-865c-4305-b46b-079b9cd7a49d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679042945, "uuid": "0501b6ec-17d7-48cd-bb7d-1245cc92d5e6", "value": "e-dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1751fd4f-c4a4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1679044456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044456, "uuid": "3557bdcf-4912-44d1-a995-a7ac27a829ec", "comment": "Malware payload (Gafgyt)", "value": "4f2927f67f6af9abf824670dd789e26c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044456, "uuid": "560bd2ba-86a8-4229-b271-00d5019a66a3", "comment": "Malware payload (Gafgyt)", "value": "6b6abd8e01229a6f6c540123b6570fe58b0b652643c58a9feac791c48601c36d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044456, "uuid": "087b65c0-923f-4e95-80e2-ae4d762384f3", "comment": "Malware payload (Gafgyt)", "value": "bd0d5f995aa640c1704ce64f281ccf29f35ff804", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044456, "uuid": "69778e03-726c-47e6-bd8d-0b03b212647e", "comment": "Malware payload (Gafgyt)", "value": "b767e420301b7082ce77cb23efe194c6012164286bebed67c4abdc2356abac020f9a05a497ba6dbeb9e9eecef594dc77", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044456, "uuid": "e0573354-96fd-44b2-81bf-e6b1a7a1a7ee", "value": "T120C30A3B7B130A23C0CA147112E30732BAB5DF9834B95697B9A07DAC6F366C438567D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044456, "uuid": "861e4e0e-9e3a-4845-b240-d302e494c58a", "value": "1536:m9Ts2sEtqO1WsmhN95cbtc1ztujsidAyEmi4W5bay0Tn8yNO:LgdMzhNPcuNY4idFEm/W5baXTn8yNO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679044456, "uuid": "fd73e46a-4d00-4709-98f5-d551293ee1e8", "value": 123549, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679044456, "uuid": "46911940-1c1d-40f4-9b0f-0a08d45d4962", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044456, "uuid": "d4e1d4e9-034d-4c9d-a050-41095ab30233", "value": "4f2927f67f6af9abf824670dd789e26c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6717842e-c4a6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679045449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045449, "uuid": "9b31a881-246f-4a99-b6da-4b9f019c9694", "comment": "Malware payload (Mirai)", "value": "867f3b69b8ea2939a2446f904570e6fa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045449, "uuid": "4f2b0cd4-bf5f-42ab-9702-68f14ed4b1da", "comment": "Malware payload (Mirai)", "value": "6c961fa607b83f54491a79134a1536e4dd50433089527353dd07e35568731c3d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045449, "uuid": "d7131266-e28c-43b0-978a-ccb612adcffc", "comment": "Malware payload (Mirai)", "value": "350cd50e0b7810b0efec5c9228b45df37e1d6c8e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045449, "uuid": "413df965-892b-44b7-bbc6-4936a49ceb11", "comment": "Malware payload (Mirai)", "value": "fe796810dc0e6cd30bd210dee4b60e363fc5dce19fd8f8ba6b532a477e204cd7b83361d86def64c21de64084cba7ec08", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045449, "uuid": "b117fad6-37ad-4293-a207-fc351854db8f", "value": "T127632991B8819613C6D1127BFA6E028D3B2613E8E3DF72079E225F2137C696F0D37A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045449, "uuid": "e4769641-d47e-475d-9a68-2296e1b9979f", "value": "1536:xZ1ltKm9nMtfTa7/KrV9YhozLvkuyCG3wfqvfW5:xZkhXsozLvkyEbfU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679045449, "uuid": "ac0cbf72-f767-46b0-83bf-fe7f626d4703", "value": 66900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679045449, "uuid": "2bf67596-9659-41b8-bd58-5e52f78a3d92", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045449, "uuid": "adaf90a6-943e-42de-bfd6-6cc734f9add6", "value": "867f3b69b8ea2939a2446f904570e6fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed2bdf08-c4c9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Fabookie)", "timestamp": 1679060706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679060706, "uuid": "20a15d42-a5cc-49fa-86ae-acc950f3a855", "comment": "Malware payload (Fabookie)", "value": "47b6859164cde5207d164c0688cd40a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679060706, "uuid": "500e2233-792b-4e41-b84e-ce74fedc55a7", "comment": "Malware payload (Fabookie)", "value": "6d6189cc370ddb24eb88504efff85e5b744af465656c837feb188e037240032a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679060706, "uuid": "ee6a6a94-188e-4e73-8796-42f40a973c91", "comment": "Malware payload (Fabookie)", "value": "356a7819fbfa63b425dc876a3e84d895b6d606b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679060706, "uuid": "40d3ace4-92a9-4fe6-96c3-0a32cafaf89a", "comment": "Malware payload (Fabookie)", "value": "98b22ee8c4fcb86e5d293c0211afe201a1a7e9d80b5d65171ab846380a5c9af84ee0c17bc4e92c72c59eb739264bd22c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679060706, "uuid": "dfc85bff-bbf7-4476-8061-17c14cdc9ce4", "value": "T1E0258009BE5E8080CC1156388976D775B7627CA81F2D86EBF197BF2E6F325949C39203", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679060706, "uuid": "7a5158fa-b7ff-4408-9fbd-a92bde1336f6", "value": "7533beb38e834532b23ecbe6c94b2454", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679060706, "uuid": "d644a814-2c44-4ea4-b842-7f36a8a1bac9", "value": "12288:hZJc/3ljJaKbZmkWi6dSsA1xsBwLgGLXKPXPiXuHNHGb6bH/zx/GCLW/nh/X:hZMa1iV37LgG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679060706, "uuid": "15ab63d5-4580-4b9f-bcc2-25daa1c4063c", "value": 973312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679060706, "uuid": "5d4d8b32-0d38-4044-be32-3a2ec068f34f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679060706, "uuid": "3491f610-0e0d-44e1-a472-234fca25bdfd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1335df15-c496-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679038436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038436, "uuid": "b652b063-6bf1-4289-a132-d4def818092e", "comment": "Malware payload (Mirai)", "value": "f7cbbadc616f47e4b0b45140124f3692", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038436, "uuid": "d5529f5e-7566-4c2b-94dc-ec00eeab72dc", "comment": "Malware payload (Mirai)", "value": "6d9dc55e37cdddfa7143b32b3700292f8017dd088233ec8d2f7f6dd97c4fad96", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038436, "uuid": "150d0315-dd68-4e8b-9149-86741eb9859e", "comment": "Malware payload (Mirai)", "value": "eaab8719f0d280742ed95a9dc60a31f23a15dea8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038436, "uuid": "ddcf2b5f-c547-4fbb-9284-b5a88d6b8842", "comment": "Malware payload (Mirai)", "value": "e0b9a5236e870ce4ef6f8defbaf6ab8bd9671ff0ae31d25f5b85ed178e8ac5cabeb1ff4e3aa9675978930cf35d685a34", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038436, "uuid": "e023b4bf-5deb-4fd0-8e8b-37941144afc6", "value": "T188B31977A4654F73C045A5F125BA9A310F12AD931B1F1A88763CB6B04A3B4CEB84EF58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038436, "uuid": "63e725a8-bbec-4c55-9047-b61528978a26", "value": "3072:MDVLSItJP+Xsp4JlN3HPjmH1cuEgvniuN/:MDV+ItJH2l3HPjmH1cuEgvniuN/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679038436, "uuid": "fc86f3da-ed74-4735-9f37-d914c40c731f", "value": 112633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679038436, "uuid": "5d241650-e7a3-494c-a455-c651ff1af754", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038436, "uuid": "f47998d6-9180-461f-85da-3e2265a9d0c8", "value": "f7cbbadc616f47e4b0b45140124f3692", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8c54d09-c463-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1679016783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679016783, "uuid": "6a348361-95fa-4a69-b104-5cde0908429d", "comment": "Malware payload (AsyncRAT)", "value": "6d7be98d68c6b3d8ea8c55da493b568e", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679016783, "uuid": "4665f810-47fb-4b26-89c7-dbd1b8e1eb56", "comment": "Malware payload (AsyncRAT)", "value": "6ecbc0d9795b7fa1869f113c5a05fca4d8ff17f2312ac8f973277989cf64a67b", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679016783, "uuid": "71c36e30-bb58-4655-a913-f968be021ba5", "comment": "Malware payload (AsyncRAT)", "value": "71ec3454cef1f3e4a90fe2688e9bfd0e0f9c2cea", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679016783, "uuid": "66ba269e-ce00-4985-b94e-344e9d08e8a5", "comment": "Malware payload (AsyncRAT)", "value": "8007544fe3271a41c98b13522478a2d03f716cc884713fd000c58caff3a218ea165e4d6be1d01b5d4031862492afb0c8", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679016783, "uuid": "67e5f7e7-00a2-4b09-a541-c6a28fb52f07", "value": "T188D4EF0B52E469BDDC76567F6B379FF8A76C7A52680DD6001320627A102C1CEBD06FB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679016783, "uuid": "38fd1e84-e857-49e5-bb3d-4e6e094ada54", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679016783, "uuid": "5b5f8dd4-b694-4f94-92ba-d936f35b0d97", "value": "12288:+DzeNryR43tPVX38vhtUM4Th09oAt4CsyXwLLzl71M+zuBP1d3owmDYS:0ze0RM6ht8mq0rSLzl72qufd4wMY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679016783, "uuid": "fce7cbfa-bced-45dd-8025-47731b042702", "value": 629248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679016783, "uuid": "a01713ff-74c1-46bf-9351-9956e96e1e2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679016783, "uuid": "61e5e539-8d00-410e-b947-d3b5a843a175", "value": "Alien C++ Cryper.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c53aa6ff-c46d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679021125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679021125, "uuid": "e88b2aa9-649f-470a-8203-eab4d8f8970b", "comment": "Malware payload (RedLineStealer)", "value": "c8a086aef9377f5fa6bded6386cc050e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679021125, "uuid": "29767587-9fd6-4648-bc87-39807e55f942", "comment": "Malware payload (RedLineStealer)", "value": "6f14bde89e63db2aed293ac576e71986bd986f1dd3155151f4bc04b2bdd7b746", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679021125, "uuid": "8a3f4466-7c91-483b-8c14-56fc258fbc91", "comment": "Malware payload (RedLineStealer)", "value": "9b0502d1558624ba96ce1c9456ee285dc98a7b04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679021125, "uuid": "3902a56a-9702-436a-b703-b38f695d9109", "comment": "Malware payload (RedLineStealer)", "value": "8b5a8d415c0da4f70669bb6eb508f2eccacc21424255e1ccfab0b504cbde8886912ac14bafcbf49ff299f0c54536a4ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679021125, "uuid": "2b9ce60c-8b92-49d8-9d3d-111a16adc847", "value": "T1EE551213A2E2FC91D66E46399D3FC2E83A5EF8418D55239B223C7B6B19311E2D16371C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679021125, "uuid": "972dbc5b-dd8b-4ffd-a514-874cd495382c", "value": "936983a4f2f646ba7a7e331c33b74850", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679021125, "uuid": "681ebbee-07e4-49c4-acce-53fb39144c7b", "value": "24576:0ayERURkqhI9erD91ItsZKbtEkua2XgcqfuM8gTtvo1pvY:0mUf29m6GZMtXufgvf78gTtvo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679021125, "uuid": "a3f32667-6586-446e-a031-fa80d4bd6efe", "value": 1288192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679021125, "uuid": "4784c20a-ff37-424b-bfba-dfafc24908ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679021125, "uuid": "51a0124b-249c-48fd-8049-788f367cba8d", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71bafe5f-c4d5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679065653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679065653, "uuid": "394a100e-9a91-4213-bce0-9ad8cd1df538", "comment": "Malware payload (Smoke Loader)", "value": "c573fcdc2ef612533f9dee8f3486af13", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679065653, "uuid": "1fcb3953-dd2b-4169-9e05-437db76e4171", "comment": "Malware payload (Smoke Loader)", "value": "6f19f31eb4af77b8613de1e06973f8b1923d49c6add7aa49737bf3e2e7a8ee98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679065653, "uuid": "9d606048-b485-4d2d-8efa-1549e273b11b", "comment": "Malware payload (Smoke Loader)", "value": "e0a0f71928e31f4b33fb53f264ee8bc0c8895278", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679065653, "uuid": "d4b93819-34fa-4c28-8156-e4fb9ad43163", "comment": "Malware payload (Smoke Loader)", "value": "038cca96376493c190b61129ffa04e6b79dfb91789bac55585f2f0dd4fdb3890b9589b7077c71d6b1de2996abadbb9ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679065653, "uuid": "301525c7-d775-493c-ae93-6264c8a9f74c", "value": "T18D048D0353E47C61F5268B315E2FC2F8771EB963CE79AF6B22185A2F08711A2C56E711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679065653, "uuid": "5c0c9ce9-dd01-4159-b236-12d79f21f425", "value": "3391dcebdf72207e22a1ac369ab55c39", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679065653, "uuid": "d51ee5b3-930d-41d0-b9ce-4df8aa41fa2e", "value": "3072:/XiXnaErxuMYU7qZLf1DyRNwa9EWTsLQtam/hVlEndJB:qXa7/dpylOWgLQ1/hgJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679065653, "uuid": "ab1589be-a604-47ff-908b-8085ceddeea3", "value": 177664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679065653, "uuid": "a526e4a4-4d8c-4245-ba5d-15fa6b5174b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679065653, "uuid": "0f90ef3d-9419-485b-955e-c7257253a05c", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10424830-c4a6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1679045303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045303, "uuid": "a88c7f88-7210-4753-be78-f02e246c9cf3", "comment": "Malware payload (Loki)", "value": "e6211fda7ad9a6fcfae19b775be5c980", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045303, "uuid": "5a4c516f-3655-4237-b60a-f752aeae66b3", "comment": "Malware payload (Loki)", "value": "6f24575f00c2dac29c50dd95998b4f9dcb21a179bf26a428638cdd78d69e1c49", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045303, "uuid": "8b6cf7ef-1159-4558-a4ad-734e1e4622c5", "comment": "Malware payload (Loki)", "value": "1bcfd8426a6d80ed6d13af9d2f18ef359e448c4b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045303, "uuid": "21465608-843f-45b9-a7d9-177a0ca2237c", "comment": "Malware payload (Loki)", "value": "b14607aefadab089b09de26da1b3105989e8843ef484089a382f2251ee57a418d6ce37a145cdd55c447af0976a4e5dce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045303, "uuid": "5a128791-9c8b-45d9-8257-cfbe55d751b7", "value": "T1A6E4020CBA9D5625C62F727B91B12A489375EE18C711D33E2DC668321EF3BC9DA52C43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045303, "uuid": "4432cc53-ee44-4cc1-a38b-036555e78b62", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045303, "uuid": "9b84af4e-08de-42aa-928f-848107b52ef0", "value": "12288:RCOpCAdlHasdqLWbUjfoWCM97C2wSv6JN/EoAc4e5hBeIDdE0PENtsxXDlT883JT:RCUlHasd8WbU7oVY2/BfmcV5WIDuPtsx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679045303, "uuid": "3fe7f61c-9d28-48fa-8582-8ddad715e3af", "value": 686080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679045303, "uuid": "40b09144-9112-4c9c-8ef4-b4b28c786af2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045303, "uuid": "50aab63d-c34d-4828-8b5e-f89abcac17f3", "value": "e6211fda7ad9a6fcfae19b775be5c980.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5055488-c4c7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1679059833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679059833, "uuid": "2a71ba96-b787-4f36-a117-0ccfd04fbac7", "comment": "Malware payload (Formbook)", "value": "21450482d79aad4ee69fa19a0b7a9215", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679059833, "uuid": "6df456fc-eb4a-4c17-a4ca-f61e85363dfc", "comment": "Malware payload (Formbook)", "value": "6f2935e3ebf1cd66707a7c74e69c342f347c900cee97bf69c012e796b9315433", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679059833, "uuid": "ca213cf9-85cc-4b75-be71-382e22cc3e35", "comment": "Malware payload (Formbook)", "value": "e7d20e0943236b583152d84e0d7f36bc2af226d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679059833, "uuid": "d173b559-29f3-401d-8d79-5cbbbb92382b", "comment": "Malware payload (Formbook)", "value": "5177ab9700bb43071c9c31831a0cd154b926c1896c9449763ee8744845c629d8c8607a2defe04183e15d237f0bc0ea56", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679059833, "uuid": "7f26b03c-92b4-4795-b945-43932a13de89", "value": "T15AD5D0027E44CE62F0085633C2FF454C87B0A9516AA6E31B7DBA376E55123A77C0D9EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679059833, "uuid": "0b143a33-322b-45d8-b21b-0d9faf95b56e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679059833, "uuid": "0897339f-6424-4c89-9e4d-bf074cdebcdd", "value": "49152:uCz1k790oVAevcQ9wWk1gylgsbcr1rQ+NBuBx7Zot3lVDUwR:bzCZDV81aycFQKU5g3lVD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679059833, "uuid": "191f5d3d-b030-459a-9077-deb1e037d5a0", "value": 2807296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679059833, "uuid": "f81c27a7-cfdd-488f-b5a6-3a6ae11efd0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679059833, "uuid": "bb25c37a-0209-4f40-b665-cc0aa5d37646", "value": "21450482d79aad4ee69fa19a0b7a9215.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e46a6727-c4ae-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679049095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679049095, "uuid": "007bbfa9-798f-4ade-8fad-ebe8a25533b9", "comment": "Malware payload (Mirai)", "value": "e20d48cc0ecb1c8a5179220d9357153b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679049095, "uuid": "82384587-394a-4fd8-979c-98b111789bc9", "comment": "Malware payload (Mirai)", "value": "6f7efb2bb72dbf0311ebebb8cd417ed445467a5f02808bcf85e5719925e1162e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679049095, "uuid": "1fcc7e13-7c9c-4314-89eb-9534b12a2c14", "comment": "Malware payload (Mirai)", "value": "dec2a07bba5c0c1cda312781184bb31ade6457e2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679049095, "uuid": "11c47329-6e28-42b1-ac81-70adf3eeac7a", "comment": "Malware payload (Mirai)", "value": "c40eb6ba85311d96234e6924090bc6861fbd63661d2b94489ea89613092333345d1afd0594ae1445438634ca314b0f10", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679049095, "uuid": "fc07762f-c1a9-454c-a6e2-8f3bca3a4370", "value": "T155A2E01039621F69DAADA83CC87E8256734B57F8E2B432B6252017A0D24950B7F74AB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679049095, "uuid": "2b24eb62-651a-45f9-bbc5-42e2f7401113", "value": "384:TvtIoZxrSniaXs+qx+bwqPXwZFfYzeY0PeUKS0Ql7224SwhymdGUop5hK:TvQn4j+gFxW/E7/4Sws3Uoz8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679049095, "uuid": "3fd77e34-baf1-47b0-b9be-bcb34f5a95d6", "value": 22168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679049095, "uuid": "e2f8679a-dfe7-4eb8-a3a2-8ed2c6c9ddc3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679049095, "uuid": "050c76a4-f9bb-4f27-87a1-185e78861249", "value": "e20d48cc0ecb1c8a5179220d9357153b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69677315-c4a0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679042876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679042876, "uuid": "ccd42b1f-15b8-4888-ac4f-3ce813f990ed", "comment": "Malware payload (Mirai)", "value": "91be5618cf168f53fb6eb27bb8563379", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679042876, "uuid": "2e1682ab-d93f-4bd4-abfb-8c657407dff2", "comment": "Malware payload (Mirai)", "value": "6fb32ef21d08963bbc451099d9d3240d3c97cfc4e65c983f49dbc9080cb9fb2b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679042876, "uuid": "37908386-61a4-4b6b-9c50-ae1fb20717a1", "comment": "Malware payload (Mirai)", "value": "0d050dea30414279847557d540fdf5f344eaaa61", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679042876, "uuid": "2bb9322f-64e2-4596-a543-3b3471dd7155", "comment": "Malware payload (Mirai)", "value": "87cdd82fd138b781ce754b373ad996cf478e8b59338327508c1b140573785a5acc4c098c4fbe4a1a8656edede0b7636b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679042876, "uuid": "c82dd783-afa5-440b-af20-069cad5538d5", "value": "T1DCC30B9BB9A441EDE0A4E03917BD6675C41970EF51BCB3C727C1AF2A6C65DB2070DC28", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679042876, "uuid": "d59c94ae-a03d-4c6d-bc74-cbbe6c2edd5c", "value": "3072:OXlzXuHOR8oYZx5U1HPKpErxbs5ovB21Q5s35HswkQk:OXlzXuHOR8oYZx61vKpEtbmmhsJzHk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679042876, "uuid": "b2c3ca4f-d4d0-4bdb-9061-6ad0a24e590f", "value": 129376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679042876, "uuid": "d39192d3-2b88-41c1-bc77-8788906fd37d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679042876, "uuid": "00d7b3de-4b53-4164-bf43-c9167edb45db", "value": "Paralysis.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a32571ab-c4ac-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679048126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679048126, "uuid": "8622906e-b8f2-49c8-bca1-0849ba2cc28a", "comment": "Malware payload (Mirai)", "value": "fe0f8f2106fe02cfb36858d88d4df6d1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679048126, "uuid": "80264832-190c-4900-a9e1-581919cfa9be", "comment": "Malware payload (Mirai)", "value": "6fd4f43f640143521e44fa43226d286d740fb520aeee9c66d40ff32bb1399441", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679048126, "uuid": "4bc2c51c-29ac-432f-b040-f2e8124c6d9c", "comment": "Malware payload (Mirai)", "value": "5a59dfdb04e7644ce5c414dfb580461a22312eab", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679048126, "uuid": "f63d8854-8f42-4ed8-8312-51ffd2c2e315", "comment": "Malware payload (Mirai)", "value": "e862218507ece7f05b2fddef000eeb57ef5400d12dbff70bc572bdeba12694da6793ae531ee6ec516e91d4cbc6562357", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679048126, "uuid": "feffaddd-45a6-41bc-9842-e2e29f3c1f76", "value": "T1B1A2E039729D6271C9B58C30DF7EDD4AF66B437CA2EBB0650211C950AAC120347FCAE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679048126, "uuid": "ee64d23c-31e0-4e1a-9ae5-903240a4c060", "value": "384:Nfmu7YtXl3lZ4G6pIsEygO5zJndbZxPI+7F43BBGNcJV5dcswhymdGUop5h8:Nf17YJl1ZTygQz5dbTPILxBGCJnnws3k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679048126, "uuid": "80e66f10-8b86-4067-9330-e1e3f6d3fcf8", "value": 22168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679048126, "uuid": "aec77604-05c3-4283-b3a6-838e20191c1e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679048126, "uuid": "1acca94d-6fa0-43ae-a33c-e26c4c7f4408", "value": "fe0f8f2106fe02cfb36858d88d4df6d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71177e6b-c51b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679095717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679095717, "uuid": "93d49cca-a92e-44b2-a878-78a22c8db964", "comment": "Malware payload (Mirai)", "value": "aa720174a619072b9eb2f2c24e08d8f1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679095717, "uuid": "e27e1337-0303-4f6c-97c2-fd44cc0c858a", "comment": "Malware payload (Mirai)", "value": "708bb09f8e189aa8086e1738900001245cf77cca6296d0eeb59018cb596bf094", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679095717, "uuid": "1f05d52f-d11f-442d-87ca-765aafc66bab", "comment": "Malware payload (Mirai)", "value": "28dda44b400e2a8aec026265a11c0f19a83f2b77", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679095717, "uuid": "ea404ff5-6835-4795-9fc6-09a2bf9d9eca", "comment": "Malware payload (Mirai)", "value": "6ab5e7ceddb3a4dcd7243ff835f4c9b59683944c4294761f091803f87404628d94cf3b3b110c81e6bf4d257b10fc88ef", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679095717, "uuid": "6b8a294c-4da6-475c-af11-f3b7d687c047", "value": "T1DF03F13546247BBED2D0FAFE141F63D5D14E9301E18A1AB20CD3E08A36B16B79324F46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679095717, "uuid": "6a797242-72b1-4aa4-8620-2923b157a76d", "value": "768:eG75+Y+NofxRNepbFDLFbL9Vc+FEV9aVvaPqsDxSH9H8VV5d:eG75eoZLepbPbL9VtF1SxRv5d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679095717, "uuid": "5fcee3d2-24cb-48da-8d4f-491a765ee54d", "value": 39340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679095717, "uuid": "191806fe-92ae-4bc8-ac11-8263b13cf51e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679095717, "uuid": "b0b13a64-4f85-436a-a3f5-1ed9c65c82fa", "value": "aa720174a619072b9eb2f2c24e08d8f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a2e63a0-c4be-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1679055735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679055735, "uuid": "ce4dc100-ea25-4d59-9164-e5013d793ba1", "comment": "Malware payload (Gafgyt)", "value": "acf09c522ceeb92d49033a23e1a47a2d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679055735, "uuid": "443dda58-57fd-4886-98e5-763c752c262d", "comment": "Malware payload (Gafgyt)", "value": "7104ca59373bd21402c08158cc87fdec45bc86feebdcc6ad72f8584b87c151fe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679055735, "uuid": "958d8b44-1150-42a7-9d73-416dc934bf06", "comment": "Malware payload (Gafgyt)", "value": "df13d10094985e4d15a96102827c6bd104818186", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679055735, "uuid": "86992df9-e247-468f-9ffe-81eca8841387", "comment": "Malware payload (Gafgyt)", "value": "6d89c88aae788e75f71dd9702b9ae8370b64aabba354560256fe4171b59db8bd0d25afcbaa9e889116a58cae008b1188", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679055735, "uuid": "b050a6b0-427f-4e6f-9592-135ab6ceaf28", "value": "T1A1E3866E3E21ABBEE16886310BF76F70C39529D636A19342E16CF7185EB124C1C5F760", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679055735, "uuid": "a85bd7b3-5f53-4231-af40-cfe2c5630f62", "value": "1536:mVNs7K797V+nv57gbj6l6T6B6v6N6/6AePe1ebeZe5bwClA2rKQA1dXAQTI/e0h0:vY01ZkXAQT4NB9//ImlWs4zWfOodW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679055735, "uuid": "71f9fa4e-f1e6-4897-ae7d-c1397e8405df", "value": 152121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679055735, "uuid": "8dddaffc-828c-45cc-9a60-80170087edb6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679055735, "uuid": "76fab886-c151-4471-a9d8-24b808a58e29", "value": "acf09c522ceeb92d49033a23e1a47a2d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39ab88d1-c4de-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679069424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679069424, "uuid": "8ed2f366-c1ca-4450-9dd8-19c23b1265c5", "comment": "Malware payload (Smoke Loader)", "value": "7b1f959c49351af4036ce59518426fca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679069424, "uuid": "ab357b26-c041-429e-b91d-5d1cafc47cb0", "comment": "Malware payload (Smoke Loader)", "value": "713b35f8573ef16030e7daa86bbac66ff24abde4a5eb0c281f6a8fb046249939", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679069424, "uuid": "b21efe8f-8397-4238-af99-875941fb8c8f", "comment": "Malware payload (Smoke Loader)", "value": "285b9adfcaba9ce5e936540c488bd0f1b1318145", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679069424, "uuid": "001b5cf1-d0cf-4104-8eee-6769e6803b17", "comment": "Malware payload (Smoke Loader)", "value": "dd88e0fc31591cb5e3a083f8191eb2ec68c638c258dc020f3123f455dfecc5c28ed9cdcec162258d8b35862f1c7e2c5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679069424, "uuid": "0b7a3f7c-4c05-4650-8390-26bc65d99476", "value": "T1D554081396A27C40EAA68B33AE1EC6F8761FB5608F4977B52218DF1F24B1172C167713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679069424, "uuid": "99e643b4-0181-4ace-955d-8e4ffc880e5e", "value": "800c211657980cdb5c72386d0a0450fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679069424, "uuid": "77c2573f-ba5a-4afb-9aee-9e072e8f4046", "value": "3072:Nx/PwCL1vWxj3FEb0DUVZR6evZRoa67D1tKG36LWVI3xdN:jnwCL1uxj3FW0DU3wehB67D6GX2d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679069424, "uuid": "9394d5bf-6a0c-4b04-9221-9184fbd24e3c", "value": 303616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679069424, "uuid": "cd1ae256-eba7-4f60-b773-a30a375701d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679069424, "uuid": "0a76a7f5-ccf8-4b31-be2b-1747be7fda1d", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "111232e2-c516-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679093408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679093408, "uuid": "480abf86-4fba-4419-8725-10f4a88a13a5", "comment": "Malware payload (Mirai)", "value": "5c9c5f08eaec2bb258df76f4322b5e64", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679093408, "uuid": "e19459ca-be9e-4fef-b18e-9332c4009b4f", "comment": "Malware payload (Mirai)", "value": "7181861b8adea140fde94d6f5df67ccd9a83f8fd6d1d70651d264e24b2e42878", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679093408, "uuid": "befc4e80-9864-4141-a111-056345783201", "comment": "Malware payload (Mirai)", "value": "f4da98bca23e82705b759fe29fd4dea45a8f0057", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679093408, "uuid": "bb596529-6d8d-45e6-8393-ab238b388f70", "comment": "Malware payload (Mirai)", "value": "eaac079dd70a5c312e62834a2d05ad7151b2d252ba7a71232727e5334d3f86093af6731f7142a2a4535e94b374be9521", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679093408, "uuid": "576cb7b6-df55-427b-83a7-2bb1965c04a2", "value": "T103D229C1D883E8F9EC1502F69633AB339B77F5692509DE8BC3ACD522E841601E20739D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679093408, "uuid": "9087763e-323c-4b55-a1c2-7f07ba0a915f", "value": "384:fj89bOlrx6W6MOzuffNi24PL26nBFRSMZaJQiWPaO1g/291osuOvkLBE3TVl:Ga3rOaf5n6BiMZciaO7QOviBy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679093408, "uuid": "7968b5d8-670e-44fb-8ba6-3220e7239166", "value": 29776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679093408, "uuid": "2c06bcdb-d71a-4714-b416-7cde6abaf71e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679093408, "uuid": "03378d23-9381-44da-8790-3f11b965bbb2", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdc40f92-c50c-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1679089403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679089403, "uuid": "5f301e0d-2918-4175-9a66-1696584b20df", "comment": "Malware payload (GCleaner)", "value": "dd2711669b0f650baab85bf1191c6b84", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679089403, "uuid": "d51820b8-9b36-4c0d-997a-bd206386ca3f", "comment": "Malware payload (GCleaner)", "value": "72238987f1f659c6e41a74a077ea43fd07d6709be29e1f20546ba6f9ebeccc1a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679089403, "uuid": "58ef7a63-0759-4356-9f44-feee29d66320", "comment": "Malware payload (GCleaner)", "value": "32fccccadcb652baa898bb9ce04fca0c5a2c2e2a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679089403, "uuid": "5ed9cc80-5980-4f24-9629-6f05cb35f339", "comment": "Malware payload (GCleaner)", "value": "2fe7dfe0f93b128c53382ec4facda0924be0b96e0557cf25bc9414cb2b73024c445a556e70ac9736648bc84c24b62a58", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679089403, "uuid": "0280ca1f-7434-4a41-9b0f-89b8ba29d7a1", "value": "T12AC533A0A782D8F2C0739B712D45B539C947BDD7183826DCB70E86E96F1A403E78D663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679089403, "uuid": "9621af1f-f03e-4a9d-ab88-fec4512db7a6", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679089403, "uuid": "ede0a4bb-7dd6-446a-a7bb-db1e72fc2fcf", "value": "49152:EGlJfsKC6CG1gNZ+B/TRn8PRAVp5TrlmSXLHntls1xk1/zLePYyRWjd5dlLYp:5DCGWNZuoRwZpmKnTsLkNzLeAyRWjrP+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679089403, "uuid": "8c1098f4-b0c1-4ab1-a865-ddbed911c764", "value": 2695267, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679089403, "uuid": "2f2638de-739c-4c27-8923-9262b22e9091", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679089403, "uuid": "f3ea0d86-7d3c-4b75-a556-487942f642ea", "value": "dd2711669b0f650baab85bf1191c6b84", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fc75914-c4a8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679046322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679046322, "uuid": "fc373b21-5ef9-467a-88ff-5ee259d2be62", "comment": "Malware payload (Mirai)", "value": "14b96ef8173381f3d6c035f6dc3bcd1b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679046322, "uuid": "3803ea56-f602-4468-81ec-b49e21fc8768", "comment": "Malware payload (Mirai)", "value": "728f92047ebeb4e121e5214693b51fa59c7bd7d92bd9875fc9519502d7eb9d99", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679046322, "uuid": "0596d7e6-330b-442d-a996-4c17e83a8c6d", "comment": "Malware payload (Mirai)", "value": "f0fc8952e99f42c9b172c4985097c199ea8c5efe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679046322, "uuid": "285fdfea-cc16-43d7-bc67-56852004e7e0", "comment": "Malware payload (Mirai)", "value": "b8a058604bfcfa2a6de227f8228020ea66013f6f9483f3f3e02331df70154c35e1c935e994209e9a6fddc657f521da4e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679046322, "uuid": "d9429645-d989-489d-af82-41a9bad157c7", "value": "T19FB33B376251C97AC08356F426EBC5729D13BCBB0B32219A33D47D60AF368DA1E99B05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679046322, "uuid": "063afeec-22d9-46e7-801f-2342febb860d", "value": "3072:kiry859a2ADJf9wHYqbgFFo8+HeAm+TRCm7FnVqfJXFWbNb:T9a2aLqkrM5sm7FnVqfJXFWbNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679046322, "uuid": "350cf911-95df-460b-b246-e76d1d15ff4e", "value": 116503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679046322, "uuid": "6a35f845-a360-463d-b0be-7f7c65492998", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679046322, "uuid": "763193a3-927c-4bcd-b5db-480559369e62", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4633c118-c49d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679041528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679041528, "uuid": "8b18f1e2-8146-45ee-99db-569618e46ceb", "comment": "Malware payload (RedLineStealer)", "value": "38b7f433a65cdc9b846b3bff842c3bb1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679041528, "uuid": "830f00ea-eb4c-4dc2-a6d7-2801ac0958c5", "comment": "Malware payload (RedLineStealer)", "value": "72b6b5455fd03c7a412bce29b4759a01862e081ed6a1e71f0f5e89ef99363270", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679041528, "uuid": "94b1cd51-53e8-4c60-9b7f-6855ad56a067", "comment": "Malware payload (RedLineStealer)", "value": "c9010e18d9175877ab2eda44aea24223121a0ffd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679041528, "uuid": "b8af1373-956b-4cca-9e53-3ff8a9027c22", "comment": "Malware payload (RedLineStealer)", "value": "d8fa7187838fdf4a750c438e99ef1e0aabc1166790a69fac326239dec866edc1e9740a81461cc9fce6bc97dce44809c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679041528, "uuid": "d2223853-f2db-401d-82bd-b122201c4efd", "value": "T15FD36B4B96A8B9EEE12757731E2B9F0DA638BC537909CF162221434F506608FF247D93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679041528, "uuid": "c402c686-b7ce-447d-a1d8-49a375fd9f7b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679041528, "uuid": "d48d77c3-0cfc-481e-adab-b7b7a02753d4", "value": "3072:aFXTTzIPuqanvsLao/3hagjTe3U9xbSaPgMD6ZR:aBHMeEuTgjQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679041528, "uuid": "340d29fc-22e3-4c6d-8f02-26dddbdcb5ba", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679041528, "uuid": "d770fd33-1409-42d1-a89c-42b67320162e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679041528, "uuid": "60481b32-45ee-4f38-a78b-a8ec40c6683e", "value": "38b7f433a65cdc9b846b3bff842c3bb1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f2a75ec-c4ac-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679048120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679048120, "uuid": "2c10e311-1bfe-4594-8afa-2b7b5d5d8b46", "comment": "Malware payload (Mirai)", "value": "2b7d4779aefcd5a0e0cc9ad3b82a845a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679048120, "uuid": "88ec5fcf-49e4-4bb1-b5d8-66a586afbddf", "comment": "Malware payload (Mirai)", "value": "7354794cb1a70ab0c503e44f1743c90736dbb8bea0a140d318a7b2b6cc6e3666", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679048120, "uuid": "452aba40-29ce-46b6-8c53-80ece9b570e6", "comment": "Malware payload (Mirai)", "value": "12f0298b0e1ad4e4364413df316e3d555723a1bf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679048120, "uuid": "8adba5dc-99f5-4298-9307-ae8875d8a37d", "comment": "Malware payload (Mirai)", "value": "d645e82f67a717ad1e0ba649789fb40b6ff87f202bf452dcbb83e7e42001db10aa88318dc70e4d0beecd8cb4aab12666", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679048120, "uuid": "380cfbae-553b-4999-aa79-a5d7e8bf6e6b", "value": "T12D23F2B5945ACEE5C6203434F24C95F362F9E57F6487221367204E7C6BA9C822B95F0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679048120, "uuid": "7d0dc965-b6b9-4ddf-a6c3-70ef1cb83dc6", "value": "768:g/TYCoIxdEvL8YPWjNmyzhQ32WwsA33n/9q3UELbUXfi6nVMQHI4vcGpvi:gECFqL7OcyQ2WwJuLRQZi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679048120, "uuid": "d4d8d180-d676-4b08-a4cf-4f70b89a664c", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679048120, "uuid": "e8c669a8-d3cb-43a1-8db0-4c5e5cd539b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679048120, "uuid": "36ea2cfc-40f7-4805-8b67-4187066e555b", "value": "2b7d4779aefcd5a0e0cc9ad3b82a845a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "901a04f7-c51b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679095769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679095769, "uuid": "879b996f-5213-4077-a580-41a5af3281d3", "comment": "Malware payload", "value": "82acd827f36e29c05e6581558b0d76ca", "object_relation": "md5", "Tag": [ { "name": "AresLoader", "colour": "#CA747B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ta579", "colour": "#AB1B02", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679095769, "uuid": "ef0daa12-14fa-4c45-ad66-caf0c7bc0fc6", "comment": "Malware payload", "value": "7572b5b6b1f0ea8e857de568898cf97139c4e5237b835c61fea7d91a6f1155fb", "object_relation": "sha256", "Tag": [ { "name": "AresLoader", "colour": "#CA747B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ta579", "colour": "#AB1B02", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679095769, "uuid": "afa21201-1f2d-4822-84cf-a61b3ba9eaae", "comment": "Malware payload", "value": "bd43089a78e97b66064b37d72f086f4c042a4c91", "object_relation": "sha1", "Tag": [ { "name": "AresLoader", "colour": "#CA747B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ta579", "colour": "#AB1B02", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679095769, "uuid": "816b8e83-5510-4a30-bd19-930688bc079b", "comment": "Malware payload", "value": "fc94a4ae8406e3a6bb0735036b93139c754ff9e49c65a02510fa4853378177f87436aca8d15e81cbef202a5439bd06da", "object_relation": "sha3-384", "Tag": [ { "name": "AresLoader", "colour": "#CA747B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ta579", "colour": "#AB1B02", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679095769, "uuid": "c800bb05-b870-4564-8a9f-80a1fa409cb6", "value": "T1D3751A4319CF1D66DCD27BB4B1C71359A33CED70CF6A9BBAB50884374A932C4A91AB41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679095769, "uuid": "65566524-9922-4d4d-bfb4-65a5c3b46404", "value": "967eb4f66af509da0d8ad27d2261daaf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679095769, "uuid": "91b7bff2-268c-4cb2-97b3-547532519f4c", "value": "24576:f/f6OAqD+EoVeQExeVATaXAuQ5x3f3TWH5x:faOAU+M/WH5x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679095769, "uuid": "0b38ee26-db07-424d-9cc6-84fb659bc839", "value": 1577775, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679095769, "uuid": "da2e028d-54b3-4f78-8fa0-82fdebcd29e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679095769, "uuid": "6f187c60-f2cb-4cf3-9ff3-debf282b5b52", "value": "Documents-invoice-plan_032023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "648f1582-c4cb-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679061336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679061336, "uuid": "b00231bc-6fcf-4316-ae4c-35a8fedb96a5", "comment": "Malware payload (RedLineStealer)", "value": "6df2dcd218edeb81ee4dc5585ab6875d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679061336, "uuid": "9fb1f0e6-4269-4368-ad0e-b3167fa0bfd4", "comment": "Malware payload (RedLineStealer)", "value": "758181cba06215c5c4144ef0dd978ac75419c8aedc29e1a9b7288a02e0290d2a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679061336, "uuid": "c0b2e091-e90a-482d-a1f9-7851ae3f73ba", "comment": "Malware payload (RedLineStealer)", "value": "51d39483b9b1435bfbbcc09381de11c35b043da3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679061336, "uuid": "608425ef-839f-4c5e-95a3-73b0d561d7de", "comment": "Malware payload (RedLineStealer)", "value": "6dd844ad8bf42fd7c587725c94883be5427f5e9edf8577eebf89bdc5af4adf775d018b89f630671ef7a10c6e5aa3a0d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679061336, "uuid": "db605660-b65b-40d7-b582-4a3768839cf2", "value": "T1B954184396A17C50EA268F73AE1EC6E8761DB670CF4A77B6221CDE2F04B5172C163712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679061336, "uuid": "7dc62100-e7aa-4f58-b691-8a1663b0e974", "value": "800c211657980cdb5c72386d0a0450fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679061336, "uuid": "7b6fb55f-2805-41de-ac7d-6cd8537b24e5", "value": "3072:H/YwbLJtWAbShGlh6eP02aI0rt9fmSiN3NBlTtZS6LWNiI3e:wwbLJ8Ab0GiQ0JDmh7W8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679061336, "uuid": "d0bdf4ff-41f8-4a96-ab14-c3c34eceba4f", "value": 301568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679061336, "uuid": "e01fe882-13f5-4e05-9fdd-afb110fbaeec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679061336, "uuid": "90ee0755-8c46-4c05-bf96-f3dd1c485ec4", "value": "6df2dcd218edeb81ee4dc5585ab6875d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed04838b-c45a-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1679013032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679013032, "uuid": "30e2b22f-5a89-4711-8a4c-bd4ddbf273b0", "comment": "Malware payload (njrat)", "value": "4c2d57d34e69887b905ac39fbb58d736", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679013032, "uuid": "06906ddc-c59b-406c-99dc-132eb93174a9", "comment": "Malware payload (njrat)", "value": "75e794dd1ddfe6d2585dc9031c32fa1c27515d08476d7d2dd52dd650bfbb934d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679013032, "uuid": "f784ff3d-073d-4ca5-bee4-5ffc3c2323c7", "comment": "Malware payload (njrat)", "value": "a35b9371a42a87a814dd68ff9db30f6e1e95a008", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679013032, "uuid": "861bedf1-278f-4d85-aaac-41e0fef057c3", "comment": "Malware payload (njrat)", "value": "d833d6d5e401b7bec693f7754e562ca16c288b50eeebbe37a089f8b4b8c92529c4ca3a3dd30bb42408a511de6078eb54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679013032, "uuid": "2e163174-2cba-4444-a03a-3d29ea267cd3", "value": "T1A1140161B7D3A8F1CB6E9F31B452C208CB717780912BCB4FA47D94149B5B3A39AE2560", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679013032, "uuid": "894c4d8b-b37e-4fba-aafc-3f6c25ef8da5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679013032, "uuid": "2e1e0691-1cba-43da-8019-db68ec772147", "value": "3072:VRs0YSY6FGHBu/84ozP1a4HjQPp4UgcaaeN3AxB3qRrvCG2KSWFPQ4pn1iqZyt:L4HY/8aOj44UVD0Qx5qX2KxFPQsn1NZO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679013032, "uuid": "fc89ac48-7baf-499c-aa32-791ed692193c", "value": 203837, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679013032, "uuid": "c17f54ac-e8df-49f5-8773-48fa20ed94ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679013032, "uuid": "aa976872-07f6-4a58-aea8-016178952f4a", "value": "4c2d57d34e69887b905ac39fbb58d736.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41c88d3a-c4a2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mekotio)", "timestamp": 1679043668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679043668, "uuid": "0a1b1f4b-2c6d-4f24-98cb-823b6fe2f0d3", "comment": "Malware payload (Mekotio)", "value": "6ed3590e3e8592f8c0626d07dc0e5f9a", "object_relation": "md5", "Tag": [ { "name": "Luxottica", "colour": "#1FA906", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679043668, "uuid": "33cbe957-0c90-4549-9814-1bf1821be686", "comment": "Malware payload (Mekotio)", "value": "761eb4c63b1c64b2241ead93fdf6714ec655f165fd82fb5548bd31b154ed5ce7", "object_relation": "sha256", "Tag": [ { "name": "Luxottica", "colour": "#1FA906", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679043668, "uuid": "2bb67f93-1f75-4b94-bed1-11501b608091", "comment": "Malware payload (Mekotio)", "value": "b1a576ee5e176d82bec9c2759bb6ef86683e98f3", "object_relation": "sha1", "Tag": [ { "name": "Luxottica", "colour": "#1FA906", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679043668, "uuid": "e97f7f3b-3721-49b2-9275-b7dcaaf01fc7", "comment": "Malware payload (Mekotio)", "value": "4e01bef80a91146e8c0341721f26f8b9ad315cde801a3321e28ba11acde1deb9b58fe7f8f8d44889233def3b4c70f736", "object_relation": "sha3-384", "Tag": [ { "name": "Luxottica", "colour": "#1FA906", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679043668, "uuid": "4dbbd6f3-d2f2-40ff-8d6f-894250d35397", "value": "T18A962323769A4121D5FEC7744E37BED535F1272883A240BBB5946BCF34A16E087B2A43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679043668, "uuid": "dcff1f87-254e-4ac3-a978-550450d384dc", "value": "196608:bX+UBdpyjrn34Rl0oTvVlRXIrIdIPsgM4FCK7Kf0QDsW:bPjyIz02vFXIrI1wfKfr7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679043668, "uuid": "1a2289ce-8355-419c-8d79-2f77faa161d2", "value": 8997888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679043668, "uuid": "4dde3180-2424-4ed8-ba43-e87c26e96c14", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679043668, "uuid": "285f8718-416c-4f28-b3cc-ca9363d49b74", "value": "FACT64142.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70d81d3d-c497-11ed-88f6-42010a9c006e", "comment": "Malware payload (DarkTortilla)", "timestamp": 1679039023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679039023, "uuid": "46104ea9-3016-43c1-aa97-3d3bc83c7005", "comment": "Malware payload (DarkTortilla)", "value": "168eab563bcce314c992c44a36f8445b", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679039023, "uuid": "b3c4ef4f-37c6-4b2e-9a4c-73e0887f01db", "comment": "Malware payload (DarkTortilla)", "value": "767cfb648aed84d4bba5e27bc8b62cfc02adfac0133d4eaae0359a8a615511f0", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679039023, "uuid": "a3a9d010-0a93-48ac-91dd-d78b041aa4fd", "comment": "Malware payload (DarkTortilla)", "value": "0c0ee49cee6347bd10d07788e4079017ba039a6c", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679039023, "uuid": "4eef2d45-0ac0-4650-acd9-88f73be2bcca", "comment": "Malware payload (DarkTortilla)", "value": "4599ca96797eee28f0e44eb76a363eb1ea551885aeee225118804333eb7df82e014174f57abed7e739e25eb6d986f91f", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679039023, "uuid": "f991d360-84a9-4b79-ad4c-811679cbde52", "value": "T1F084236D1C793F9CFFC1B55322EEB680987920442166D32A64D6987CB064F7CBAD78C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679039023, "uuid": "4524e608-427f-4ecf-ba52-c673ff8180ac", "value": "6144:+yBD471ybB5DzrtfGYO9OLVCNnX05IWC+zVUKac5t47+DQ06EVUNpRkhyb3YU6:bK71KrDzMYO1kIWC+uKhT4KBmP3bIU6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679039023, "uuid": "cd39e94c-512c-4b7b-ad2a-fdfad86d4773", "value": 373538, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679039023, "uuid": "677394c8-37ce-42b6-9a47-2669a28feb57", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679039023, "uuid": "3851ffdd-5994-4e1f-a24e-00fca1a5c419", "value": "TT $45,000.00 USD_1.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e850da4-c497-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1679038992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038992, "uuid": "e6cebeb7-0cba-4c71-89f0-177797365760", "comment": "Malware payload (Heodo)", "value": "846cc0231ced33d2615d9466cae9fd09", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038992, "uuid": "a658a565-c1a1-49f3-9e7c-c4c436ce80dd", "comment": "Malware payload (Heodo)", "value": "76c6f1ac7490a6ff9fe336658c83f25c3b7709922fc39e8018e0e72538509ffe", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038992, "uuid": "a5cd9288-7ecc-40aa-8257-b669b20d0a5a", "comment": "Malware payload (Heodo)", "value": "c9893d84728220ac40c4db9cf2d651b27b30a92c", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038992, "uuid": "881d7869-b28e-4e8d-801d-6ea350a21781", "comment": "Malware payload (Heodo)", "value": "7971f16a3a1c07d93cf3ff85d1f0e08aa820c0e1cacd817ddc71a0f1324264b07c4bd99ae13746c83aa8e01c5e5a5a4b", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038992, "uuid": "b133284b-6df9-426e-a449-5a702dea06b1", "value": "T14FC33BF1A8025C0AE123C976B1FB661399D051ED42283B2BF87D507DD978A20D5DD8EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038992, "uuid": "43451671-5f1c-4ca7-8c25-4254a68af16c", "value": "1536:RDBoTVdaeNtuXndCrJJmT4HVnteV4FrdMiYcx7bfCb6HPdnXf:1BoC+tCYvSMVnte8ZP1Y6Jv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679038992, "uuid": "6e03838b-f6d0-4af4-8bcd-17db21a8abda", "value": 120428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679038992, "uuid": "c081ee04-ae02-4636-ae2c-91298b2afb1f", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038992, "uuid": "a7c292f7-a6d7-4f4e-a680-cfae1ef6206d", "value": "Opast International.one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80a0477a-c51b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679095743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679095743, "uuid": "bc469c8f-6d82-4901-b677-22d35ccfc620", "comment": "Malware payload (Mirai)", "value": "c8ab875d6b1b16164342f5ababe8c391", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679095743, "uuid": "f8cc5c3d-e043-484a-a335-b2c7343ff1db", "comment": "Malware payload (Mirai)", "value": "76e54a4cde775931371955a25953ee8f42f9461bbd6e2b8978acf54cf17df1cf", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679095743, "uuid": "cad79b89-f4d0-4d25-a70d-5639c8d9463a", "comment": "Malware payload (Mirai)", "value": "d60d09df86f0df8d4ef42b86486e65baca94dce7", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679095743, "uuid": "8ac4fdd4-1f18-44ae-9976-90285fd15f4a", "comment": "Malware payload (Mirai)", "value": "a28cc04a03d5608e93f9804c41cfeb510d9a9ef3f727197ada200fab9845a3c21a56a6e70d1eb3e19386190ef79f623e", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679095743, "uuid": "d125d386-9edb-4b02-95b9-574a29e496ca", "value": "T18CF2E165D336A207DDEAE271DD8B8A8F43B579C623C5700A5D5221E02B74599DE33CB0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679095743, "uuid": "588d217d-51aa-4368-8097-be3003e402e4", "value": "768:IXsPcZYugTG5WyrRGhmRF5MaCoo/H/EwedZCIsz:I85o7OaF5ov/EwaU9z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679095743, "uuid": "93319eea-39f0-4505-aa5f-9b9482b76d32", "value": 34416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679095743, "uuid": "1e3c466b-c798-4105-8e94-40c81e5ab53f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679095743, "uuid": "bb8e7b0c-55cd-40cb-a758-104e8727c6a9", "value": "c8ab875d6b1b16164342f5ababe8c391", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "210434f3-c458-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1679011830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679011830, "uuid": "3a1b410e-d630-4eaa-8506-cfacb87ed5ac", "comment": "Malware payload (AsyncRAT)", "value": "47e11a112a3d572494fa01c900e8df20", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679011830, "uuid": "e3515541-d0c7-4521-b8be-aa1c09ec91ea", "comment": "Malware payload (AsyncRAT)", "value": "76f655949c39dfd591636997afae0a090c9ac51f8972e862a092eba574f517e9", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679011830, "uuid": "8d15e620-69c2-4b77-a319-e62757894021", "comment": "Malware payload (AsyncRAT)", "value": "883caa80b22b49ec89c9b913fc86e7bc24b8dae0", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679011830, "uuid": "903bc247-e954-49f6-b3a2-bfab5f091d6b", "comment": "Malware payload (AsyncRAT)", "value": "08a8eac9f7ceef03dd0caabe27f9b4e9343efbff94aedff92b73f2e55d5e8ee05fbc0ad47c2f65c26b8d89b6f1838a8c", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679011830, "uuid": "ed27dada-e0e4-4320-983b-f55ee0714df7", "value": "T1CA432B003FE9D126F1BD8EB4A9F2755446F8A1A76902D94E1CD411CB0622BC6DE43BEF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679011830, "uuid": "aa8005e3-68a0-4276-b949-b24bb52da285", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679011830, "uuid": "a5dafc49-a028-4529-9fb3-b4dd8cc4b9db", "value": "1536:VT/FkQMcYNVT5O2MqCqKbw1t74rl/VCzq7Qx:VT/FkQMcYjT5OrqKbwkCzq0x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679011830, "uuid": "7fd0a2c7-31be-4f03-9a6a-adc0c3f002fb", "value": 60416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679011830, "uuid": "b49d235e-5c1a-4d99-af1e-d524d4782dd4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679011830, "uuid": "6077d119-77d8-4c65-aaf4-74dec149e5db", "value": "47e11a112a3d572494fa01c900e8df20.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec2d0a4e-c47f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1679028922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679028922, "uuid": "45abc282-b4dc-43ed-89b9-204d8b46cc78", "comment": "Malware payload (Formbook)", "value": "13a237b2f7042de8f7585c54d2432b6c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679028922, "uuid": "fca71c2e-96f7-4900-b8ca-af5a00f6dec8", "comment": "Malware payload (Formbook)", "value": "77194b668ce640225df0d876e991d58dc8c08e809474cd21abe5dc030857cb10", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679028922, "uuid": "f0dbddca-6d47-49c6-b88d-4e9411162b60", "comment": "Malware payload (Formbook)", "value": "a6803950285eb446fc57d9722507816731ec93f6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679028922, "uuid": "569d5b60-e5c0-4e04-b3fc-0ac33c92be65", "comment": "Malware payload (Formbook)", "value": "3e59affa48b4d3139a1c43fb60dbe65a8b731e9e160f518e7a42b449ebf69bf05c25420b675a6467ff1548eaac67ff9a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679028922, "uuid": "83891a5a-14b8-41bf-bfec-faf3d6a1e773", "value": "T121151249BB29DB21C2BE87FE7476701193F3845F622AE3485CCF64EE7A62F510501A4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679028922, "uuid": "825b7082-7b75-4759-a2b6-7b3e47da0c71", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679028922, "uuid": "dd31d605-7824-431b-9f71-d74a6d0539ff", "value": "12288:hzCmBMpjkjXyuaqPMQK4bUyicmpOwKgkf6QktWivF1HxjqQBxK9i/v8:pcjkj+eMYPivO5f5kWSjpqQBxJ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679028922, "uuid": "e131c2ee-b271-4fa8-aaee-86cd6d537d10", "value": 892416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679028922, "uuid": "73f4e7a5-7fc7-48a8-b5be-204ec142e606", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679028922, "uuid": "f3a56198-9df8-4323-9e48-2310f983e86e", "value": "13a237b2f7042de8f7585c54d2432b6c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f3054d0-c4af-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679049220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679049220, "uuid": "8efc2060-f3d7-4cef-8977-dc18280dcfde", "comment": "Malware payload (Mirai)", "value": "4bd694e90bbb9e72cb398758f9d12be4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679049220, "uuid": "30bb1a16-a013-42f3-a5ed-d8b9e0e0092d", "comment": "Malware payload (Mirai)", "value": "77569fa826f1f24300dc9c2a5985e8acef3f0fb1173bbb024cf9142200931f0c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679049220, "uuid": "f7819195-f434-4f4d-af1a-4558c3b552f4", "comment": "Malware payload (Mirai)", "value": "f2f12a2b6a89bcf2d58dd366836e498cbe95cde1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679049220, "uuid": "886dc2d5-48fc-4b33-a55f-170be3ce64b9", "comment": "Malware payload (Mirai)", "value": "12233a2ef552830ca0f0bd65bb36bbe126f09334af439fc20529d1ad8b0a0ac6f762064f3c36a1fea512a4be04576d37", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679049220, "uuid": "a63d4cba-5d66-4072-88c9-351ec79e7c85", "value": "T12E73831ABF654FF7E8ABCC378AA91B0124CC651A21A97F797930D814F24B24F55E3870", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679049220, "uuid": "989d7e6e-860c-4ba7-ba1d-4b83c8a4c4bf", "value": "1536:7p/bgkjaVYjj/36mI7MZz4ODnu9d6dPRRo1/:7dbgkjaVYHCQZz4eP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679049220, "uuid": "8947e00c-4b28-4620-8e01-5d3d368d3eaf", "value": 76476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679049220, "uuid": "0fd002da-41a4-463f-83ae-04f8b6b8d37e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679049220, "uuid": "0450dce3-64a3-489c-9733-1a394b2fa7ea", "value": "4bd694e90bbb9e72cb398758f9d12be4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e6a11a0-c4ca-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679061003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679061003, "uuid": "fd77d03d-43b2-4121-8d72-8b0e2689afcf", "comment": "Malware payload (Mirai)", "value": "c2d07e64b3e8c93264e87c6d8185d29c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679061003, "uuid": "80189f9f-8f5a-425d-8043-85bf45ae3875", "comment": "Malware payload (Mirai)", "value": "779deb9e9f6fef73db921743edca70f373292d728cbcd238aeab28d456f71ab6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679061003, "uuid": "37ef7009-0e02-4293-8c99-1da02008b1d9", "comment": "Malware payload (Mirai)", "value": "95bc51466ff168d04895b0a9ae8f98da865b4963", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679061003, "uuid": "3d79b2f0-16dc-41fe-ac35-1c81354b5c27", "comment": "Malware payload (Mirai)", "value": "0008a8817d77096a1a09ba7f6c272d31bf8e047993767e69dccf05035f5f32fbc61fd288a9648d0e8cd39690a6507c46", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679061003, "uuid": "afdca49a-9a21-4a02-9f16-5d95e2644204", "value": "T1FEA2E019BF28828BC836297555E9E9D21393FC61F29DCC0D6540C16FF5A33A92834F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679061003, "uuid": "334efab2-516d-4627-a773-ef10e14bcdf7", "value": "384:MgWLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXadmTb+502F2vwA9dWuMW21bAK1oTO:O98o08kxofBE+ZkXaITbp2F2TWul0c5y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679061003, "uuid": "9fead3aa-2dba-4c8c-9b01-f157f06479ae", "value": 21500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679061003, "uuid": "326f74ad-e3e0-417c-a961-99e4549f8baf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679061003, "uuid": "abe3dd8b-99fa-4558-8a26-2d0c2ffa7b65", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdd0bc3c-c4a5-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1679045165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045165, "uuid": "a14dab6b-eb13-4783-a27a-d95b122baf72", "comment": "Malware payload (AsyncRAT)", "value": "97bf48e51ff002f6d9f5e778e52d8319", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045165, "uuid": "df3eec41-90a5-4237-8128-ae34882a9b96", "comment": "Malware payload (AsyncRAT)", "value": "781415b6119448b0765637cd119276949935b7c79a448d30960224f71c137f28", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045165, "uuid": "8e7b29c7-1023-44fd-adea-8e3c06335151", "comment": "Malware payload (AsyncRAT)", "value": "d438cbf1d22a960524c27dd97c1b0516ee344687", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045165, "uuid": "17034a1f-a37c-4a49-ab2a-dcb5f9588900", "comment": "Malware payload (AsyncRAT)", "value": "28625f93e8e523123276d29c941261140c8ab585e23ff96dc7b2ba2ca6258b438572a22debc16f085250b154aa4edb77", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045165, "uuid": "248469b7-2029-4019-b8b4-2688b517b727", "value": "T1D993190B96D879EEE12B9BB35D5B9F4DA678B9533D0ACB052260074F50720CEF203D92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045165, "uuid": "47ad9d06-3cb6-4769-bbfb-a1ea9e480c1c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045165, "uuid": "f525945f-1092-4eef-978a-34445de26476", "value": "1536:byJxJglcDm/GcHrvlTOqwWNu5j0lucwY6jkHFbg6yRgUA22gcK:bKglcDOGcJrwWVwryFbg6yRgUA2pB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679045165, "uuid": "c59cc9ec-e5f1-45b9-bc3d-300974b82416", "value": 89088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679045165, "uuid": "8355078a-9a58-4bef-a4c8-407f87277c19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045165, "uuid": "4d0f9974-42b4-4570-83ac-ca4a739c67eb", "value": "97bf48e51ff002f6d9f5e778e52d8319.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20352082-c4f5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vjw0rm)", "timestamp": 1679079260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079260, "uuid": "b28f79dc-1290-47bc-ad59-4f05ae4a8165", "comment": "Malware payload (Vjw0rm)", "value": "fb50b5a527b81faf53eb766fc69645e2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079260, "uuid": "54631170-3b04-42fb-aa86-1d1eb684d6ce", "comment": "Malware payload (Vjw0rm)", "value": "786b63ecc1fb8174eb1301a5498ba858ccac1978cb745afde8c8cd22c7c962af", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079260, "uuid": "65e340d4-1bba-4832-a291-54a5080e1081", "comment": "Malware payload (Vjw0rm)", "value": "30b12f026d2122f487973235e5d46651a3040996", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079260, "uuid": "b0a7f767-5afb-4149-8bc1-ca511630a9ae", "comment": "Malware payload (Vjw0rm)", "value": "399b29ceda88f2b56b4c18d6435587c503f147a8a921324362dff19377837f7dc03c0faee319a2985b6657b54de127ae", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079260, "uuid": "dd0f08c2-0385-446c-a331-c8b4519e0855", "value": "T13FE155DC9A8ACC074B8E9D73DD564DD66732837497C9398F820BB94C999D1A3F400CB1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079260, "uuid": "3c8e69af-6c0d-4e47-af33-438783ef8a0b", "value": "192:CZVh76ew2V2ZIPoH5Xi4FvfkumcR9E+dir8OE3:0V0ooH5Xi4xfkL3pIz3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679079260, "uuid": "27f6c4fd-c059-46ee-8f67-6fd49ea7492d", "value": 6987, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679079260, "uuid": "e203432c-bf3d-4b1d-b0e6-e55b381e8adb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079260, "uuid": "1aa1606d-9e0d-4b1d-923d-70da3960da6b", "value": "1133543545.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d93bf0e-c4b7-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679052707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679052707, "uuid": "bf7b14b3-a641-4564-a3da-56efc3f018a8", "comment": "Malware payload (RedLineStealer)", "value": "b93f37b3bfe0b331e15bb3ffac941f04", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679052707, "uuid": "1adae199-1a5f-4eea-b4cc-23b69af84fae", "comment": "Malware payload (RedLineStealer)", "value": "78c5fa2cb5ac009370a09eb82bbc7ad80e1bf4947e39425dbc64768a00aec564", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679052707, "uuid": "fc699e2c-db5f-4731-aedb-1b6524a6f00b", "comment": "Malware payload (RedLineStealer)", "value": "ae6968d31bfa137e98f3faf6d16d90ecfb1b23f9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679052707, "uuid": "30045860-34ee-4743-aae1-14602dccee02", "comment": "Malware payload (RedLineStealer)", "value": "3187dc3aabdfd676203b4ce0cd280cfbded61c57c5cfc37525a9570322c6f9ffa1070a912cf02baa736c858cf778b6a7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679052707, "uuid": "76d2a5a8-12ad-4a8c-9215-5cde957391c8", "value": "T195052312AECC4432DDF117B05CFB07C30A36BDE58939E32A1596E89A1DB2AD4653136F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679052707, "uuid": "6e4d1585-5da0-47ba-b30b-4b498ca2625d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679052707, "uuid": "f9bb6d59-9838-412a-b191-e8783a522da7", "value": "24576:7yJRiHMmwoDA1WCS6LyTKu3jP63vPS3BVk:uJRi1t+WCS6LoF3jj3BV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679052707, "uuid": "d47c39ea-de5c-4b87-95d2-9611d791c5dc", "value": 864768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679052707, "uuid": "36358f74-ae91-4370-a698-fd5f7df65b30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679052707, "uuid": "4bc0fd5c-2f8e-4ada-9620-0a693a249d42", "value": "b93f37b3bfe0b331e15bb3ffac941f04", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aecb953-c4a9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1679046690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679046690, "uuid": "7a91152b-ad95-4caf-8b0d-0e23d5058b5c", "comment": "Malware payload (Gafgyt)", "value": "d1e999ec9f7ff234e78608c75411a32d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679046690, "uuid": "9c6803a4-0cf5-4e7e-a739-b2747aef6f2d", "comment": "Malware payload (Gafgyt)", "value": "79bd0288842988df644c1ef8b96be72c36a4313217a5d3d5af0e64db6672d4f7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679046690, "uuid": "8d4cfbe1-1ae4-4614-ac15-2844737e47e7", "comment": "Malware payload (Gafgyt)", "value": "fedf51d4400cd6a4418f877645939ab20e17b456", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679046690, "uuid": "58f77ad9-3e55-4afa-89d0-a7194996a80a", "comment": "Malware payload (Gafgyt)", "value": "0001a2f64411f015ce73e011edc7752a369796f4f2eac07cc1851f05f1b48ca542af9305ffcf463f5654b775361cf00a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679046690, "uuid": "b4bcd003-4152-410a-ad0b-bfb27da27ad1", "value": "T12BC30A44F901475BC3E327BAE78E038C77355E6857DB33156A38BDB42BE1B982D29260", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679046690, "uuid": "123507e1-cdc1-41ee-bd95-549c074aea8b", "value": "3072:H63VpNeuWDGeQf8sRCVt3DxkS2YmyVUQuiXfQd6W:OSuWQEcCVt3ZmyVUQuiXfQd6W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679046690, "uuid": "e54d5e41-6a01-431d-a2a3-b1585bd413a5", "value": 127723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679046690, "uuid": "eca029ab-b26f-478f-b47f-57ec37cd3ca5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679046690, "uuid": "449a7002-c4fa-4e7d-a873-e4c2149ef6e6", "value": "d1e999ec9f7ff234e78608c75411a32d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3da76e8a-c4a6-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1679045379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045379, "uuid": "cfa0f0c8-585b-4851-9434-43e6c7e55aa0", "comment": "Malware payload (DCRat)", "value": "2d0cc7c5c9953f0b7c91b26533f93cbc", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045379, "uuid": "437fe403-6167-45df-ab48-ca238031e5e2", "comment": "Malware payload (DCRat)", "value": "79edd0ed1204d38ba8d6269eb025a5780067d2b4f11c6aee3318065ce6a14945", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045379, "uuid": "583e97c1-b5b2-4105-85ca-fb41d34c9167", "comment": "Malware payload (DCRat)", "value": "15745c7b80a2bfb4637dd160027a77e26dd47db1", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045379, "uuid": "2de7bb0f-ec5a-4c07-836b-9512b2c04b53", "comment": "Malware payload (DCRat)", "value": "4425313b8b1a356dca7a58def879f8b8a758bee4bf3ef7c75ad289418b95b6fe5eee7011d34a2624485ac2209acfa92f", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045379, "uuid": "5e831486-f562-487d-b0e7-a7c931150ff2", "value": "T117C560862F888533E249973AC6D36A2D93E7F40CA656D2C334E957B7341A7039D31B1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045379, "uuid": "c6f649e1-d9c1-487c-8414-f3a9a3e4158f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045379, "uuid": "f43260d5-e429-4f9a-bc91-a549fc209e59", "value": "49152:oWsTEkwghTKv4jysGUqgCoOtt1JKeENicJWTtv:oFEkwghTKv4jysGUqgCxtttEwRtv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679045379, "uuid": "ed8e3f67-f3d1-45d0-8938-20f4dfe7a786", "value": 2721280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679045379, "uuid": "1b270267-663a-4470-a9eb-53ce5b53b785", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045379, "uuid": "9620e3f0-a544-48fc-b857-ace89d39e54d", "value": "SecuriteInfo.com.IL.Trojan.MSILZilla.26093.14891.18400", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b79de64a-c4aa-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679047302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679047302, "uuid": "cbbba9fd-8541-45d9-91d6-1e40ebb36cb7", "comment": "Malware payload (Mirai)", "value": "340ee6650816b75f8f6dd43b858e01e6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679047302, "uuid": "c90ac5d0-8195-4625-a9ec-85a2a74f585a", "comment": "Malware payload (Mirai)", "value": "79fbcfe76ac20583f318f956c87f2ed0258246cfe862a8d8754572396985e3a2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679047302, "uuid": "b2797a85-f114-4728-862d-c0547daa13dc", "comment": "Malware payload (Mirai)", "value": "ab680f46393b2021c03553223d7ffefac59bb5c0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679047302, "uuid": "b2574356-2aaf-4576-8335-895106abf633", "comment": "Malware payload (Mirai)", "value": "7f1d189cd194862646849649d60b411f6e66a2917a35ff992dfa3204acca68d13592ec6c436da0d279cdd59359c79142", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679047302, "uuid": "93d94135-e716-4234-bc70-1e9277216ba4", "value": "T1B9330885BCD29A1AC6E0537AF96E809E331073E9C2DF7623CC140B1176C655F4EA3B96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679047302, "uuid": "6c1fd0f3-b286-4ecd-afe1-cb1d674b5fa0", "value": "1536:RfinNXlMJZdy9imMnjkYm7JSWOCrzO+1gAD2yKCQ5KkzoEOSSSSSSSSSSSSSSSSc:RqnNXiJU9j2yBezohSSSSSSSSSSSSSSs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679047302, "uuid": "161c21cd-178f-4ca0-a957-27e4d79a724f", "value": 51392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679047302, "uuid": "9e23ccd8-a3ef-4c58-9cbe-f60c4475c390", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679047302, "uuid": "87fdb391-328d-432b-9300-019e43f542d8", "value": "340ee6650816b75f8f6dd43b858e01e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "678dba84-c49d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1679041584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679041584, "uuid": "1677411a-fb6c-49fa-97d5-5f4167f9c0b1", "comment": "Malware payload (Gafgyt)", "value": "7c2c37586498f2328d565fa2a73ca336", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679041584, "uuid": "12e4ed45-61f3-478e-9173-1dc39a0f0adb", "comment": "Malware payload (Gafgyt)", "value": "7aae6723970b8845d9bf959a1fff9a63808cb20321b1569cbd6b0194c2afd746", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679041584, "uuid": "38e6e9eb-4e0c-491c-bfaf-bd4e30122b44", "comment": "Malware payload (Gafgyt)", "value": "70006e6dc641c3ebe78975bff082b8bf137adb7d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679041584, "uuid": "3a14173b-af4d-45c1-a438-c337ccf3eedf", "comment": "Malware payload (Gafgyt)", "value": "6fe46462d8f4f5decc83652e58922c8e35aebd866fe84f752df607e79dc092b45ddc0963b533378459ca02dcb2efbcdb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679041584, "uuid": "da86c7d8-9013-4f05-9ac1-4fa4e88f76df", "value": "T1AFB31813B7B1DABEC08252B12BDB92F19423FD7D0732622B33957DA51B388D96D59302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679041584, "uuid": "f5d49f40-1a91-4949-bc2c-2be7e4093eb0", "value": "3072:od0w4SAewzi+Xn+8Uhw6W+aP/JmDk1c8xF6KjW:zfO8IBSJmDk1c8xF6KjW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679041584, "uuid": "66694584-32e2-4f30-9724-3426c8ece636", "value": 114825, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679041584, "uuid": "349e4436-8cd0-4654-81a4-c533253bff55", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679041584, "uuid": "d9becd1c-1064-4dd9-ac19-a646fa3db49a", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df520b63-c495-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679038349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038349, "uuid": "8da6b8f2-b0fc-45f1-8a57-1af54cbd4e68", "comment": "Malware payload (Mirai)", "value": "12a3a9a69f78a3483b47051822a3a916", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038349, "uuid": "d57b17cd-dc69-4f40-bdf0-bef0c5698f34", "comment": "Malware payload (Mirai)", "value": "7acd582be2ff14571842de3723a4cd9dde6bf13d90f770950d88ccd37f175c1c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038349, "uuid": "fe2a929f-f9c5-49c4-bcd2-83babb44f88e", "comment": "Malware payload (Mirai)", "value": "674197768c56501edb6971b2bf68bcf98e2b1113", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038349, "uuid": "8222236b-742f-4717-99fd-41fffb1c9137", "comment": "Malware payload (Mirai)", "value": "27e88dc1cfa4515e9ab494e60c467a376a4347c75b3c96a70d6441d8379190c7b9137ac784facedd6d41b92547e480aa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038349, "uuid": "f1525d26-c6ef-4c52-8f49-1fa55a797679", "value": "T1FDA3F872E643CAB2C4430AF201A7DA6B0D21BE6B0A7A5A85F31C7CB09F334C57655F59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038349, "uuid": "754477ae-8a0b-44e4-9818-586e2a3ba952", "value": "3072:wW8FUmgujld6Mkxm6AJ+4fVHmmFVcqq0GnDZT:wJFv4Lm6AJ+4fVHmmFVcqq0GnDZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679038349, "uuid": "bcd74dfc-5156-4321-92b4-c9560d7ed640", "value": 104138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679038349, "uuid": "a0891f92-d138-40fa-8c21-72f2c1858792", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038349, "uuid": "a2e52703-eb83-4625-a2f8-6889690c01fd", "value": "12a3a9a69f78a3483b47051822a3a916", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "884af9fe-c4c7-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1679059678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679059678, "uuid": "8d056373-ec7a-4d50-81d2-96b93f1f521e", "comment": "Malware payload (RemcosRAT)", "value": "c03602c5c0802ff7a3aa1981df95665a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679059678, "uuid": "f7b610f1-2599-4906-a509-cdb20964d2e7", "comment": "Malware payload (RemcosRAT)", "value": "7b0d9ba55d89502a2c87615b74fa58bd2f1da801fb281e1bf1bbfc05361e9583", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679059678, "uuid": "ae728543-fe02-4805-9d0a-69bd0b42e14a", "comment": "Malware payload (RemcosRAT)", "value": "8f521a2a74841ecaae831686501d255f89d41a6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679059678, "uuid": "da6f24fd-7a87-4db6-86ed-c81c96260416", "comment": "Malware payload (RemcosRAT)", "value": "c159887ca4becb2dd6015e4849bb6dcf1a68392633b8cb94f38a78673df8fa3eebcfca494e4a14334859a977bae74c97", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679059678, "uuid": "b737b6be-211b-4260-92e6-7b8d1fa60f5d", "value": "T1922523E8728D872ECD7DAFB92021888663F7A37EA097EB4C4DD560848D13F054566BD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679059678, "uuid": "b3486c2c-6af2-4ef0-8869-14e102f87efd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679059678, "uuid": "de3c7f98-1184-4a87-8e9d-8498755c62ce", "value": "24576:Dzl6TJIglIUS6+DfSf82qoRFBTkpYwN9daW3UWdf0jFFW7M0csHr:DM9zaUqfUtqIzjwHdaW3FsjfazPr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679059678, "uuid": "c7a1e314-280a-43ff-805c-a6563d46f814", "value": 1052672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679059678, "uuid": "cff911ad-6c97-4524-b2d6-98d1d5d8f71e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679059678, "uuid": "5dba551b-299c-4aad-b4df-4064891bbec7", "value": "HGF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de34a131-c4ce-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1679062828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679062828, "uuid": "c9063cb8-fec1-4b36-9254-d5536950d52b", "comment": "Malware payload (Amadey)", "value": "52a81c3cc0703a5f1053cb18a583244a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679062828, "uuid": "4636bcf2-fbe6-43be-9923-273fa1f12765", "comment": "Malware payload (Amadey)", "value": "7b8400245c4ae4c8a7728369b2ec2832556fef83a1d70917bf6019ca8cbd8ed5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679062828, "uuid": "c9331e8f-5d4c-4a3f-a7bd-d0bbe668f705", "comment": "Malware payload (Amadey)", "value": "4e868d2e9a2e8852a4ac74fba5f8e6404350dd7e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679062828, "uuid": "bc8f84b0-849e-4f35-a644-1a2684565a2f", "comment": "Malware payload (Amadey)", "value": "07083f709c05f6bfdeb973c171e771dbbfe9b45d2b6090436a639b83892e1ab4e44bbc17a256fdd5a66e30934d007fbe", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679062828, "uuid": "8dadd418-5868-4915-99d1-f2faf3770737", "value": "T179643A0397E17C50EA268B73AF1EC6E8765DB520CF4AB7B62218DE1F04B1172D663712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679062828, "uuid": "a447a1c2-b053-4a57-b9ca-cd5e36e4fb0f", "value": "abe3ddf8623240e0db2d6ab65f42f1d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679062828, "uuid": "ddca77fe-7eef-4641-b142-2bf8243bd6c7", "value": "3072:F+02jE1LBoBPNsybiL6PGWYvg6TSe5EQ1XQS4qSDpTqnI3Qk1YB:FL2jE1LmBlsybiKYFSeuGQdu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679062828, "uuid": "d70fb684-c894-4b50-9c92-4faaeab67c0f", "value": 307712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679062828, "uuid": "6f4aa107-4e93-45e0-92e3-2cd3977f5b8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679062828, "uuid": "1a6dba68-37e1-466a-8a71-7f59fe0e0b83", "value": "52a81c3cc0703a5f1053cb18a583244a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2d4a047-c49c-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1679041334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679041334, "uuid": "9f243b63-2dc5-4179-954f-0789ec1d62ae", "comment": "Malware payload (SnakeKeylogger)", "value": "04745ac4f36815aa9af2f5436c124b59", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679041334, "uuid": "5041222d-e08e-4cce-baca-7136287575e5", "comment": "Malware payload (SnakeKeylogger)", "value": "7bd6fd45434b472102b1deebcdf02410a0dc297c250d04ff9dd8418285183874", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679041334, "uuid": "c08dc2be-75a5-4d3a-ace1-1a6d0e17a8f3", "comment": "Malware payload (SnakeKeylogger)", "value": "19f3943f796f606f9a87bcc448f9b339d001296f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679041334, "uuid": "b8ac3e4c-d85b-4fa6-9ac2-5585318333a4", "comment": "Malware payload (SnakeKeylogger)", "value": "456c6d2fcd6ea6322c80d220536c191a09e3ae9539d8d91b42c17d5c854a4ad0d29ad807c2dd01b38495d5bfcb154edd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679041334, "uuid": "1add0e0c-9db3-45a4-91cb-0723bc343e0e", "value": "T189A4E06D33EC9501E3BE997325B04151C67AB8021E6EDE0D5AC1F429293EB588E1BFD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679041334, "uuid": "a8d281e5-b6d0-45b2-acea-8a377397dd42", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679041334, "uuid": "6274c019-814d-4d04-8e92-57da28631dc3", "value": "12288:rk3E3HDei3oXA2jCXgXLz/HQOqzjW/Nh:rkU3Hq6oXA2jBXHnqzjG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679041334, "uuid": "157e9f2e-98a1-4c86-9e31-fc624fb049a0", "value": 481792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679041334, "uuid": "256e3b35-bc84-4701-9c15-53bc5d3436de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679041334, "uuid": "a5379090-2730-4088-8bd4-0a84759ded3e", "value": "04745ac4f36815aa9af2f5436c124b59.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bb892c3-c51b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679095708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679095708, "uuid": "90291e92-96ba-404c-9dc7-1a2d65d57900", "comment": "Malware payload (Mirai)", "value": "dda4c18300dfa64a00551c26e752e209", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679095708, "uuid": "d1f1e8c4-3e87-4b12-a2da-8060ae522753", "comment": "Malware payload (Mirai)", "value": "7c73b9062dd1975db03e1c5e0e137d91db5ae5c0f9be224765ca52b73ef3dff6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679095708, "uuid": "f3998ac4-6139-49d6-bce8-7d3486f94683", "comment": "Malware payload (Mirai)", "value": "37ec42b28967316abe907c1d05e975412964f929", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679095708, "uuid": "45cef5ab-8900-408f-ab70-a6d0042ced5f", "comment": "Malware payload (Mirai)", "value": "bf30213a71e194172ea52a1f9925396b0deddee25a39f58df63e64c22cb6a56b97ff19d4dc80bbd53acf01505fd37605", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679095708, "uuid": "d32180ce-ad9b-4726-96e4-1e49a2d5e3c0", "value": "T18BC259A2C52E5E48C60882B4E4705E381B13F429E7671FFB1A5F81658027EDDFA193F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679095708, "uuid": "6fed3f57-265f-456f-845f-5d65edcd244e", "value": "384:Ma4Eults6+5h4/eI7w2Nmgxuks2hlNeyYC+NeNB5fSl+CY42yoaTCd/6AqBWbxDk:Ma4po5Weqm5ilUfC2bo8C9rjl21", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679095708, "uuid": "e9d169da-84eb-485c-bff3-b47c29a4ecb6", "value": 27748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679095708, "uuid": "adbc92df-87de-4a6d-a7f3-116d363e950a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679095708, "uuid": "56d30b69-2691-4abf-80a9-23b8b0a0cb48", "value": "dda4c18300dfa64a00551c26e752e209", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0f452bc-c50b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1679088925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679088925, "uuid": "a1f4c8b3-e946-4da6-acdd-fc059ba893ce", "comment": "Malware payload (Amadey)", "value": "3dcb6a0d2f3ff93b20b95f9b93626ab0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679088925, "uuid": "4167537b-aaff-497f-a5bd-e894ca2ff818", "comment": "Malware payload (Amadey)", "value": "7cb9edabc72fd0d1fe0767d27a4369297ba0f5229c476ba31f91640ca17b9d1e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679088925, "uuid": "518b1aeb-f5c4-4c8e-bdb2-af7416772567", "comment": "Malware payload (Amadey)", "value": "ef69000352792fb1834a3fc9f6d27eb7e56c40fa", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679088925, "uuid": "9f310918-340e-4766-9b6d-55635df7df3e", "comment": "Malware payload (Amadey)", "value": "012c5b6d2158bd5ebf042f7baa2d2b56a55b9941b2572f30026c71bff03c6f146f98d88d35cbfe252333768d268e72be", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679088925, "uuid": "d6ce2cb9-8458-4b11-9ed8-f21922d59907", "value": "T12854191393A17C48E9268B729E1FC6EC771DF6518F89776532289A1F04F2272C163F94", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679088925, "uuid": "476c7bf5-9d73-4d11-aa45-880b220b7a45", "value": "9fce6c081ab87c2bbedff5f8a5ba7a52", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679088925, "uuid": "17594f24-f1c8-407b-b242-433708ad613a", "value": "3072:3UGuLw1LMeWazyKRpZYl+e2mxVjb/I+XQ7Y/nlb/f5RFN9pwypftxtuM:klw1LM3azu7Hjbg+XQ0d35RbVFtu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679088925, "uuid": "977319c9-13a9-4a3f-a64e-71ffb60d7235", "value": 303104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679088925, "uuid": "cfae87eb-e9b9-46a5-af5a-756d6c527f95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679088925, "uuid": "7c16193b-8a7b-49fa-b5a5-b753d435eef1", "value": "7cb9edabc72fd0d1fe0767d27a4369297ba0f5229c476.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e060321-c4cb-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679061325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679061325, "uuid": "01a0c2a6-a9c6-472a-ad61-61f6594144e4", "comment": "Malware payload (RedLineStealer)", "value": "33161cf6840d5a528ce61dfaf5fef99a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679061325, "uuid": "7f568f29-1065-42e1-b97f-5a7e6732db31", "comment": "Malware payload (RedLineStealer)", "value": "7cbb8136db04df3cbdad3b36d0b83896aca5822c7e8695ba580799534c7fbf0d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679061325, "uuid": "d92ead85-7af3-4c4b-9ebc-14f24f3e659d", "comment": "Malware payload (RedLineStealer)", "value": "cae04368b3f74b210ada76cb40f05bde836a5a70", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679061325, "uuid": "90365527-13e3-4ef6-8a0e-e827131079db", "comment": "Malware payload (RedLineStealer)", "value": "ae9a9a7369496d9b596fbd8a8d72413125170b09bf1f2fde64306ddd9a7b89df1e4c7c4c113ef062639f21450d7c347e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679061325, "uuid": "41236fda-07d8-4362-a599-4bf7640b834a", "value": "T1F645F1539AA17C50EA168B33EE1FD2E8761EF561CF4A7BA53218DE1F05B01B2D163702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679061325, "uuid": "54c342db-a777-4126-a9ee-2b65295dd48e", "value": "800c211657980cdb5c72386d0a0450fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679061325, "uuid": "f0001eac-5889-45e0-a97e-35fdaba7d1b3", "value": "24576:rBAQnUjC25pKw8ZWQl9D3c6jenpDQz3EmFXTi5+YzYcY:rr8pKw8ZnTRaWzQzN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679061325, "uuid": "2180fe82-f73d-429d-85b5-994cd187d5a6", "value": 1238528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679061325, "uuid": "447adc15-fb75-44da-9f28-8990594bdab3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679061325, "uuid": "bc082f65-c18e-47fc-a27e-57ee893e254b", "value": "33161cf6840d5a528ce61dfaf5fef99a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f7a5799-c4ae-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1679048979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679048979, "uuid": "e917e9cf-464b-418b-8204-15549550115f", "comment": "Malware payload (Loki)", "value": "b6157bf7275c8d32dfdd87e4aefa6443", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679048979, "uuid": "96ebdda1-4d14-48cb-a097-5429458bc8a6", "comment": "Malware payload (Loki)", "value": "7d1ba26b15557e0932bb07292025af17139c1f7e8b9f078ed688533b485b0cb6", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679048979, "uuid": "8d004a1c-f468-4964-9574-6455b994c37c", "comment": "Malware payload (Loki)", "value": "7add9cff51c5e12ce24585e773fc02347d9dbc95", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679048979, "uuid": "1f773001-9122-4f54-b31e-55132011b88b", "comment": "Malware payload (Loki)", "value": "9e0dec58b93635eed1585d9f03a311a3b1df82a89e917b7891403535f55989ddfe8f77333b0133661ee0de4e67c336d9", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679048979, "uuid": "0be72b19-cdf9-49e4-9b11-3b6389557aa9", "value": "T1BC82E8A9D7470276CE5200B6971E028943BDF17EB25550B238BC467833FB81AD67B6BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679048979, "uuid": "5e133c1f-9bdf-431c-84a8-eb76e27c9132", "value": "384:bL0AbZSYlNU6c598sm4TUEYX9HJWmNznSD9O5L:bwAbZSOZc78sjZI9HRnS+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679048979, "uuid": "6eab16de-b2f3-4f48-8cbf-82097644770f", "value": 18953, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679048979, "uuid": "17df47e6-ac60-4487-9aec-6430c5427329", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679048979, "uuid": "48b2e605-ae34-4e2c-9fb6-2052c1e2246a", "value": "SecuriteInfo.com.Exploit.RTF-ObfsObjDat.Gen.19058.27863", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "478eff95-c4a2-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1679043678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679043678, "uuid": "3bc07290-4e40-4f5b-8a20-34491cf14449", "comment": "Malware payload (SnakeKeylogger)", "value": "d4124d55d352edbaa4db7e8facb35b70", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679043678, "uuid": "681d6636-36f3-4a74-a7b2-fa7eca61c94f", "comment": "Malware payload (SnakeKeylogger)", "value": "7e039e4d466d67e2e7fe4cf46aa141db13f2454161ebc86ec1dd02c33113d154", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679043678, "uuid": "25f74aab-2d25-42e6-934d-647d38a111df", "comment": "Malware payload (SnakeKeylogger)", "value": "644178583390f3075a6c14bf35902d501d697e2b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679043678, "uuid": "179940cd-7885-4ccf-8819-03641b5bd490", "comment": "Malware payload (SnakeKeylogger)", "value": "b0bcc82722b93a3e64c3c46db022c9638660a3f38b27612d263763110c0ba41a19b10911209a5f9fc1293c9eb0ae6006", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679043678, "uuid": "471ad08b-0f57-45cf-844f-b49cec6b274f", "value": "T117F4024CADE46A05CA3E0BB7E4D360A093B295029F81D70EADD619F62F323D7C541C6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679043678, "uuid": "bbf10bbd-9fec-4adc-a2e3-50aa357e8e2c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679043678, "uuid": "1a79fa48-9aab-40d3-8288-5b4f308b4c73", "value": "12288:DUWz9DgQwoLZUk1w4gKyeQJOWAMVAi5GK8Stkup0Nk25jziTpDcVBIPzRQ:LgQwcZBw4gxeQJOWAMVvpPtkupop5PiC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679043678, "uuid": "6f652a26-58ba-485f-8b79-0a14ae5a37d5", "value": 772608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679043678, "uuid": "130b249d-b8f7-423e-a491-03896dc522e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679043678, "uuid": "51d252c4-d7dc-4b8f-b33c-eecde7700062", "value": "RFQ-GCE-Piping & Steel Requirment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40ef7e19-c4a9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1679046673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679046673, "uuid": "b04577b9-6164-4b6a-b919-cd318710d460", "comment": "Malware payload (Loki)", "value": "089d4b6c54ca88e0b040322a142e2101", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679046673, "uuid": "b9a374b4-0618-42eb-b7db-aa05335fc1df", "comment": "Malware payload (Loki)", "value": "7e1dc494582780c64746c936c3975a5435c8f9b6e7e848d229c11ce9e6f6a2a1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679046673, "uuid": "369ef720-0b5e-4c51-a3f3-a8630dcee51d", "comment": "Malware payload (Loki)", "value": "5ca2baaef7f766c033f652f14d13a4112806b3a4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679046673, "uuid": "8e2f4246-de8b-4eb3-9b27-d251386c0914", "comment": "Malware payload (Loki)", "value": "0267421216172647f0ca1d039d4654ad9e64a6dc6e62d5def03da0ab3766ce837348e06a4c30ed1fb895e361c10f3e30", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679046673, "uuid": "308cbf46-adf3-4e90-a30f-84ce09c9e18b", "value": "T12804011577E0C093E5A20F314C7A9A5F5FF199361C718A6723E89B987E71702EE1E322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679046673, "uuid": "93960a03-9967-403c-92ec-5213bdfdfdd6", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679046673, "uuid": "83fdf5cd-ae37-4aba-a1d3-291a176aa0b0", "value": "3072:3fY/TU9fE9PEtuabA4wXgBn4cZQbltx7gayS+tY2ka5yVUMFnItlBsYcPb:vYa6yrwq3ZQZL7gPDJV5AnItlBG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679046673, "uuid": "75b5961e-9a96-455d-a6a5-2087a1dc5e66", "value": 177904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679046673, "uuid": "d471ba82-e1c6-49a1-8189-f3d37b1c8af2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679046673, "uuid": "643e9901-bdb3-4bc3-b2a8-e8c514fdc98e", "value": "089d4b6c54ca88e0b040322a142e2101", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb73967b-c4c9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1679060703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679060703, "uuid": "b90a86b5-da13-4730-8e38-14fd78f3b7aa", "comment": "Malware payload (Rhadamanthys)", "value": "d1f8e6ec0e0a31e2e8cdbb836d1dc5ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679060703, "uuid": "4752aff6-c0be-435b-bdd8-3436110a21c5", "comment": "Malware payload (Rhadamanthys)", "value": "7e4dac07d2696331da92d33b3b8d888dbd60272845ebc7889ace9709d6cda45a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679060703, "uuid": "2b9aeb01-27f0-4113-b155-a0276d4619b8", "comment": "Malware payload (Rhadamanthys)", "value": "2876f0a9e0b7fdec1a711a41f37244d2ddf208f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679060703, "uuid": "aebc2d98-0ff5-4d15-9831-649326284cf4", "comment": "Malware payload (Rhadamanthys)", "value": "29b71322c62761ce2245f94d9e4da7bc30df32f16c9fededebc741f37d3e792c46929b0d8649b7b660fc33697cc421ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679060703, "uuid": "28c84944-8a66-4936-9254-e68a3a3673ab", "value": "T1F3745B53C6A27D44EA258B73AE1FC6E8761EF5608F4977BD2218DE5F04B0272C163722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679060703, "uuid": "bbdeef0f-769f-47a0-87aa-108226b415fb", "value": "800c211657980cdb5c72386d0a0450fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679060703, "uuid": "7c577f71-06d4-4c72-8e45-85aee963a748", "value": "6144:fJcLT8i79LouEtgChMxOLN6d3SWC6CKWxD0d8o:fJccip0udCYaMCMWxD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679060703, "uuid": "6425d5a7-5e58-46bd-be3b-887044e70996", "value": 366592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679060703, "uuid": "4632b123-31ce-43a5-8ab9-b4b2ce1d5f7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679060703, "uuid": "1c999cda-a9e5-444f-91aa-fc713c903c03", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "536fb759-c4a1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679043268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679043268, "uuid": "94e1178b-f304-47ec-bc9b-c02d9b255372", "comment": "Malware payload (Mirai)", "value": "eb9159b9d3ad35096ac29ead276eb6ab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679043268, "uuid": "56a99696-7d18-4bb0-b319-9e85fdc4d41c", "comment": "Malware payload (Mirai)", "value": "7e6ec8afaa16b441758d0227951f97b6e7dc303212b0f3f61d4e2e302d58e807", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679043268, "uuid": "09f5944d-e5b2-42e5-823f-15a2907ee733", "comment": "Malware payload (Mirai)", "value": "0f1c55ff080510283a58761822a6f3853ef9888d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679043268, "uuid": "1738c915-5d36-4072-a56a-3a6b236b56e8", "comment": "Malware payload (Mirai)", "value": "b0c9bccde24dd1c0cd477a08952ed4f033e295b4733ca2e6903338010bfad8bdb17b3e57eb746f92f0e27194b53b5012", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679043268, "uuid": "be50d374-a1d7-4d53-8493-6452d0bd43b9", "value": "T114D2D1EAF2DBD4F0E5F585B4505C10C0F468339A5B2487FF089B61BD88A26DA6638F51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679043268, "uuid": "ccf405a6-2be3-44c9-b2a4-019a487e54a5", "value": "768:kYSoXdJZtUjkFfNJlVrQeHvPx2csGHESkrzAHSx0sw:kYJdJZGjkFV35/McrZmrtw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679043268, "uuid": "2b9f6da9-b895-41ab-b8d5-6a5b07276b7e", "value": 29440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679043268, "uuid": "5dc753e7-cfbd-4792-ad91-25a8f915fac7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679043268, "uuid": "cbc8d173-f027-4e7d-b616-26592b430cbc", "value": "sora.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ca0fb83-c4a5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679044975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044975, "uuid": "97d06984-7081-4ad0-a3a1-0d2c0372690b", "comment": "Malware payload (Smoke Loader)", "value": "97f1d0fc3507878c292fa8d484057c38", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044975, "uuid": "42c564a5-600f-47e9-a44a-493d2602fe93", "comment": "Malware payload (Smoke Loader)", "value": "7e883ac0d52e2740a28e0c19fb1a6c9490d00d302b934f5b5f2b69b8957c20d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044975, "uuid": "e643e318-8bbc-46fa-8dd5-508e83e42903", "comment": "Malware payload (Smoke Loader)", "value": "50f694cd8d8d484a3fc0802bb1ef92fc0c73769b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044975, "uuid": "fb3f4c0b-46b8-4bfa-8dc0-15c6e260dc78", "comment": "Malware payload (Smoke Loader)", "value": "81c4ff9faf8337c687f6d432d2fef9eafb05fbb9cb27d68064feae338c5c16d2702af6abc42e8ffe1ebfbd9c2f8e7db3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044975, "uuid": "dd83c168-5280-4cf1-8361-d618667b1e80", "value": "T16E048D0393E47C64F6264B718E2FC6F8771EF8538E69AF6722185A2F08711A2C56F351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044975, "uuid": "14d3ee27-73e8-49e4-904a-95a2aaa7da1d", "value": "4b2faf5e2157c756cf2fd31d6cfd3d44", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044975, "uuid": "c656ce96-5c17-4ba1-8c5a-3ba31b27245b", "value": "3072:2TxJntIwSYmF11CnYdKQMnSoYti4N6jh5srom/hVmXIdJB:wJtgtC6KQMnjYtgjh6rl/hBJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679044975, "uuid": "8bf2d47a-4c03-4cff-85b5-45a78521b373", "value": 177664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679044975, "uuid": "4550023a-5ab3-4f73-95a6-7d11bcf5626a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044975, "uuid": "190ed1dc-14c0-49a4-b699-0ec11a0abac9", "value": "97f1d0fc3507878c292fa8d484057c38.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a563d489-c49e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1679042117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679042117, "uuid": "74ec8cc2-9359-4792-bb16-9dc3ece68257", "comment": "Malware payload (Loki)", "value": "59489b0ee07903adb6bb92399b2a5d1b", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679042117, "uuid": "dbed91d5-9cb1-4afa-99c0-09b3f9c8e980", "comment": "Malware payload (Loki)", "value": "7e90e1125eafb350974734f39fe99636a0316c099f7860715cd543c2ff4e6852", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679042117, "uuid": "27a44f70-4034-45b7-a61a-9650fdc78255", "comment": "Malware payload (Loki)", "value": "9484f42f4de286b397b9d5508547a1fab63746ce", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679042117, "uuid": "88afbdba-c2b6-4da5-9984-ef28190569f5", "comment": "Malware payload (Loki)", "value": "4d8d48d2cb3baf5776b5edcfa9c8a5569669cc78ffd6569337c8d8eb3aad7e670239c1118e51df722acdcc5da9563fd2", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679042117, "uuid": "b5f67051-ce35-47c8-9d42-97541e6a9111", "value": "T10345011FB204DF4AC14287B95E67F9D9121D7D60ABE4B18736817B1F2E325A22AC71CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679042117, "uuid": "5b4a5273-79c1-430e-95c9-fe34becf9dee", "value": "24576:QLK7WQmmav30xK7GN7GJzmb0c5z3SwAqrmGY+qvCne4Pw:QLKaQmmQ30q7qAwmGYBvCe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679042117, "uuid": "8f97de9d-49b5-48ee-a484-484be14a8c44", "value": 1223680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679042117, "uuid": "1c81b291-44ed-4ac0-8be7-0b0d92faecd9", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679042117, "uuid": "5f23ce42-0d01-48cb-8775-0b446b906185", "value": "OUTSTANDING BALANCE.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97cbaeef-c471-11ed-88f6-42010a9c006e", "comment": "Malware payload (LaplasClipper)", "timestamp": 1679022767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679022767, "uuid": "8cd41d32-0acb-4090-8ec5-c18dda6a6118", "comment": "Malware payload (LaplasClipper)", "value": "83554c48c989188a5483b8cac98bd4ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679022767, "uuid": "b27909e7-181d-4cb8-a432-8229f6907c08", "comment": "Malware payload (LaplasClipper)", "value": "7ea5061e9ebeb45f7ef962d1566d74fdbfdaf81cfff399d22aeb1605e2501f11", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679022767, "uuid": "433596d6-6ff8-492d-b0f5-37389b3885ac", "comment": "Malware payload (LaplasClipper)", "value": "1a09f227dd35b01abb2a0318fa4b1dd74349ea13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679022767, "uuid": "79a8923d-9620-4ea7-b12c-7a0e8a7c670f", "comment": "Malware payload (LaplasClipper)", "value": "c410c9965cfc78cc4cdddd6986837eac17310ac22458167f7596723e498f78c327a6f79c227c0adf90979d2abf503133", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679022767, "uuid": "e66aa8cf-df85-4fb7-8c89-f7b6a285d734", "value": "T15434B04393D47C64F5228B719E2FC3F87B1EB4138E796FAB22145A6B08712A2D16F711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679022767, "uuid": "f8f7d5be-7dd3-4165-858c-0f2118b7dbbc", "value": "4b2faf5e2157c756cf2fd31d6cfd3d44", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679022767, "uuid": "456af709-d166-4adb-9271-6e51c261913a", "value": "6144:VbfmTinRvgDPVY7Rae8Vkpv9qmo3hLhJ:VbfmGnZgJYqVNB9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679022767, "uuid": "7ed59ff9-6c9c-4345-92f3-f9865fb42000", "value": 250880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679022767, "uuid": "495f9a40-fec6-4b0d-9b7a-45144a4bc49b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679022767, "uuid": "48cd18dd-6344-4fb0-a8b4-fab8a372e424", "value": "sample.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5417c51e-c497-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1679038974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038974, "uuid": "bc77f594-0709-4d7d-a5f9-de2b4ef665ea", "comment": "Malware payload (Heodo)", "value": "0d8f675a79a32d286f8eccb2ff989c91", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038974, "uuid": "5c7562d1-efb5-4c05-bff3-12ebdd0ed0e7", "comment": "Malware payload (Heodo)", "value": "7ef31d3538810c895812e331db91f905693b99b682d062d9d0b4dab5df0da0a2", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038974, "uuid": "3bb87c94-288f-4b4c-b892-1aea169f00a8", "comment": "Malware payload (Heodo)", "value": "e0796075d09841386c12f37503495c9624a3c393", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038974, "uuid": "6e13f4e1-4b20-4bc6-a1a7-fbc983f53d1c", "comment": "Malware payload (Heodo)", "value": "5a55118f1e13ff3f0969d9022bba35a10889ededb20e22101a13bca6d5709163a5cbf9f1de8875f4f49799378930cce3", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038974, "uuid": "c81fcb99-6896-4f50-b980-bca26a53931b", "value": "T1C3C33BF1A8025C0AE123C976B1FB661399D051ED42283B2BF87D507DD978A20D6DD8EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038974, "uuid": "c2b018e1-a8d2-4db2-9bb9-cde0cfd2e53a", "value": "1536:RDBoTVdaeNtuXndCrJJmT4HVnteV4FrdMiYcx7bfCb6HPdnXE:1BoC+tCYvSMVnte8ZP1Y6JU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679038974, "uuid": "4921f594-b53d-4acd-b009-e243d07d147f", "value": 120428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679038974, "uuid": "e5e394ab-e954-4ad9-9028-f1e2312ec51a", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038974, "uuid": "f3959cb6-8222-4cf3-85ac-8e0687946d56", "value": "Insight Medical Publishing_3.one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "465f7a6d-c4df-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1679069875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679069875, "uuid": "57940fcf-45e7-4f7a-a931-cd63dc7e9be6", "comment": "Malware payload (Formbook)", "value": "8e622cdc206d192aca92afcde837ba02", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679069875, "uuid": "44e8afab-7c7d-4727-bf24-ea73ba2089e9", "comment": "Malware payload (Formbook)", "value": "7f3e54772180ae88b60845cc87d6c4675481b02c340005e35fd8c23a0dbf0c3d", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679069875, "uuid": "6f66316f-5d8e-42fc-869b-ce424371246d", "comment": "Malware payload (Formbook)", "value": "b28d9d1eaf6228e71031fca0749ffa95b0037f33", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679069875, "uuid": "8d76ca89-6e29-40c1-8772-2b8a9873a85b", "comment": "Malware payload (Formbook)", "value": "d15337b7f1661b37e3dd1374a02f6afe39ee5b34d49008e1eb39b1d90d00d46e19b09fcb9bd8e354988dc1e4e998ff2c", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679069875, "uuid": "e85cccff-c10c-4f93-819c-948c43ee82ab", "value": "T1BBF43386C6DA7738AA8928079EF7A00A5C17673B652F3BB8CCC51408F71C865976F06D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679069875, "uuid": "6d3f89e8-2a50-4750-af92-98dd03624dbf", "value": "12288:6LbqUhtZ+/XX7xKO0a5mKMgkneOD2E+4lDKwDh724w5rJoc061eJB68CJj/q9qgd:6XdtZebxK9a5nWr2ODKwDh6Tgx6Iv6lQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679069875, "uuid": "217099f4-c8ca-487c-a4a0-a77c6ba8eb12", "value": 747181, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679069875, "uuid": "dc73f7a6-522e-4eb3-b19d-63f8b00d7cae", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679069875, "uuid": "61f17f1b-214f-408c-8b66-ca29cdf3b457", "value": "Inquiry.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03d4c0af-c4f5-11ed-88f6-42010a9c006e", "comment": "Malware payload (BitRAT)", "timestamp": 1679079212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079212, "uuid": "9dae33c0-64a1-444e-a0f7-065903f96417", "comment": "Malware payload (BitRAT)", "value": "a5a6fbe5e7f86784d14ce1f4d7672f6b", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079212, "uuid": "ddf14af2-5546-4a15-9720-ff243249977f", "comment": "Malware payload (BitRAT)", "value": "7f55a7b60a243743fe8f8f25220e8aae506d985ff963587200329f229cca2248", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079212, "uuid": "41195608-00d3-4af1-9a02-e6360352cf66", "comment": "Malware payload (BitRAT)", "value": "c8b9fc16cea841705b1b80152cc95f3322799c80", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079212, "uuid": "b8c964e3-2953-4f74-bb57-37710bac2dcd", "comment": "Malware payload (BitRAT)", "value": "87ac6bc52fb23ad2fcc5d070619170fbba68896fe4803406e73cad407abaf1335b331e0127bd4d77c728a8c6f722fe56", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079212, "uuid": "4345c912-0792-438a-98e2-9ab738a251ab", "value": "T13D613DE331185856EC466867D6B1BDF12043B7177DD9380872ACE7C310BE911CAA9C0D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079212, "uuid": "4fa792a3-3d65-4747-9abc-c4d9b1607c51", "value": "96:4HYHU3j+eS/IAV9kfAwNmycAvz++jIu4tB+DPacO9:JEPSzC4wcNAvC+jt46DPacO9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679079212, "uuid": "820cb1af-b784-49ae-b03d-2eb63caf87df", "value": 3424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679079212, "uuid": "c81fe03d-9ae8-4b10-80f2-0e4e9483d5d1", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079212, "uuid": "f6a66539-e7c8-4c50-8401-c5861721f637", "value": "zapitvane marko bulgaria eood.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b919209-c470-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679022263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679022263, "uuid": "2eec69b9-7762-48f9-85f8-7b062cf5ab89", "comment": "Malware payload (RedLineStealer)", "value": "337976018eb047ee545f5002c51d4f01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679022263, "uuid": "6baceca8-9c23-4f98-baa8-bf0462a46409", "comment": "Malware payload (RedLineStealer)", "value": "7f5bc567c9bb814ce2c53cc4d5ddfe2c88d54aa482fcb328f02baba07a3991ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679022263, "uuid": "89db61b1-eb00-4b65-bb04-e1c33d3aff60", "comment": "Malware payload (RedLineStealer)", "value": "3662aa9f95888e6b476bca0059112732cd9574e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679022263, "uuid": "7bdb306d-1292-4ca7-a307-703ba04120dd", "comment": "Malware payload (RedLineStealer)", "value": "f81855fd9dd04403b3f8bf5c59501360024b4853cfdea3c510292cdbbffe120d75726b987796c3deec43d8ea561a04bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679022263, "uuid": "2c140101-410d-4ec7-9bdf-be26d26bb209", "value": "T15E45020393E1FC88EA2A8B72DE1EC6F8765EF5518F49376632285E1F4571176C1A3B80", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679022263, "uuid": "f79d90c1-f26f-437f-afb3-ca0cbf2ea732", "value": "02bcb533fc6eab16fabdf3b7ff49a9d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679022263, "uuid": "6a6e8142-2a8b-44b6-9e92-ac72dd133f3f", "value": "24576:l8ohR8bPifxEqc0/cCB4NZxNBF4dkU3eQPXaI95:dRDEZUXB4PdF4RbPXaI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679022263, "uuid": "df1c1c12-e608-4052-add2-717ffad0994e", "value": 1246720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679022263, "uuid": "408575c8-02da-4e1b-b685-cad6bf58d852", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679022263, "uuid": "9b1ddc91-6ea4-4c58-971a-61f1e39fdc98", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "605dd42e-c497-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1679038995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038995, "uuid": "e0c54a53-77fa-4955-8b43-bcd87a176667", "comment": "Malware payload (Heodo)", "value": "eb30d9ac71b87e539a8c28d0b7d797bc", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038995, "uuid": "bc9c517e-0e77-4524-a903-f922546cfd42", "comment": "Malware payload (Heodo)", "value": "7f8c61f902918f1545d12c989963838c1ebe9719918bb586b31872e28026d8d0", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038995, "uuid": "761bfdfd-25d8-4182-8de6-028aec303ab4", "comment": "Malware payload (Heodo)", "value": "472792914840d3cc8e6274eee3a660cc62cfb011", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038995, "uuid": "c11b21f5-e72e-4f2e-b399-0e759b30fbb3", "comment": "Malware payload (Heodo)", "value": "0e13ad61950b743e2683e4ef04d19657c21968a5f3fe0f33291d184cbffccd72af3bd500ae0b939c4f5e996d9db6cc88", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038995, "uuid": "45393468-6011-4b2c-8a32-bad8b0b5fc86", "value": "T1A1C33BF1A8025C0AE123C976B1FB661399D051ED42283B2BF87D507DD978A20D5DD8EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038995, "uuid": "542a9892-ffc4-4b18-86c1-4391766ff29d", "value": "1536:RDBoTVdaeNtuXndCrJJmT4HVnteV4FrdMiYcx7bfCb6HPdnXb:1BoC+tCYvSMVnte8ZP1Y6Jr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679038995, "uuid": "adad0b52-3e3f-4c6d-b946-5b8afb32db64", "value": 120428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679038995, "uuid": "92cb30a5-7bef-441c-a59c-2162e16ed21e", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038995, "uuid": "b348c6ac-28c8-4b62-946e-e33c9e06e63d", "value": "Opast Publishing Group_1.one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b9247ab-c4a3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679044248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044248, "uuid": "3d665b96-8152-4844-b3b4-ef709a0ad9eb", "comment": "Malware payload (Mirai)", "value": "38d6611b8a52cfcebf91ef5956bbda58", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044248, "uuid": "4eacd60f-19d3-4ff8-88d9-2f454fc018e0", "comment": "Malware payload (Mirai)", "value": "8097c1a7ac9d57b4a8d952d4bf0b491279f8e44a392858ec9794f6d5447654d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044248, "uuid": "897bea3a-4382-43ce-8f4a-9fed57199f34", "comment": "Malware payload (Mirai)", "value": "7679e5f7649191cc5c3cb3c98da12ee85f9491d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044248, "uuid": "ed09fe85-6427-4631-b42b-3c8303297be2", "comment": "Malware payload (Mirai)", "value": "f94ee13b1e0a0bcfadf82ef804c0e46d62bf2ec8a02950ad0b8f181d8f4f191a41d11824f8da25efe1351d42ab1aea4e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044248, "uuid": "c3dd6e65-9e94-43f5-8d51-e877f1fd8107", "value": "T1D3A2D019BF18828BC8362A7855D9E6D22253FD61F2DCCC0D2940C15FB1A33A92870E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044248, "uuid": "92401fac-a200-4b82-962f-7999c70310d2", "value": "384:Mg4Lpj8s/qPui8uZxoIA57RWQjJiEVi+ZkNadmTb+502F2vwA9dWuMW21bAK1oTC:M98o08kxofBE+ZkNaITbp2F2TWul0c5e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679044248, "uuid": "d0c96f57-7342-44a6-b349-12005b91fdf6", "value": 21500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679044248, "uuid": "a8aab09e-0bb7-49b7-8b58-37ee0189460d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044248, "uuid": "03b9642d-0877-45ef-b862-3467ad6f7723", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba4b7080-c4e5-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679072647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679072647, "uuid": "c4f70f8c-8455-4559-8d1b-2a373abc0594", "comment": "Malware payload (AgentTesla)", "value": "9d00317b8d93146fa0605f04c796b762", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679072647, "uuid": "6d5fa225-37f3-4f2a-8fe7-36a1d128dd75", "comment": "Malware payload (AgentTesla)", "value": "80eabb4ed2bf442079ed36b1a74aa1afd5627eeea83bc48cf4c9d2a4b719c0a9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679072647, "uuid": "a52fe765-a71d-4c43-bc6f-b111afc7ed9b", "comment": "Malware payload (AgentTesla)", "value": "d5b973cbf83d8226dc69624119cad6cc260b6e99", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679072647, "uuid": "b9dd9c67-dd64-4b6b-bb88-a2993722677e", "comment": "Malware payload (AgentTesla)", "value": "6fbb38f1f0a2e283681d367e0bfcf0518e37da0b8c3423c40db9c4f663660a2bb0cba486d9dc78ce0222e36d515faf7f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679072647, "uuid": "31255b3c-d7ea-4fc7-a4ae-e4321c02ad2a", "value": "T13F05015DB76AEB22C67D9BFEB0B1306053F3940F6235F3995CCE24EA2A62F910501947", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679072647, "uuid": "eeb26851-1d0b-4197-976a-ac41abd39300", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679072647, "uuid": "253922ca-ca0d-40d1-b614-1893ddc3bef1", "value": "24576:JXjkj+rHRS/B1loJPbyxYq2CIebJ3v6EIBMTn:JXjkkHo/B1l2yxYq9xvjzz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679072647, "uuid": "df7b6115-89da-45fd-812d-06e0284c8df6", "value": 864256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679072647, "uuid": "cdfa0087-9f95-43ff-a94f-76e394f0493e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679072647, "uuid": "79bfc1a3-6458-4eaf-ad63-00c2ed8278ad", "value": "PURCHASE ORDER_shrunk.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2b7b6d4-c4e2-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679071453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679071453, "uuid": "1bafc8b3-83bc-47c2-ac4d-9db09613f9fb", "comment": "Malware payload", "value": "9938256510e61b1f2a26e276a139e879", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679071453, "uuid": "5e8ef39f-dc95-4085-b619-6b2c11aff3ed", "comment": "Malware payload", "value": "80fec8091e91f6118bc86d587ee05f6655757788880a237a2330e7de65800ee4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679071453, "uuid": "f0c3aa77-94b7-4478-b1d7-d5a649080f28", "comment": "Malware payload", "value": "37a092af42b298210fcf08bf12d664ca4f67a513", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679071453, "uuid": "47acaa81-962c-493e-a1db-2b5b732c7a6c", "comment": "Malware payload", "value": "ab69fd7962baceb04ddf225fd801f65b0d2289bbedfbe16352c6511187789cc66f5cfc60df8e935d27c53303cdc56598", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679071453, "uuid": "6af74028-7ac9-4816-b591-f8b0c3316677", "value": "T16E85F1CF19EBC461FC573336BDBD4A2AD5B87C62DB24E28BA5C467093463E91E530206", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679071453, "uuid": "2e0326f7-979b-4200-aa8d-6ec35926d1b2", "value": "5044024844498395d0e63ba22bbd9978", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679071453, "uuid": "a99e9c4a-f78b-498f-9c0b-158bd7610111", "value": "49152:LVbvZFNcOr6yTI9pCDrXCuEa8OhJ3iQx9:RbRFNcOr6UI9pCDDhEa8mQQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679071453, "uuid": "28d097c0-0222-4274-926b-a99728ee1bce", "value": 1784920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679071453, "uuid": "0ca35637-f4e1-4672-9988-03a03d074b73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679071453, "uuid": "dfbe2207-51d6-4d86-aa6f-8a96f5cb1de8", "value": "9938256510e61b1f2a26e276a139e879.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67487b26-c4ac-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679048026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679048026, "uuid": "910f65f1-98d8-423b-96ec-2ed6dac7a9ab", "comment": "Malware payload (Mirai)", "value": "80bbe2c5ab2b0bcb435676e805b136ee", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679048026, "uuid": "5b363514-b33e-4f1e-a5d6-b351438f7a19", "comment": "Malware payload (Mirai)", "value": "81786cc93fa428e26dd39ae9dfe5212e1c2978a5de5b115bcdd5097adc934e42", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679048026, "uuid": "93c18a46-5302-444e-bc15-25a7687352a1", "comment": "Malware payload (Mirai)", "value": "c9780ec68789af35a54c8a5816e0de79a866f4e4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679048026, "uuid": "554d431a-e403-44b1-99b4-e7aa76b37e98", "comment": "Malware payload (Mirai)", "value": "153b4f93bebe09c25e3628254caab22be8fa8304cc5e53f6c0f4bf6a923a48d65fd75a182e5fded26a7f3581c8ff0346", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679048026, "uuid": "869956d1-ac62-4fa4-a5cb-7888a49cc103", "value": "T1307386092E219F7CFFAE423847B78F259648339A36E1D585D25CEA011E7074E341FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679048026, "uuid": "e37e0e99-2012-48bd-85fc-6ff37c0a183f", "value": "1536:PCxBpGYuQsvvfIyMvdaGuT+tp32xIogGrYzgp1J7:kLduhMMGuYkxIogGrYsLF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679048026, "uuid": "9075bc30-c875-4d29-9419-eef8b2e0f07f", "value": 75836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679048026, "uuid": "95292b68-8175-4dc4-a564-a98a0081f51d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679048026, "uuid": "819e645a-1c28-4c39-abca-9e5fdb9c64fb", "value": "80bbe2c5ab2b0bcb435676e805b136ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8d43060-c4d9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stop)", "timestamp": 1679067463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679067463, "uuid": "a2e3e7fa-27d1-4a43-9d1f-df366740cd16", "comment": "Malware payload (Stop)", "value": "b3d842e721a4a45ad5005f26877aa426", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679067463, "uuid": "82f2f6dd-e677-4df2-a7e7-bd6260205f69", "comment": "Malware payload (Stop)", "value": "827f4988d10bcb9c88f371bace942c95e0b82166ab62520f089ba534f8252999", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679067463, "uuid": "768f7f5e-f799-4258-abbe-84b8a260ff0a", "comment": "Malware payload (Stop)", "value": "fe49ca6762cada0e1a932075c4b2ef75e2d8c0e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679067463, "uuid": "1e6923b3-86be-4f58-a093-0475b72b522c", "comment": "Malware payload (Stop)", "value": "620ade4b62392eb3708d225d2ed8bcdacfd39303654584b38f2a159343f4003fd3a010343177ead773424f67064e6279", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679067463, "uuid": "e4b14332-f539-4b21-80bf-39d7db651e8e", "value": "T16E05D04392E07C9CF9168F729F1FC2E4771EB5518E997B693218AA1F04B6272C163F90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679067463, "uuid": "bb4f6eea-97bc-49e2-bf4f-0d9c8372340c", "value": "6e76b494f1a9946f83b6b72033f310be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679067463, "uuid": "ab87a6e4-96b9-4af9-b7b8-ec206f60da7f", "value": "24576:xJqUt8sf9w9WDVz7ZZeg3TRlH1MtaXaaJtRT:xJqUCyQWDVz9V3lZ13XaEtR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679067463, "uuid": "daa9a424-523e-42c0-850f-21a017643262", "value": 814080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679067463, "uuid": "ec3c9517-efe3-4de3-b08a-4f005440de78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679067463, "uuid": "c8de2640-39d1-4b88-9ed0-3f0815620f44", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "533afabe-c4a9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679046704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679046704, "uuid": "1f8d9896-907a-4643-8a5f-c5ba8ad2b63d", "comment": "Malware payload (Mirai)", "value": "f938a80e37cfadf9790ee90cff15820d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679046704, "uuid": "d42f9997-0bf9-4ca2-8bd6-08daf7c88ba1", "comment": "Malware payload (Mirai)", "value": "82eb47bf2ee21e1b8f608462fd553304a3258007aa2e4889410d063cf199ff47", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679046704, "uuid": "99025634-c8b9-4ade-b616-e5b41e92e272", "comment": "Malware payload (Mirai)", "value": "044f429c979091bcd523d876b162e310ed0a5ed0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679046704, "uuid": "2204e8ff-0cb2-4940-9c67-ebf5ecdb8e33", "comment": "Malware payload (Mirai)", "value": "8a81b55480e6c8ede8ab9e98cc1f5001baa61bb37140ccf462e673d7bd49e93d8256fc6605eed2cd60bc35daa5f97191", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679046704, "uuid": "0121bd5d-b679-4487-bb33-f266a63dc812", "value": "T19503F751BC829A77C2E1137ABA6E5A8D332163E9C2CF7217DD214B207AD511F0D23F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679046704, "uuid": "2208ecd6-72fe-429d-87bc-3a398e27eb3e", "value": "768:MglA4CbIsG5f0OhnlUl0O9FRA1wArb9/3W5uv+bdLdUZXoTN/NbwW:MyabXG5fDlUlXjwVe4v+wZ2qW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679046704, "uuid": "81012943-3e91-4bc0-98f3-3978b12b72e4", "value": 40744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679046704, "uuid": "98246898-1a61-495e-bb2c-85cf428fdcd9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679046704, "uuid": "e4487461-5a4f-4330-be1a-3acf10d68f1d", "value": "f938a80e37cfadf9790ee90cff15820d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e2e302a-c4d9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1679067392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679067392, "uuid": "f476154e-4ebc-46e6-b99e-a0078e00b962", "comment": "Malware payload (Rhadamanthys)", "value": "c9278696675d3ea851b08bf258e6d323", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679067392, "uuid": "900dc0c5-cb0a-4a0d-9071-7a0b23a931fe", "comment": "Malware payload (Rhadamanthys)", "value": "82fe62a041eead15f00cc550b88d5e7bea2e8c1b218a931350a97687cc91225e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679067392, "uuid": "d7ad24d2-3202-4b75-80d6-2cd0fcbb303e", "comment": "Malware payload (Rhadamanthys)", "value": "c6d99445feb44156696b6ea852b42271eaa0c2ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679067392, "uuid": "1ed002d7-a279-4eb2-ad27-216eabebc148", "comment": "Malware payload (Rhadamanthys)", "value": "9428e7cc27817d707253f4ae724f66bcc57bceef1429f7f4803bf92cbdaf04cdc68cfc6dc005d742ea5933e658dc9428", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679067392, "uuid": "bd0720af-2ba5-41b3-bd98-8f83a8e4d95e", "value": "T117745C0392A17C49F9264B729E1FD2E8771EF6D28E89776532189E1F04F2172D263F90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679067392, "uuid": "d132fab9-f83b-4b73-8909-a3528a10aaa4", "value": "6e76b494f1a9946f83b6b72033f310be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679067392, "uuid": "1d6fc305-7041-48a1-8468-7367f535824a", "value": "6144:pbJ7LoRRC9a4LruQyjhqdIG8j/sGqYJz+LCRBfx21QcVxn3tu:ZJ7kR+a4vMH/SuEJVDu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679067392, "uuid": "4990b537-3975-4696-8390-21d925d13e25", "value": 367616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679067392, "uuid": "4bec6c86-58bf-4a14-88cb-507b6e9a2107", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679067392, "uuid": "610193ba-cfe3-41c1-8a1f-49abd6f5d52e", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc9d3c7c-c4d4-11ed-88f6-42010a9c006e", "comment": "Malware payload (LaplasClipper)", "timestamp": 1679065349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679065349, "uuid": "5087fbfc-30a8-499a-bd32-56ef722d4991", "comment": "Malware payload (LaplasClipper)", "value": "27c3e0708804985d4f0758f873509805", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679065349, "uuid": "ee62e4c3-feb8-40de-a852-b249d15a4729", "comment": "Malware payload (LaplasClipper)", "value": "83224bbf17e2eaad3e40aa076696d35daef0a126d7c7c8125920ff457b4de93d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679065349, "uuid": "9873aeb4-ec22-414a-a54a-5d84c68937b2", "comment": "Malware payload (LaplasClipper)", "value": "926ae820a61da9a6241ea94299edfcac963bcf78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679065349, "uuid": "74a7b1de-284a-4c77-90ec-a097c05f561c", "comment": "Malware payload (LaplasClipper)", "value": "82e319248fa378c890453ec87e386dd5509487894b4667493720dc3642d44e060c682589a5200d52c72e3e751d9a7c6b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679065349, "uuid": "4a7c2e55-d4da-40fd-bc17-5b9690b7e3da", "value": "T11F95121386E13D90EA1A8B73EE2FC6E4760DF5608F4977BA1229DE6F04B0176D163712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679065349, "uuid": "9ad650fb-4e57-4e1a-9500-812f5c4e3d3b", "value": "800c211657980cdb5c72386d0a0450fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679065349, "uuid": "bc3d0dce-f2bf-4140-ab17-7313f573800f", "value": "49152:RQ7IJR3VJ9Ln5CI3o4U9ekXJkGB0qj5Bl+w:RZJR3VJ9VCAce45BD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679065349, "uuid": "2129c966-3ef2-4228-88ac-50223880c510", "value": 1961984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679065349, "uuid": "3da4773b-5b86-4c16-b0f5-f0854c3004ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679065349, "uuid": "522521c8-4c54-4977-a176-1a072c219ddc", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f293c38-c4d2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stealc)", "timestamp": 1679064199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679064199, "uuid": "b1207693-e178-4764-84b0-bb3c2957512b", "comment": "Malware payload (Stealc)", "value": "2852c0eb15c4d3a76ccd8dd1a4a57913", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679064199, "uuid": "245cb473-4dbf-4dee-bfb9-2156411a7ee7", "comment": "Malware payload (Stealc)", "value": "8384eb97c0fd7d916cdb454b2212794a8eafa37fe6c7165644d02e8d9bfe5237", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679064199, "uuid": "bedf619e-8e10-430a-91fb-3603a8a7b099", "comment": "Malware payload (Stealc)", "value": "a4716be68d566242a2db02ab81a0ab5d36ce4c78", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679064199, "uuid": "d92014ae-9959-42c6-9065-51efc4d6a7d7", "comment": "Malware payload (Stealc)", "value": "2680f81447123d57e2740e5e17f6f2d996e1a4b2c6ff0e9714db080d42473d39cbacf262a5fc98afcf7c1035e54f1728", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679064199, "uuid": "89573630-f87a-4c40-ab0f-5f1849cddea2", "value": "T1B554298396E17D40EA268B73AF1FC6E8761DB6608F4A77B5A218DE1F04B4173C163712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679064199, "uuid": "4312a055-c046-41f8-8bac-3cf0332e828f", "value": "48e7bdebf7b90ec755513d967cfa38a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679064199, "uuid": "d44d6456-8396-4fad-ae3c-3ed6a3757115", "value": "3072:IfwRwuLVYWcNymdtYUPW3kiW3GEYJf3ahRnb+k6n6miI3KkdMX:bwuLVZcNdUHoYZqhRqYJkdMX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679064199, "uuid": "cea81054-4e79-49cd-8498-e80aa737b5af", "value": 302080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679064199, "uuid": "85177dc4-97aa-410c-8547-4456e53a833c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679064199, "uuid": "03bed8c9-3056-4f24-9eab-afbd4a1e421c", "value": "2852c0eb15c4d3a76ccd8dd1a4a57913", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1133fda0-c4c2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679057330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679057330, "uuid": "81c6d58c-9d98-45d3-bfae-a9a2efebc15b", "comment": "Malware payload (Mirai)", "value": "9ce3cedc4922b0894529d49caceb5401", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679057330, "uuid": "62fd4734-7563-4f2b-9e7e-d082e9c43407", "comment": "Malware payload (Mirai)", "value": "847ebd6a624881bb75702b1ef07968a203c8250fbaaab5004b4ce035e4dff9b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679057330, "uuid": "c4798f2c-70a8-4432-b692-5706cee40966", "comment": "Malware payload (Mirai)", "value": "b4c93ca4064bb0aff367db6970c2df8f59e4ec3a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679057330, "uuid": "e9ff3366-4bb5-4a51-a577-a3ae15d94ef3", "comment": "Malware payload (Mirai)", "value": "e7e1e59417cae72a2835d821d958bad60b80b4cc24c039b3e22c5942edab7d70fe5fc6603316914355bc5408cdc8e292", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679057330, "uuid": "1f32761a-030e-47ab-98ce-f470a4789324", "value": "T119B2DF99270210D6C4A282BE97C907503F5A42B76982ED4CFA08FA47EE975F125C7F83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679057330, "uuid": "0d69c767-d197-422f-bc70-ec94584ae91e", "value": "384:p3WEBXfrIOPMQXWFgjmIzbEx81mVFkXXXYR+Fdh7hD1sZr/OEMcZJgGlzDpH7uNh:Rx88MD6jXoxcmVFknoEdRhDgrMKJgGlG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679057330, "uuid": "72510557-0809-4c2b-83ad-b6e8c2c4f199", "value": 23776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679057330, "uuid": "6f6150d5-4fa3-40d9-b46a-fac3e611262d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679057330, "uuid": "61744cce-1dc9-4141-88ea-88d0a03f480e", "value": "SecuriteInfo.com.Linux.Mirai.3982.8986.20434", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0eaa2e9-c4c7-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1679059826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679059826, "uuid": "7db1b9fa-2dc8-4b17-9d68-b94dbd6e0350", "comment": "Malware payload (SnakeKeylogger)", "value": "f6016fe7dcc0d49cc0fc10f18736fa5c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679059826, "uuid": "edbd7612-dd75-4537-8974-c5238981ee83", "comment": "Malware payload (SnakeKeylogger)", "value": "84a7b931079a581a4e3334a3be74e9c16876b1f00c51270f7eee81df6738340a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679059826, "uuid": "dff926fb-3457-4049-a011-865cb8b0842e", "comment": "Malware payload (SnakeKeylogger)", "value": "3c3a20e4ed9b7fee6eecbf4d38366c4c2602df2b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679059826, "uuid": "c9b50a1e-a83c-4a17-9bdc-8bb4561ee526", "comment": "Malware payload (SnakeKeylogger)", "value": "833de83ae6ec71b5a9fc5c39f75b339cb1c241f1de1e42066687c22f7cd3331ab7b75cc21b8f21aa1b56d71739b59688", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679059826, "uuid": "8786bdc0-e8a5-49da-b25b-7d381f539240", "value": "T118050148B725EB22CB7E9BFEB471206193F3890E5225D38C5CCF64EA2A63F954501D4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679059826, "uuid": "dd712e48-2abd-4b9f-ac31-3b07fca39f88", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679059826, "uuid": "0600bc5b-ca4b-49f6-95ab-acb410807df9", "value": "12288:qzCnhNpjkjXyuaqrw4WuzwgMGpn9RgPp9IPLk+vq8f16x2pllOAt0YjAqEMM:3fjkj+UfWuzNpgPzIo4XtLOAnEMM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679059826, "uuid": "e7302dd0-a0d0-4986-9558-72f8999d6973", "value": 823296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679059826, "uuid": "8348fd4b-a945-4e23-9cb6-96c655c6ae7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679059826, "uuid": "c3fcc4f1-c009-4805-a3c8-9a6c61460da3", "value": "Vessel Particulars.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1eeccd7-c4a3-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1679044366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044366, "uuid": "673c7365-d841-4cd0-a7fa-1e56659e24f7", "comment": "Malware payload (GCleaner)", "value": "f647eb51d409c5525721d38e61831544", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044366, "uuid": "31d24fab-947b-466c-bde1-6ccbeb764e75", "comment": "Malware payload (GCleaner)", "value": "84cc827150e0aeb82f1e7b4abd98332c49b45be6ac8f4df9fbd516633c452d0f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044366, "uuid": "d7b3f536-d918-44ec-85bf-16261d909bdb", "comment": "Malware payload (GCleaner)", "value": "e100331dec22bbc0b630cd4c48513ef48bee566c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044366, "uuid": "4460e86f-dcd2-4fba-8e1a-dfe1678ff625", "comment": "Malware payload (GCleaner)", "value": "46124df87f4d96374aa5cf32d01970f47fecf8082530e90d3b962c64717cfb72642d9f695de7a9a7289f83c2d9488279", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044366, "uuid": "ff19c268-0512-414f-a8ab-19330f5a3e56", "value": "T177C53376BBC2853FD9678A312E7DC624870F2B554CA8107EB67C9A5F0F164A2CC18727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044366, "uuid": "a45c72ff-7098-4b9e-b259-5963a3ba5487", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044366, "uuid": "a1b0051c-d9cd-4417-b6c7-2f4ed2e6b0ec", "value": "49152:EGlJfsQ1jp4ESZzT6kHTpFLLHBJhf+oOv3xxD0ux3V/ggflraoQ96Fw5dlLYp:5/F4EIOgtFP0rvxx5J7BQcyPYp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679044366, "uuid": "031b6321-d1f5-4b2f-9b63-b42bf138c5c7", "value": 2544784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679044366, "uuid": "c8d9e019-9e1d-4cb8-bab4-2df74afd95f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044366, "uuid": "78ecbe06-6c64-42ab-b24d-e9adbe58657d", "value": "f647eb51d409c5525721d38e61831544.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39987783-c4f6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679079732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079732, "uuid": "99281adc-2ca8-4058-87b6-203b47dc7abf", "comment": "Malware payload (Smoke Loader)", "value": "40ae16d9f72b0d03b3d8bf251e623a85", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079732, "uuid": "1c201ae5-f41f-439f-861a-4f46a99e58bc", "comment": "Malware payload (Smoke Loader)", "value": "84f201911eea13e0a46afa437f7a5942a1d70afab17edcb4fe65680d1599f602", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079732, "uuid": "c5aeea37-8df4-4bc4-b938-a483821ff5aa", "comment": "Malware payload (Smoke Loader)", "value": "45e26f7fe44dc651c6a3e0f9f685891514d05912", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079732, "uuid": "8fdf1cbd-277e-4ded-93e8-31cb62e63100", "comment": "Malware payload (Smoke Loader)", "value": "59478ea8d3902545efe1d47cf18451c314c5abc14e5b933ce64d74976ed74e9cbf7c993ce1566224cf4b97553d874973", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079732, "uuid": "2a41cdf9-ad5b-4c66-a4aa-2e2646d1a801", "value": "T181542A4393E17C48E9368B72AE1FC6E8771DF6518F897B6532189A2F04F2172C563E90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079732, "uuid": "d2a809a6-0b79-4148-b2b1-1b9866e65bd6", "value": "6e76b494f1a9946f83b6b72033f310be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079732, "uuid": "21612776-2718-4afa-b21e-cc8f0c4a9926", "value": "3072:aUhO7wlL4qWSEFfweFrAV/PAVNY46k2htR4ZoKXPI4yDftPqgDuM:bawlL4zSS4QrAVwVNL2mZ5XGFNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679079732, "uuid": "f77b3788-ecd7-4c96-a09d-5166a1774a91", "value": 303104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679079732, "uuid": "2156fc94-3441-418a-a839-ed2d954b6cef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079732, "uuid": "10d4a4f4-48ce-496d-af7d-8c3ce89719d1", "value": "40ae16d9f72b0d03b3d8bf251e623a85.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bfac6ab-c4eb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stealc)", "timestamp": 1679075119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679075119, "uuid": "95fcf789-e7db-4dea-b380-645c54ec5f67", "comment": "Malware payload (Stealc)", "value": "82243d995e493b56fbe6900ef80c18f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679075119, "uuid": "e2102441-5040-4148-886f-72ade82f80eb", "comment": "Malware payload (Stealc)", "value": "8566c357f42e4e6f442564c63c376540b4e4d0ee72d38f83a3de84a83931a6ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679075119, "uuid": "22159658-53d0-474c-b927-178018e1549e", "comment": "Malware payload (Stealc)", "value": "63b3e6088a4a3bd070c02e46b9fa8116763dd100", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679075119, "uuid": "86429fc5-7d91-4608-a533-884555535462", "comment": "Malware payload (Stealc)", "value": "e3b2b17bf0eec5b15d336abf66fe6511767805230bad88a3a310569d6014e30e4b1f62505c14118f2979447b10ee44f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679075119, "uuid": "e5cfb5d2-244a-45ee-aaf2-83bc915428e3", "value": "T16E54284392E17C48E9268B729F1FC6E8771DF6518F897B6632189A1F04F2572C263F90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679075119, "uuid": "828a50e7-5a14-43a9-acf0-77d0c0b9f88f", "value": "6e76b494f1a9946f83b6b72033f310be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679075119, "uuid": "69998fdf-71a1-4c72-8430-9ad4a3101074", "value": "3072:10YqLgVLSMGLNwY4TQUmpEmu/0wO+I4yvitjJeKRuM:mLgVLSNLqNsUm+M1X4Jegu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679075119, "uuid": "f8bfa3d6-5135-467a-ab4f-6a07f3111f9b", "value": 303616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679075119, "uuid": "15809ab2-4c7e-44a6-b61a-ab310ca536e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679075119, "uuid": "50e60a07-cfc1-4366-a537-df52df0fe79e", "value": "82243d995e493b56fbe6900ef80c18f7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abd3dad2-c4aa-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679047282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679047282, "uuid": "147e66fd-199f-4995-9c48-b01747ffdf71", "comment": "Malware payload (Mirai)", "value": "572f023680cd69174a08dca025e4c366", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679047282, "uuid": "1c3717c7-287e-43cc-a2a9-7b0d79cfc18c", "comment": "Malware payload (Mirai)", "value": "858146150b6ded1304cf71a7e874da5540327a8f41bf8a273d092fedba6401c7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679047282, "uuid": "dae523fe-a761-4842-bfec-dd3e1c8f3843", "comment": "Malware payload (Mirai)", "value": "aca2d690680d439fee25321a09657dae727e1c87", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679047282, "uuid": "d9d31453-06a0-4c6d-874f-45373d1cdd66", "comment": "Malware payload (Mirai)", "value": "256a749e87e108c80a95e1cd853547f3da10754f1170d55d13c03e69d68a16bfd37e5b3e8cb52770d698de2aad549cf7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679047282, "uuid": "c428d47f-4982-4e17-9711-39504c1fb167", "value": "T1F3B2D1A48B915601C6B0B435A7BCCF936B3705A0D6F638272A2092FCD98149733FDAC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679047282, "uuid": "739d18b3-a8d7-4f6e-8bdb-11207a315ed5", "value": "384:4GHKXlJIDFUS0Mggks3aIrokYVDoDDRRKj55N7LB9U+Bv/DhymdGUop5hu7t:4GHKQFH0rs3zWoDDRsjt7LB9U+BTs3UJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679047282, "uuid": "687eca2a-6038-4641-b1b6-75adf14adabf", "value": 24536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679047282, "uuid": "3ac5c799-e649-4eaf-aa21-f853cd64e092", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679047282, "uuid": "988dacf2-0768-4a98-9801-823822cef0e4", "value": "572f023680cd69174a08dca025e4c366", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e080f9f-c46f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1679021677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679021677, "uuid": "cdd1c017-c9b9-4d17-8271-4649ce146c0b", "comment": "Malware payload (Amadey)", "value": "347023ce2dcece5caba8bbac55d75797", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679021677, "uuid": "fb17e23c-f800-458b-8dc3-90656f644730", "comment": "Malware payload (Amadey)", "value": "85e7a7f1c32e5d4d270c59b9dd23175e06a3fa8a001c3e56704f511a859c032e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679021677, "uuid": "11b2d9f3-87a5-4e9c-b65a-f49667219c54", "comment": "Malware payload (Amadey)", "value": "042348f36b9492e17c2bfa4f3d48666066e42d2d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679021677, "uuid": "ab67934a-5d37-4fa9-8c0b-15ffb5ea82a5", "comment": "Malware payload (Amadey)", "value": "f93c7c030903378b85560850a245e1adab3231e853f97830b5a7738e063685bc6dcf93d2cfb3e9ce29ec3529b725252e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679021677, "uuid": "be858766-e5d8-477f-bd53-e6bd8b2473b9", "value": "T17345020393E1FC88EA2A8B72DE1EC6F8765EF5518F49376632285E1F4571176C1A3B80", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679021677, "uuid": "14f2bb85-59eb-4e29-9e41-95b0580a2e5a", "value": "02bcb533fc6eab16fabdf3b7ff49a9d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679021677, "uuid": "a5ecaa7f-09e7-421d-8d87-d9f814e2163a", "value": "24576:R8ohR8bPifxEqc0/cCB4NZxNBF4dkU3eQPXaI95:hRDEZUXB4PdF4RbPXaI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679021677, "uuid": "d4445727-b8a4-4f68-a53d-f2227915f37b", "value": 1246720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679021677, "uuid": "7386d0d3-4929-4b2f-9123-ac834277fb50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679021677, "uuid": "afa93a7e-8bb1-442b-a4bb-1ad7281fd3c1", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8bfbcc7-c4a4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Nitol)", "timestamp": 1679044807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044807, "uuid": "ddd704a6-d72f-46a7-8b14-c3cf9f75d806", "comment": "Malware payload (Nitol)", "value": "ef4a2bb28bee4196a1996de11a3bbf8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044807, "uuid": "c2c1e1e6-a783-449d-a312-b5e35fa5fab6", "comment": "Malware payload (Nitol)", "value": "870a43d88877a0a3e894c444742e29db08aa9c3ee11b8f355eda9c195cd00a4b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044807, "uuid": "2605ad56-03f4-4547-a657-bd895690c50d", "comment": "Malware payload (Nitol)", "value": "1a99d51ffa9419bf83c3a23b9d7332f4a598d53a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044807, "uuid": "94b180e5-6fcb-4ea9-8683-70680cd404b9", "comment": "Malware payload (Nitol)", "value": "4af61e8c78dd246e4eb1c24efa77ff77c45b55b0d12f04028e143c66f4de850570118a6ad8dfb58f16be08f39780d51d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044807, "uuid": "2662bb8d-a657-435c-8294-861271888af3", "value": "T1B44523912E594871D6C34F708DE9D706FE32E88100986F9BE141A27FEC76BD2789462F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044807, "uuid": "453adf54-7a26-4b1f-8a47-67464674a908", "value": "520e49367515fc0f38f619960f084b81", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044807, "uuid": "03f11005-3c32-4a61-afd4-abae9dc05b38", "value": "12288:5zU3p48uWBJuktdYlf+TaSW9gzpCIAhgxqfcm/qEwU6nYYl7SRBd0OzW5lho:5zJMjJFaSWOzpNnPuBd0oW5n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679044807, "uuid": "b36e4bb7-e430-48e2-bd45-b1f3603518c5", "value": 1212416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679044807, "uuid": "56a2a374-b8fa-4565-92c4-ee78c0f03575", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044807, "uuid": "deeee4d3-6357-4ec8-8e74-e8ff0be4e054", "value": "ef4a2bb28bee4196a1996de11a3bbf8b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe1969ac-c4a5-11ed-88f6-42010a9c006e", "comment": "Malware payload (ArechClient2)", "timestamp": 1679045273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045273, "uuid": "f2233284-0a8f-4b8c-b698-726f819753b4", "comment": "Malware payload (ArechClient2)", "value": "04694e5e78d0a3dcab0bfea22aa90cfe", "object_relation": "md5", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045273, "uuid": "74d63961-4793-4578-a5fa-0ba67ee44c0b", "comment": "Malware payload (ArechClient2)", "value": "88262a78ce91985653afffc74d9938050e56113840efbc67ee98eb9483fe1f22", "object_relation": "sha256", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045273, "uuid": "b2f9fdde-4f7c-4c4b-afa8-6af4276a3053", "comment": "Malware payload (ArechClient2)", "value": "bbc04877ba04814fa13800b42f6e8ea550967e2b", "object_relation": "sha1", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045273, "uuid": "4480f930-43ab-46e7-8338-b1e800d96ec1", "comment": "Malware payload (ArechClient2)", "value": "81d10e3b5a179a27a42af9dceb7c730b69020aa97d04d42cefe59ce4839cb4bf321e7612cc9982f2c969b486fd9c272d", "object_relation": "sha3-384", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045273, "uuid": "6c352787-c6f5-4ee8-ae1f-3b89716c160c", "value": "T1B6C42359EB07B6B8ED07AEBD913ED615B51C68E221A24C112357B803CDC7BE8DD3B412", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045273, "uuid": "2d07b601-23af-4dd8-bb87-03e6a614400b", "value": "217175ecb4b918909da918aebf70d95a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045273, "uuid": "a7470683-b789-46d6-96c3-750591ffbe39", "value": "12288:UdXvDWopdu11GNJGUOXOoDscvVqILhtgpiEg/ojnSFRsQOoS9cwMd:gv6oLM2GvXOoHdqIdsg/ojn4sQ9S9c1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679045273, "uuid": "65e90fb9-39de-4991-9711-167435db8747", "value": 552448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679045273, "uuid": "06f430fc-bd33-40ee-ad04-29a6dcc8f1b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045273, "uuid": "c5259590-12b9-4e6b-ac9d-a0a4113ec921", "value": "04694e5e78d0a3dcab0bfea22aa90cfe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5483f83-c4aa-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679047405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679047405, "uuid": "eab0863a-0c4d-4a08-8305-48ec65cae048", "comment": "Malware payload (Mirai)", "value": "abb71e65367ea2f53dd54adffb73fa2a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679047405, "uuid": "3e754df1-e8dd-4fa1-be4f-135f9a436d63", "comment": "Malware payload (Mirai)", "value": "882a4c4b4dbe6066c3fd792ff13cb323492c522adb4f1980b74f9fabf3aded03", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679047405, "uuid": "3838320b-389c-4373-b734-922fcaae74b6", "comment": "Malware payload (Mirai)", "value": "85358418c5e75cb6a5f7167f2ec624f47b841170", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679047405, "uuid": "6210efb9-9b9d-4788-a6a6-e0d299029af5", "comment": "Malware payload (Mirai)", "value": "93f6e8192d0f123a49915ff44e6c8f40fe9e814fb21ac71099f3166e6db38179a5edfcd3b73643ec1d75a59f2385d75a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679047405, "uuid": "964a64ec-f2e6-40ef-8893-8afb7463ab63", "value": "T17CB3F872B804DF66F00A96B504D38B367E30BFA70E6316A2731B39669D331D528A7F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679047405, "uuid": "26cf04bf-9b42-4b42-9f71-3f9d60570137", "value": "3072:Ydg8GXIDvGIk1MG8+mjypvZ5oamm/QcuLB1niDNb:YuFX0GIk1MHyphuamm/QcuLB1niDNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679047405, "uuid": "8d0f8687-4f84-4267-88b4-4d19bda5f161", "value": 118090, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679047405, "uuid": "fa8cb139-d374-4c99-af98-f433f5a8d023", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679047405, "uuid": "399c5b61-752a-4946-9770-da577c28838f", "value": "abb71e65367ea2f53dd54adffb73fa2a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2629e27-c4aa-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679047293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679047293, "uuid": "97e9a09d-9926-4985-9d18-41bc70370fbb", "comment": "Malware payload (Mirai)", "value": "aa4b8b1fec9520e0386af2f3608ac37b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679047293, "uuid": "bedd27d0-b043-4804-9e70-980a96635f55", "comment": "Malware payload (Mirai)", "value": "885d3ac59f465f54cffcfca182caaf19dff0e8da0bf37cc31f1330e1edadbb9e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679047293, "uuid": "732b7af1-e421-4973-a82c-176e723fac8b", "comment": "Malware payload (Mirai)", "value": "6d193a051e98ac0bd11b48ed6b09c82d9d9558a3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679047293, "uuid": "0512dae2-ddbc-4c32-8a53-d7ed9251945b", "comment": "Malware payload (Mirai)", "value": "7c3344055de8b8bffbdfb71f2a32e183d26719c11da5c415e3d688fc905e2d20a71ecfa1f20b6d05d60b13df10292dfc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679047293, "uuid": "4ad80a2a-13bf-4224-a008-40f8d89f794e", "value": "T1E9433CD5F801AD3DF957EAFE44624A0DBA21721150A30B2BA36BFDC37C332A44E16D91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679047293, "uuid": "0a0b0417-b551-42e3-808f-23d1ce502411", "value": "1536:bFyTOn7IOlZFi2x+qEbYbKup7X6Y3fG8ce:bFwt2xJEM/gYPt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679047293, "uuid": "125dc434-e306-45b1-879c-633e0318c4e0", "value": 57244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679047293, "uuid": "0c65e2c4-df37-4a5e-894b-3aa76fa8f704", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679047293, "uuid": "aa65e261-29fb-418b-bbaa-9e104477d2e9", "value": "aa4b8b1fec9520e0386af2f3608ac37b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34baeed0-c4ba-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679053954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679053954, "uuid": "b5c87fec-2b1d-4ef9-bfec-b87accb5fdfc", "comment": "Malware payload", "value": "d37a18611366e95e34ffa8a490a71e13", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "firewall-gateway-net", "colour": "#3FF98C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679053954, "uuid": "02f027c8-632d-40bd-9dcb-2686b2773607", "comment": "Malware payload", "value": "88622c371e5afbc869820b076cebbfaafe2eecfff95b0c09eb9ea4e84536fb31", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "firewall-gateway-net", "colour": "#3FF98C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679053954, "uuid": "67a0b062-5a20-4a40-b617-64dda3b3330c", "comment": "Malware payload", "value": "4d71e55791a349b44969fe77303b1f23e81619a4", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "firewall-gateway-net", "colour": "#3FF98C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679053954, "uuid": "d80ace4a-fa8e-434c-a77e-d348df52cc92", "comment": "Malware payload", "value": "f9c04fe0bb1c9d9f275e1e70b9864f12e0193f853232cbb9693ba1135ad13b65f88bb5ea121c4523647f119f7af8072c", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "firewall-gateway-net", "colour": "#3FF98C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679053954, "uuid": "0e97fcd3-35ab-44d0-ab5b-cb6e81ae67e7", "value": "T111E2C0B09D06EE29F51500B8C0AAA2491639BF823D214387F170BF5F9475C9EADD3D3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679053954, "uuid": "be545f11-70d4-4254-b457-e628fa24567d", "value": "384:nJZ8A1oOWB5EY2dWlnZaKAp5pxCgYl1BX71w1t26x4o/wjVVEZHwN:/b1oOWIYSWlZaxmgYZ71w1t2XjVVEZQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679053954, "uuid": "ebaf516a-129a-4e4a-a63a-819d27de6478", "value": 33789, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679053954, "uuid": "03fd957b-e55b-4a42-9cf0-256139c36f6e", "value": "application/CDFV2", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679053954, "uuid": "c220e51a-57e4-4839-9f6e-a1216477a62b", "value": "Circular BSP.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3638633-c4d3-11ed-88f6-42010a9c006e", "comment": "Malware payload (TeamBot)", "timestamp": 1679064985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679064985, "uuid": "7c334e65-ca8b-4a13-bac6-d47c253248c6", "comment": "Malware payload (TeamBot)", "value": "69b604ec10f24c79c773087fdd85eab8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679064985, "uuid": "c786b488-c647-474c-b955-8cf6db90996e", "comment": "Malware payload (TeamBot)", "value": "88be2c0984241081398bee0721107629001e29bd0c0982b6501a119daadbaf7e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679064985, "uuid": "52b417d0-4a71-46c5-90f3-27982d24077f", "comment": "Malware payload (TeamBot)", "value": "4166c0d0b383c3c454afb0062bd5b28852bbc1b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679064985, "uuid": "43465c1b-ee52-4bb9-911f-b43f69df878b", "comment": "Malware payload (TeamBot)", "value": "4439b3121c99e59208dea4ae004afbedb984e4b3b5fdb9d3691649cdb7e1ec1a79e9a52fb58a33f2f432c517c0bae783", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679064985, "uuid": "161d71d2-a802-4a05-910f-2fde1d8d33de", "value": "T13554184396E17D40EA268B73BE1FC6E8761DB6618F4977B62218DE2F04B11B3C163712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679064985, "uuid": "8cfbc191-1946-4ffc-91a3-c97cead523c2", "value": "48e7bdebf7b90ec755513d967cfa38a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679064985, "uuid": "daecbad8-4f15-4caf-aa50-3f2870c61df8", "value": "3072:EjDRwBLK8WcO86we9c4FgD6jebu80Ca78xt6n6yiI3XcM:SwBLKtcbj+jiu80JYlUcM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679064985, "uuid": "07866b80-0b0e-448a-b767-72e0ac1fcf7a", "value": 302080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679064985, "uuid": "6bfc292e-a8e0-473a-87cb-0e9e05216238", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679064985, "uuid": "b88c43bb-feab-49f2-bdfd-ed8d41343201", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "620a91c5-c497-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1679038998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038998, "uuid": "507278a6-1593-49f4-9ca5-d794e5efa017", "comment": "Malware payload (Formbook)", "value": "60b0bd80192dd07efcea1830f647f941", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038998, "uuid": "d146639f-268b-4ae0-b19a-122772efeea0", "comment": "Malware payload (Formbook)", "value": "893125e6dc9b73db521e856b9a94bc575982b36d494033002d80eef215510b53", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038998, "uuid": "af95b3e4-e6cb-451f-9064-ea2589dca081", "comment": "Malware payload (Formbook)", "value": "ebd7c6f2833b63340621ae2f5c510419302453d9", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038998, "uuid": "c78b4920-dcdc-4bab-a572-01333e67ef4b", "comment": "Malware payload (Formbook)", "value": "3b1144707d3012bb52eb76a5ebbd775a973e1c1ed217780e8c13c48a7feaa569795f9c9cf0a8f373561ea6a263f7e179", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038998, "uuid": "cc8b1264-d747-4ba7-873d-0db72ba2fd65", "value": "T1C9F43361F05045F8B7119F76A82B3C5B5AD7FD00AAB145D9D1B80AFCCE6B6822AD330C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038998, "uuid": "04c23b11-feb6-422a-9cfc-1a85d04bf427", "value": "12288:005IsretL4RniQ31L4ZKdnmuxxTBkuQTHSNBG0XKa9DtePlvibt5KJW:005ITxqniQlL4ZKdnxxd2uYHSNBG0XJ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679038998, "uuid": "06ea5cf1-4897-4b30-be97-2a08d99553d6", "value": 740125, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679038998, "uuid": "a79ee856-0df3-446b-8fda-d6f7973c8a3c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038998, "uuid": "e7df9c02-d9a5-4f4c-bf03-2b27c1fbe7f5", "value": "Orden de compra.pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cd46489-c497-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1679038989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038989, "uuid": "9d168f4c-129f-4905-bf0d-2ae1d52b4298", "comment": "Malware payload (Heodo)", "value": "3e9e4353c8d89dcb56d6af59b25d688d", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038989, "uuid": "21a68d93-bb50-4cd1-9c9e-d829843cd197", "comment": "Malware payload (Heodo)", "value": "896edeafdc6079f49b156289a80725d6657082ef397e2e74546eb521f7f4a80c", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038989, "uuid": "87954e3a-7cb8-4f3c-9d34-bd61979597c9", "comment": "Malware payload (Heodo)", "value": "ef5c1dea9ddc7a7f8beaa5c4e1d7f9810696f078", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038989, "uuid": "5584aa6b-ea62-4bb7-992e-4d6c6706ff08", "comment": "Malware payload (Heodo)", "value": "94441e780d18d328664ad97af156703d1904ab032f5f50ec9f18fc9ebfd529d7cf275d3ce969cc17f348d18782120b5c", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038989, "uuid": "0bbcee15-5701-4166-8fa5-a1ecced59ce8", "value": "T1E8C33BF1A8025C0AE123C976B1FB661399D052ED42283B2BF87D507DD978A20D5DD8EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038989, "uuid": "6bfa35d6-0779-421b-b39d-92c459a3f27f", "value": "1536:RDBoTVdaeNtuXndCrJJmT4HVnteV4FrdMiYcx7bfCb6HPdnX8:1BoC+tCYvSMVnte8ZP1Y6Js", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679038989, "uuid": "f22fcc58-09ba-459b-b84b-1ceb249624dc", "value": 120428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679038989, "uuid": "b974cdf7-fc0c-42c7-9eb8-ad6cead22b1a", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038989, "uuid": "1c11f88e-14bb-4f8e-aa8f-21f88c46f983", "value": "OPAST GROUP LLC.one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4e94a4c-c4a3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1679044398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044398, "uuid": "6430c75f-c7eb-4ff5-82f5-6d928f17e01f", "comment": "Malware payload (Gafgyt)", "value": "a68d1b9f5e891098ff8d176b22a4d854", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044398, "uuid": "e79ee3f8-a299-42df-b39a-893fc97dfe80", "comment": "Malware payload (Gafgyt)", "value": "897a5bbaf970d037baef718baebc4e175533da7a2cba672a7bee3e2e3183a553", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044398, "uuid": "8edf7816-acf7-4fe7-97a7-150acc185ef5", "comment": "Malware payload (Gafgyt)", "value": "9078f2ab4e7515f43a24303ea9ad9d8a925d319a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044398, "uuid": "fa2230ec-3c41-4e92-af80-238b998585bb", "comment": "Malware payload (Gafgyt)", "value": "7b782e59256a60da15d5ff5ebc63eea83e44f53a7dc4a8d3480bed8e430f55353bc318983dca993fd8b9d1e8ce3156a5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044398, "uuid": "7321240b-6695-42f7-9dbc-4ad64cebd87e", "value": "T162A35B8AD743C2B3CC530AB2124BA66A4621FD3B092EAF49F7197DB09F374C97125B51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044398, "uuid": "6cc61e0c-09bb-4303-9e5d-08deccd97cfd", "value": "3072:4WCjQrLpnr85EdT9Oa8vqbVr78/CEgmqAgcVyZIcBI:4f5EdTbpr78WmqAgcVyZIcBI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679044398, "uuid": "92711def-5603-49be-b26e-670152929a50", "value": 99084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679044398, "uuid": "8860624d-de1a-4320-9e82-f58914b664ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044398, "uuid": "c60d31c3-9ed2-4ba7-81c9-97265a45b72b", "value": "a68d1b9f5e891098ff8d176b22a4d854", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23401b2f-c4af-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679049200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679049200, "uuid": "2c230afe-2f5b-4ab3-bc28-0e30940b6c60", "comment": "Malware payload (Mirai)", "value": "fbc59216eed8472ebfa314f853fa6408", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679049200, "uuid": "60cb7eaf-733f-4330-9592-d787d283dcd5", "comment": "Malware payload (Mirai)", "value": "8a525553fce7f48994ae058acc29e9b973c69c797a56eb2eae5b247198a87719", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679049200, "uuid": "dcaada48-99f4-49fb-9c93-0557c665b1c4", "comment": "Malware payload (Mirai)", "value": "13844abd99601a92a1724ba48c2572f73fe71a02", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679049200, "uuid": "030b9efc-a2ee-4769-8cb3-63ecf51738d6", "comment": "Malware payload (Mirai)", "value": "51aa64145b295ee9d160f5bc72d129cd4df6c4d46ab27134bd8d232530ae75f0bf873f4d078b56fac1da085875923286", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679049200, "uuid": "8734dec5-3c7a-4cfe-9dce-ab185792c06d", "value": "T1F5A3F831A641C973D04305F212A7DB660D32FDBB1A6AAE56E32C3CB0DE360C5B565E9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679049200, "uuid": "770b6b61-bd69-48fe-b4c4-a65b5842e185", "value": "3072:VK1z13U6HzHoXRtmTUhQog0EmmFVcqq0GnDZT:VK7DDeKlog0EmmFVcqq0GnDZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679049200, "uuid": "433e53f0-575c-4ae1-b065-417b45ec13d0", "value": 100042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679049200, "uuid": "88b12701-395c-4dfd-b9ea-c94e4f5d8bf1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679049200, "uuid": "46cac3fc-79a9-4922-aa47-c43db16db337", "value": "fbc59216eed8472ebfa314f853fa6408", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c52947f-c4f9-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1679081052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679081052, "uuid": "25245956-1150-4b92-aae5-12b1e101b52d", "comment": "Malware payload (GCleaner)", "value": "bff65ec63e4cc671151742fc54112927", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679081052, "uuid": "d5226b84-10f6-4018-b132-4a98b40964cf", "comment": "Malware payload (GCleaner)", "value": "8a58ec8781e8b2835a2d33a6a4412b4ce0674be037eba31a55c8cefe56c903c1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679081052, "uuid": "43dffd50-4925-4dc4-b104-8b425c7b6bac", "comment": "Malware payload (GCleaner)", "value": "c1029b86bb35cb202bb34a75dba3213acddab7b7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679081052, "uuid": "0f60c42f-382c-4111-bd23-f33aa24916c2", "comment": "Malware payload (GCleaner)", "value": "35e0149a9c0498df03aac7d944fb8e94c5d288a4742ec3a0d338d88e9148229b8bde6810192d14276a44f4f81d39b56a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679081052, "uuid": "c322f0f7-978f-4713-83d3-010edf3c9557", "value": "T110C5334FE25D80B0D2F36B705DB987048727FE8F0A1C688CA5CD764EDB74299845D3A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679081052, "uuid": "b79578e5-4051-4cc4-9dca-1cfc59a0426b", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679081052, "uuid": "a60c3c26-4c4e-4b3a-b090-8188db76acbf", "value": "49152:EGlJfslgHZ8h7Dbm+Q6doaFMvOUfRop2qFIHmoorD3HbfuhkmtN5dlLYp:52tm+Q6doaFMl+uKDDidPYp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679081052, "uuid": "cbf3e8c8-2b95-4728-828c-2132faf063ed", "value": 2722465, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679081052, "uuid": "9ecb1dfe-3b2c-4a66-acbe-36efddd208ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679081052, "uuid": "adc2ada9-6797-4d93-bcff-587df6215f81", "value": "bff65ec63e4cc671151742fc54112927", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37f6a953-c46a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1679019600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679019600, "uuid": "a63fd882-4f0b-4258-b6f2-9d1c3bf458c8", "comment": "Malware payload (Amadey)", "value": "46e712748ce8068f7a6cde8d1b845596", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679019600, "uuid": "cb0ed797-fdc0-4f92-8e9f-03c6e87fdffb", "comment": "Malware payload (Amadey)", "value": "8aaf85bcec3a7e54eef06a739e05b0efddaeb65da693951b7b9d2c46e7faf25f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679019600, "uuid": "7ab9f83c-2cf5-46c7-8e37-5476331713aa", "comment": "Malware payload (Amadey)", "value": "afc2307e61dfcb38d2101724c02941844220c3db", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679019600, "uuid": "4501a893-7d6f-4eb5-97a3-0a2eba51d421", "comment": "Malware payload (Amadey)", "value": "93d7ee3caf7a16096bb51d2851d6437537245fd570279b2bfabe65c6f0a80cdf0c2a7ea7130dda8a1aaaad1c0042fe94", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679019600, "uuid": "dffb8ed3-4a11-42f4-90aa-17b2228ab13d", "value": "T168048D1393E87C64F5264A718E2EC2F5761DB8538E79EF5B23185E2F08701B2CA6E750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679019600, "uuid": "2e812623-2491-4d0c-a2d9-4d2184842e3a", "value": "4b2faf5e2157c756cf2fd31d6cfd3d44", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679019600, "uuid": "a6d56b4c-6204-40ff-ae7b-527ad2c35010", "value": "3072:OIDQ+qOkCYE/r/J9so5cr3N0YYbqDMm/hVfdJB:3QBerauYyG/h7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679019600, "uuid": "a730d57b-3248-4c83-bdef-6648db2b30c4", "value": 177664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679019600, "uuid": "1a9726a9-6efd-4878-89d6-6fe037097230", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679019600, "uuid": "330a71d5-315d-41df-afd6-abb1950b1c6e", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdc1a8df-c4a3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679044413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044413, "uuid": "b29a1bf0-0d2b-4e03-b6b8-c861679e1ba0", "comment": "Malware payload (Mirai)", "value": "6c89d6b86eb41b6b6a05804766206649", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044413, "uuid": "e8f7e3d2-8d79-479e-abf5-21ab87265aa3", "comment": "Malware payload (Mirai)", "value": "8ad2ee72610e33ae0835116b8d17e44ecf8d85329b17b56ac25a0e3a7cc5242a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044413, "uuid": "2d74a156-00cd-435c-9203-7647fa7dce9a", "comment": "Malware payload (Mirai)", "value": "3280debebbcffece762370c14608c96533db9ffb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044413, "uuid": "a30e48f0-1cb9-4ff1-bf10-a1530a95c60d", "comment": "Malware payload (Mirai)", "value": "4a6080bc946b9424bf7c5b8cb70d5f43db3dc98205d82df9e87f1a4a61fc99451d2c852ffcfc1f1d8976d9a3358b3a79", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044413, "uuid": "cd703bb9-564f-487d-b699-88ef4256d33c", "value": "T17DE32B56EA418B13C0D61779B6DF42453323ABA493DB73069928BFB43F8279F4E23905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044413, "uuid": "4427c044-9f81-4a95-97bb-0d131fc4958d", "value": "3072:iJLceVpExfBxc0aAHbz4Nb4JJXpIe1FeEXMknM/98wAY:iJLcdm0aAHbz4NsJJfHeEXMEM/93AY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679044413, "uuid": "3f7f3d89-d219-4723-96f2-b01c6127bbc8", "value": 150610, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679044413, "uuid": "09c28de0-b5fd-4be7-b0bd-f1bc42afbe1b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044413, "uuid": "5c96314a-d157-4677-b428-ccffcf0db687", "value": "6c89d6b86eb41b6b6a05804766206649", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b25ed9ca-c4ac-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679048152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679048152, "uuid": "aceadf44-1ae4-4028-b7b5-e26a074f6535", "comment": "Malware payload (Mirai)", "value": "f9eca3276b6e49f71cb9a90d8a6e941f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679048152, "uuid": "a6320370-d216-45b8-bbea-9541bf9f8f2f", "comment": "Malware payload (Mirai)", "value": "8adcfa14ed1295cb9bc320a7447a3758f7c05767e18b5a105f68625d030bb010", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679048152, "uuid": "af577a5d-6e89-4494-8737-23fc4638a7aa", "comment": "Malware payload (Mirai)", "value": "b8dc09dfd24041d9c249c0fbef3b5f8c6bfa0854", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679048152, "uuid": "9fdbfac8-515d-40bb-a316-bd0cfddad774", "comment": "Malware payload (Mirai)", "value": "d96f711ec33b95c6734306c3b0289c40c69480fdbcb88c878544d209ebae8a65b03ba74225655f6ee09172f44be9e6df", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679048152, "uuid": "47fd137f-d7ae-4596-b432-e665f1bd03b3", "value": "T13BA2D168E1C16D78FFDC9D604ED3D28333A84BDA36B9DA6256C95F115603087E284EE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679048152, "uuid": "b32f2d95-8202-4931-bc6c-97753410a592", "value": "384:m/JywWc84Tp2YshxqlD4zA/nbgHH/Crvv/3jijOq+8fIOYFjB0M4uVcqgw05VxJh:mRxsSVsMDmA/U/0ft18fUL4uVcqgw09/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679048152, "uuid": "0b8936e0-49ee-46c2-9646-fcc5714395e0", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679048152, "uuid": "c93aec0e-d03d-48ce-8d69-fba60e23a124", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679048152, "uuid": "db5c15e4-6fd4-4001-b948-3ea21e90c06e", "value": "f9eca3276b6e49f71cb9a90d8a6e941f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d976a3d-c45a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679012684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679012684, "uuid": "c80e1094-5194-4356-a708-c18315afb533", "comment": "Malware payload (Mirai)", "value": "62de841431375c5a0de7e6f4577058d9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679012684, "uuid": "1b220a3c-c7df-4d75-b6eb-5cfc827aaea8", "comment": "Malware payload (Mirai)", "value": "8b34bc02f0b5f8123bef3e81cf8428bf3f028da27cb10b9b1a105f37cfb946c7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679012684, "uuid": "b041f66a-e0df-4f60-ab67-73f4e21cd9a0", "comment": "Malware payload (Mirai)", "value": "d61f05e90c1c7ed3b8cf8ddadb2477bba43ff382", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679012684, "uuid": "147a6095-dff4-4f98-a531-86f2959224d3", "comment": "Malware payload (Mirai)", "value": "7f31574942055a3383ae4705dfac620fef13b2f7bd65d8407d3cb3d539a5acb948827ff6f768333de6301a82b8504900", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679012684, "uuid": "80516e9d-4baa-4f32-a1fa-681702483d44", "value": "T18F13F150F6DC5C21DB303C3DDE74588B1A4A0CF8A8DB2562221EA3D2C596E5297A1F6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679012684, "uuid": "67c00f7b-313a-4a8e-8741-619f176651cf", "value": "768:TdyViSQMg149Fz0Dxf+M+s75N7tOgbz3JtZX9xjknKbU9q3UELy5:TaiSQMgmF+xYsH70gbzZtZXQg9LM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679012684, "uuid": "afbeee01-3be9-4823-ad73-6365de607189", "value": 44524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679012684, "uuid": "2a39ed66-724d-4381-8995-89b071f542bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679012684, "uuid": "c7d26a93-80f9-4f8e-a6e9-99c15da04a00", "value": "bok.arm6-20230317-0024", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "184c433d-c4af-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679049182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679049182, "uuid": "8bcbfd6b-5919-4afa-b1cc-1eaeeba7e0b9", "comment": "Malware payload (Mirai)", "value": "8d91fa36678b3689e7872cf65bbdfb4d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679049182, "uuid": "d735bf05-ceae-4c6c-985c-95a65bac45c3", "comment": "Malware payload (Mirai)", "value": "8b4ac7a4b30566a1c6d24ff469b03fb22e6cb0c6aa6a534ca15b8940384ebeb5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679049182, "uuid": "6e08715d-d543-43e5-b4da-092a76366b62", "comment": "Malware payload (Mirai)", "value": "68bfb68e0fbb3dd8f62de248e420f666dcc91325", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679049182, "uuid": "f4711ffc-439f-4161-bfe6-f4c2b1147364", "comment": "Malware payload (Mirai)", "value": "8d3a9c34dab192869e3ba6608a8d11118b86bd64ecae5d301fa1b32e76306cbe56d101a8cb4977500523c5f11a4cd811", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679049182, "uuid": "cdd846d5-e48b-48b4-8f4d-fa9075d0afae", "value": "T158B31A37A61C0B43C09B55F02DB77BF24F69AEA313A611C46609FEC04B73AB22551F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679049182, "uuid": "f9e8a695-65cf-4d05-ac1a-7f59c36ad3ff", "value": "3072:pC/4rdZHsXsZwwR9+Nk5mm/QcuLmHniPNb:pCwrvHwsZwY9+Omm/QcuLmHniPNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679049182, "uuid": "e41a47a8-743e-4099-ae8e-ce570f09fc0f", "value": 116786, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679049182, "uuid": "e4b6738a-0e4b-456e-b4e1-a57dc5c0da66", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679049182, "uuid": "6e9b1d22-69d7-4dee-ae12-39701792f248", "value": "8d91fa36678b3689e7872cf65bbdfb4d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "141ac4cf-c4a2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1679043591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679043591, "uuid": "4482dce9-f99e-44df-b200-d3788c6b3fcd", "comment": "Malware payload (Gafgyt)", "value": "b9b47eee63fdb5c0b7e505f1aeb59fca", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679043591, "uuid": "7af55d1d-0e91-4f05-87a5-a896a3e70bbf", "comment": "Malware payload (Gafgyt)", "value": "8b6e843482a9249cf62e7a3227a40ea100193ea565a72f7493e508fb619ced01", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679043591, "uuid": "81ccec46-453c-4565-9a35-e5d6727c54fd", "comment": "Malware payload (Gafgyt)", "value": "5a96c395fe6dc4544580910670b88eefcbefcb6f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679043591, "uuid": "83b5041d-6734-4204-89de-115b116205dd", "comment": "Malware payload (Gafgyt)", "value": "5c777383d32bac709dc77dded0cfb6004b0e71e447f44ec987cb2de0ce57058ec05a8aa84bb8a421086203ee9aa378e6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679043591, "uuid": "54988854-aaf8-4c7d-97de-240fd81bca3b", "value": "T115E3866E3E21ABBEE16886310BF76F70C39529D636A19342E16CF7185EB124C1C5F760", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679043591, "uuid": "ff3351a6-7687-44a1-8a14-8f8f4bbf4d31", "value": "1536:mVNs7K797V+nv57gbj6l6T6B6v6N6/6AePe1ebeZe5bwClA2rKQA1dXAQTI/e0hd:vY01ZkXAQT4NU9//ImlWs4zWfOodW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679043591, "uuid": "26240c23-84e1-4e04-9871-040482162f19", "value": 152121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679043591, "uuid": "0dfa5928-40b2-452c-a0ab-2b70ec84b475", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679043591, "uuid": "880aea35-7289-4fc9-ad3f-b4a99a186f50", "value": "b9b47eee63fdb5c0b7e505f1aeb59fca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36dcc9b2-c479-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1679026040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679026040, "uuid": "926189ec-ce42-43ff-bdc6-b4957f9951ed", "comment": "Malware payload (njrat)", "value": "227368ebab549d28b20ce786f72320c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679026040, "uuid": "b61eec83-9bcd-4bd9-b88c-99a491307ce9", "comment": "Malware payload (njrat)", "value": "8c402138d923ed8e4403dd04010eaa9c593f42fc02c5fa349774c44d8dda006e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679026040, "uuid": "31a483c0-b863-4f1f-9e39-8090191551a4", "comment": "Malware payload (njrat)", "value": "50f7d115ef22a2ea3d906af5e675f416ee78b5b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679026040, "uuid": "2b5ad1e8-cf78-47a7-a0c9-8b8d5043eff2", "comment": "Malware payload (njrat)", "value": "5b06201a523bf9dc3af1abb14aeec219b6fefe3a604ada5ff59f2c16004f31988289dccb45ba9ca1202f3254894f8f8d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679026040, "uuid": "b4101ecc-1fbc-4743-892a-693c96a156a4", "value": "T155B21A4E3FA9C856C4BC177486A6965003B0E1470423EE2FCDC560DBAFA3AD91D4CAF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679026040, "uuid": "8ef04180-803b-46f1-8d89-4d1f8094ab16", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679026040, "uuid": "f6af56ca-c74c-4c27-b7ee-d018f60b090e", "value": "384:0oWtkEwn65rgjAsGipk58D16xgXakhbZD0mRvR6JZlbw8hqIusZzZMQ:j7O89pbrRpcnui", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679026040, "uuid": "79fb2dfc-5125-4b00-8686-1959f8cda682", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679026040, "uuid": "ea52852b-faac-41cd-9e99-db14a65845c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679026040, "uuid": "41c14adf-1f4a-403f-b9af-805038d5e69d", "value": "bK7G.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a90aeb3f-c469-11ed-88f6-42010a9c006e", "comment": "Malware payload (Cobalt Strike)", "timestamp": 1679019360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679019360, "uuid": "26e965b3-b43b-40a9-86bc-7bc6e1e7841a", "comment": "Malware payload (Cobalt Strike)", "value": "f368051550d028d2ffcbdd7cda02c78e", "object_relation": "md5", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679019360, "uuid": "2ea4e512-fe6b-458b-8eef-40efae26c2ec", "comment": "Malware payload (Cobalt Strike)", "value": "8cf1e49c74fb05de954a6b70281f47e3cbd021108b0ee11f4a59667ff28bfee9", "object_relation": "sha256", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679019360, "uuid": "1ac0cab7-0174-44c8-928f-d9831e910113", "comment": "Malware payload (Cobalt Strike)", "value": "27fea57d9e7088c881ee6a79ab5c4958562b6237", "object_relation": "sha1", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679019360, "uuid": "6c7d0df4-688b-4e9e-b5af-e35be2654902", "comment": "Malware payload (Cobalt Strike)", "value": "69967a2dc601d56f0fb6658b8a944aab8932d7ab4f306963814a382e8a6d87c8aafc65933153ced4f38500359052392f", "object_relation": "sha3-384", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679019360, "uuid": "a65a1621-00c2-4448-9d0d-a37744c072a7", "value": "T16071E9140BDB794AA8E72407BD3EA4851E3C2E6786CA3C00F9F49210E8CBC39D1B7B14", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679019360, "uuid": "ed1a6c2f-5ef4-452b-8b2a-1b303820bba1", "value": "96:pg5SvvvOmVeLx1Yn64+kFz1xwDA0lgUV0lk:SIvOPLx1YnLzkB6u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679019360, "uuid": "5e498809-2c60-4759-b9e8-b49576b6a141", "value": 3556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679019360, "uuid": "702d687c-bdf0-44e9-aef6-b6c0c14db475", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679019360, "uuid": "345d4256-50a1-4e25-9bd1-eadd6daa2b12", "value": "eryao7.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a7a3ac2-c4c4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679058339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679058339, "uuid": "be074428-d1c9-46fb-88e6-3437c3148fc3", "comment": "Malware payload (Mirai)", "value": "917c0fd6ceeee0b17efabb1423e8c14b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679058339, "uuid": "345c4bb7-b73b-4430-a6b4-a5c530dbee0f", "comment": "Malware payload (Mirai)", "value": "8cf5a0cbb238022f0d63daa5c16cce7f6b05f38c22414a8b831cf779c1fba435", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679058339, "uuid": "b8371a5b-9fdf-403c-a857-3874408f8d66", "comment": "Malware payload (Mirai)", "value": "58bb244a7285adfcc21d8278ebd02fd7143aaaab", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679058339, "uuid": "43ad7f93-0fa8-40f7-a455-d363c9dc087b", "comment": "Malware payload (Mirai)", "value": "40d520fe099e2811558bef5fb36da7d1255e55dec90247a9298d2e8302fd0492960631d43d214c08dd69c07aed055585", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679058339, "uuid": "077fe54a-bfd0-4de8-93c9-2af36d4bdcc9", "value": "T1AEA32A45F841872BC3D327BBE78F479D3B36569467DB33116A386EB42BC17C82A29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679058339, "uuid": "59b0f040-1b82-47e6-a10c-f6f72a34666b", "value": "3072:1SN+r6mqaGfwNtGPf27NPmZuqQ4DPwXXtse:36mRGfgtGPCPmZuqQ4DPwXXtse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679058339, "uuid": "373f332d-ef61-47e8-b6ad-91dd1a4202af", "value": 100868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679058339, "uuid": "807d4f0d-43bb-4b54-882e-3dc20ad7a7bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679058339, "uuid": "b30d42ed-0208-4506-a207-5db0db72f298", "value": "917c0fd6ceeee0b17efabb1423e8c14b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c97af3b7-c4a3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679044325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044325, "uuid": "b9a79135-05ff-4a75-8e3a-bb4d72a2e00d", "comment": "Malware payload (Mirai)", "value": "a390ec747737136f7ded731d1d449108", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044325, "uuid": "d2d73800-522c-47b1-8a89-35b078275bf8", "comment": "Malware payload (Mirai)", "value": "8cfb2096b43da60cfdbae2f23923315fb17b5984264d573a0084943eb253d5ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044325, "uuid": "22530a79-77aa-4a30-ae7c-ce953518e855", "comment": "Malware payload (Mirai)", "value": "b4e35a21edff5c013c724199096f79c69e6b6f62", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044325, "uuid": "8fdf9c4a-a508-449f-8cd2-ecfd7e0f1377", "comment": "Malware payload (Mirai)", "value": "a2ed2c5a11738e21af124878b0f4a2787c3dee48ca44a770b00a8796eeb480c484ba8903cdc84d97d73a73e28b59e7ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044325, "uuid": "abb0df67-ce3e-49b1-8a81-4ffd8003408b", "value": "T10AA2E026BE48A1CBC839427996B1E9E51281BC72D3EC99062744C09FBEB33D18435EC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044325, "uuid": "bcab9b81-8789-424c-9dd0-7c555b33a660", "value": "384:MY3Lpj8s/qPui8uZxoIA57RWQjJiEVi+ZkeaYuNTOd68NSGJPC7/Hh3Ymc/rSy4:598o08kxofBE+ZkeaYutaNlq/Rxc/x4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679044325, "uuid": "6adabe33-f2c6-4b08-8cd1-72bb0016993f", "value": 21492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679044325, "uuid": "07ae255d-381f-436f-ae26-ec217c1bf231", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044325, "uuid": "624ace0f-bac3-48a0-961f-898e4bf2188c", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "612d9ac5-c4f0-11ed-88f6-42010a9c006e", "comment": "Malware payload (CryptBot)", "timestamp": 1679077221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679077221, "uuid": "2d79826e-e20a-4826-9371-877129b101e6", "comment": "Malware payload (CryptBot)", "value": "1e13665ad9d89eb7942a5875e0c604fa", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679077221, "uuid": "02250c62-4dc4-43c0-a2e6-3c2f559fd335", "comment": "Malware payload (CryptBot)", "value": "8d6a5494e1ac90fc86b7c3715bbc55f654b1c4b9d8c589dd1229c3c4092cb49f", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679077221, "uuid": "26363e67-c5ae-4aad-965e-386d4f3109ec", "comment": "Malware payload (CryptBot)", "value": "c6fe2dfee757ad9562d6f0e97d4ed5a30f45a4f4", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679077221, "uuid": "042d757c-7d8c-4b5e-bfb2-730f3309b204", "comment": "Malware payload (CryptBot)", "value": "aa205cf232b168e68f7706dd3fa02b7d6637ed0ba8c2843d9552f64e5e65e595252cf53dcc9e814eb8e7565a0b1acfe8", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679077221, "uuid": "ccc8c14f-701b-451a-b117-f02ba436360a", "value": "T1F4050251F9B1C136E02825B5C96C6B34AFA5BE33562320EB7BD13D3EE12C262D386751", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679077221, "uuid": "c66f0932-cfd7-4d83-8f86-77ef2c014aa0", "value": "24576:agra80EMvFtQWwLI5R9le/nbHrrYCDjDaO1dH:7rktwuR9srDSah", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679077221, "uuid": "0b6fe9f8-d799-40f1-90c7-8a95fa445842", "value": 810496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679077221, "uuid": "2b7da16e-16fa-42f6-883a-7e723cce360b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679077221, "uuid": "03710ce6-6129-46c2-96bc-000ec7fecc2f", "value": "1e13665ad9d89eb7942a5875e0c604fa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9f841f7-c4a3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679044407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044407, "uuid": "196391eb-cc58-48f1-952e-20a55e9dd99d", "comment": "Malware payload (Mirai)", "value": "8d83fbb763532617fac67336c9c6d58e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044407, "uuid": "c07acc15-577a-4246-8f16-5b4159bfc065", "comment": "Malware payload (Mirai)", "value": "8ffd9d2b02f0cbbaa7171c5aacfb84a0f0b66181fa14672a779b671c4e5ebfb5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044407, "uuid": "4ad31b87-ee72-4e99-9218-3aaab825b9a0", "comment": "Malware payload (Mirai)", "value": "175c43465ded0c61300b6eb38f2b89cf64f73477", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044407, "uuid": "094be18b-3ee0-45e2-9c31-afd1857b70c3", "comment": "Malware payload (Mirai)", "value": "37804b305dccb2976b5256529ecdf6f20fccd6afd984eadc51af2a7ad324da5d36972706d162d803368957a4ae5eeeec", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044407, "uuid": "59c0a5db-9789-44da-8561-1805dad4c625", "value": "T112534B02B31C0A07D1A31AB0253F5BD197BBEAD022F4F684751F979A96B5E361182FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044407, "uuid": "5f8e8e48-5e0a-4d20-9d22-6cc4d38dbca8", "value": "768:qkaZjEoakZNRGHRnDmX7Xm+t/UGV8+BCpEMsK/J9KCrMvuBxANUr6FV+tMiwWuIC:MvolWm+phBgdBKCAWBxANee++bWuvF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679044407, "uuid": "619e3505-794a-4222-8d00-629048992f93", "value": 62988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679044407, "uuid": "b1e1b72e-acfb-460e-972a-61da032ce4ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044407, "uuid": "07ac7fc9-c768-4204-9199-714035573ab5", "value": "8d83fbb763532617fac67336c9c6d58e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34083b39-c4be-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1679055671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679055671, "uuid": "f49df266-1e76-4c82-a0dc-71e01dd714e0", "comment": "Malware payload (Gafgyt)", "value": "d2e25738c5b625fa3dad4f2bf8eddddc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679055671, "uuid": "1f1f025b-e711-44d2-acd9-e4a2e3eca866", "comment": "Malware payload (Gafgyt)", "value": "90771377f422eb8116541da3cbd4ef56a4f222868542beb3239ed72dea6e9640", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679055671, "uuid": "7102b8ea-61a9-4e27-88a6-f3c804ec19cd", "comment": "Malware payload (Gafgyt)", "value": "31d18c01f95fc134aa71e438bba671392f2ee661", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679055671, "uuid": "bd30972f-e0dc-4f33-b847-20db90061270", "comment": "Malware payload (Gafgyt)", "value": "3caccf289f5c1922f0b3ef011eab06ad59a003b32089c48dde91e421f8c853ae8feb44a85fee5e4400ea9c98a1bf2842", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679055671, "uuid": "16a0bb09-5c1d-4eff-91e4-1f8ac27a9df6", "value": "T12BC30A44F901475BC3E327BAE78E038C77355E6857DB33156A38BDB42BE1B982D29260", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679055671, "uuid": "7ef985ca-1dca-4c9d-842e-d46899fda9e9", "value": "3072:H63VpNeuWDGeQf8sRCUt3DxkS2YmyVUQuiXfQd6W:OSuWQEcCUt3ZmyVUQuiXfQd6W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679055671, "uuid": "703927a5-c3d3-49bf-a7de-3240ebafb3c2", "value": 127723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679055671, "uuid": "e3e7c237-eb5c-49a4-870b-b8513cf85775", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679055671, "uuid": "4f426455-fe98-47ca-8462-1777a2dc7bf9", "value": "d2e25738c5b625fa3dad4f2bf8eddddc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1335e0f0-c4f8-11ed-88f6-42010a9c006e", "comment": "Malware payload (AuroraStealer)", "timestamp": 1679080527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679080527, "uuid": "ec76ab5a-9882-4133-90a6-6da56430bdf6", "comment": "Malware payload (AuroraStealer)", "value": "a480e4bf51162bfd63ed718149a4a608", "object_relation": "md5", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679080527, "uuid": "c05ab9de-7cf5-42bb-b2b3-b645016302b4", "comment": "Malware payload (AuroraStealer)", "value": "90c8f164b43f4734eda087b9f9aa22f1d3aa4fcb699b3a21ab831e275456f519", "object_relation": "sha256", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679080527, "uuid": "fe9b6b64-5415-46ae-8323-8f7330232872", "comment": "Malware payload (AuroraStealer)", "value": "16b9d95ce72eceef41e51df9c30c1f84e63d9d72", "object_relation": "sha1", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679080527, "uuid": "4c735015-1c2b-4ca7-9dec-693bf108183d", "comment": "Malware payload (AuroraStealer)", "value": "26428a63ad883d8aaf874312c36eadfe3fec2e4b546e57fd916aebee1d7281542e71446e418497a2a636e1ba723b2d03", "object_relation": "sha3-384", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679080527, "uuid": "bac7e91f-ec7e-4421-b1d1-dae65732c37a", "value": "T192542A1392E17C48E9268B729E3FC2E8771DF6518F89776532189A1F04F21B2E163F91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679080527, "uuid": "508e9bef-68eb-47a7-9c78-0d4dcc3f44ac", "value": "967eb4f66af509da0d8ad27d2261daaf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679080527, "uuid": "d8924424-71b2-47ec-84b9-9a668e4634a7", "value": "3072:r0k77gXLYZGoPk/e682kbqWWIKQ7MtqoKWQ3GK53hpdylitUGuM:g4gXLY4oE8/m8MYLWQ3GgUgu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679080527, "uuid": "5f24a476-7d36-406a-a99b-879e573487e4", "value": 303616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679080527, "uuid": "73d6fdc7-ebe0-4b92-88db-cb5e8fbaf948", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679080527, "uuid": "13a51031-6a5d-4a52-b662-ff885212d097", "value": "a480e4bf51162bfd63ed718149a4a608.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aca80809-c4e6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Fabookie)", "timestamp": 1679073053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679073053, "uuid": "7a07384e-d63d-4eaf-bbc6-e9627c56b765", "comment": "Malware payload (Fabookie)", "value": "df9527b0b67e6201e5efd52731cff0cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679073053, "uuid": "599a0951-03ed-451a-8c37-3a36ac9142bb", "comment": "Malware payload (Fabookie)", "value": "915a8d2f99b3905d254e5f715038bc005acdbdfdcb84f7ca598b85fecb3894c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679073053, "uuid": "177067c1-242a-4469-b065-b1a4ae887f3f", "comment": "Malware payload (Fabookie)", "value": "12c0df4e347dcaaf454df7982b1c3cefd8016fc9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679073053, "uuid": "445bc971-5746-427b-b200-eebd3b82f4c5", "comment": "Malware payload (Fabookie)", "value": "65e08bce869a7f323c21eff263d583998ab6b1da248ef89639f55857ef3157f4219831ee9adf56a4f3a98f8e85cc7a6c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679073053, "uuid": "86af3501-c4b8-40fe-8fde-59eacf6afbb7", "value": "T15D258009BE5E8080CC1156388976D775B7627CA81F2D86EBF197BF2E6F325949C39203", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679073053, "uuid": "eb8c9e0b-e8d9-49d2-82d7-d8e6ecef2ccb", "value": "7533beb38e834532b23ecbe6c94b2454", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679073053, "uuid": "f0a30e60-7c08-4736-823c-19c1174372a0", "value": "12288:hZJc/3ljJaKbZmkWi6dSsA1xsBwLgGLXKPXPiXuHNHGb6bH/zx/GCLW/nh/X:hZMa1iV37LgG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679073053, "uuid": "896c6557-8f9e-40f4-9a12-35c6d1c480e6", "value": 973312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679073053, "uuid": "da05c0da-f1ff-404f-ad68-b1c792d6fc5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679073053, "uuid": "8717c3c3-4eae-4afa-976f-de58efcc232d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6562876-c4aa-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679047326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679047326, "uuid": "15deaff3-0b5e-4ca1-820f-280a2c91df40", "comment": "Malware payload (Mirai)", "value": "fb67d89fd27eefa5089228e2fec2bdcf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679047326, "uuid": "64ddb2fb-5216-4bb1-991f-471958d0cf00", "comment": "Malware payload (Mirai)", "value": "916a0c565dd17a3317506e96aa68e0b57a1f325e9097d2d4782c9b1498ee71b6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679047326, "uuid": "4e1b3b97-7092-40f6-888f-9630365864cb", "comment": "Malware payload (Mirai)", "value": "2e1fa044823f8157b479ee65135a732205c07776", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679047326, "uuid": "0219eef2-e265-4536-9ec7-3ac2829e7f19", "comment": "Malware payload (Mirai)", "value": "ec7af704d6dd67b5f6e3f7dc0cef468bcaf77c9da2f3a6a457406b51dd648970fa894db59d87910ed5d63de92d8c5a68", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679047326, "uuid": "36d2ce38-ab80-4a45-b948-bbabc21a1942", "value": "T195C3F731E8044B1BC2D223F6E75A469E3F351E9793E733115A3879B06FF27992E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679047326, "uuid": "dad4e064-6d54-4998-a48f-29f477497b55", "value": "3072:6jVlyaL5JCrIpv04sSbttiEiTmP46aQyfPlfKsNb:yoCJCN4sSbHemP46aQyfPlfKsNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679047326, "uuid": "2748456e-15e5-4cd7-8905-743b5f03c0d4", "value": 129898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679047326, "uuid": "8189f9c0-5175-43a8-a7c4-1da1bcf8b761", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679047326, "uuid": "19214f5c-3d2f-40ee-821a-69b916cf1d36", "value": "fb67d89fd27eefa5089228e2fec2bdcf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6c16e2f-c4c9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679060695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679060695, "uuid": "e5a62872-bc9c-4270-83cb-c9261a2ebcfc", "comment": "Malware payload (Smoke Loader)", "value": "88c9c74f227ab2c4338c33efbb177c80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679060695, "uuid": "ad713a67-2729-47c4-8e62-4d444cd9b0c4", "comment": "Malware payload (Smoke Loader)", "value": "91752dfafeac37df2e377425006fb53dc65ea27109c6e841b5412b58263be2df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679060695, "uuid": "ec4c5858-a659-4513-8e4d-e6b6000ac46d", "comment": "Malware payload (Smoke Loader)", "value": "2274b54cedb4957e3e98b743cf6a7eb04d7514f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679060695, "uuid": "e03b510d-0469-4546-9173-76945d81f67b", "comment": "Malware payload (Smoke Loader)", "value": "fa7fb4ebfa5c748ac783a20768895ca40e6d15fb4a61b1dc09c7f3e2c7706635ebb7f7be946fcb9d9819774aaf2cec6d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679060695, "uuid": "9470bc09-ff26-44ee-bcdb-74669a0bb142", "value": "T10F541843A6E17C41EA268B33AE1FC6E8771DB660CF497BB92218DE5F04B1172D173612", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679060695, "uuid": "4aff6a96-d1e9-449d-b2aa-e4010a73046f", "value": "800c211657980cdb5c72386d0a0450fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679060695, "uuid": "ae9a1add-1a83-41d7-84df-e2f53bb2ae43", "value": "3072:rSUPwyLz6WBVgPlr6MZCF2PSXMsU/mFeV6LWYiI3HM3z:euwyLzjBVg9rpSXMsmmFeVFj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679060695, "uuid": "0c6aee22-ae20-4dc1-8950-42d56079f216", "value": 302080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679060695, "uuid": "b9f9ae93-ed35-47ef-b0d3-205c695473dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679060695, "uuid": "031de041-da03-4505-ade9-ceb92076ad01", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb6c77cf-c4b6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679052543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679052543, "uuid": "e2fa799e-52e7-4fbd-bbc3-6d044d5f9d09", "comment": "Malware payload", "value": "df644e9d01d82d497159ca4c3c8df6df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679052543, "uuid": "efd28304-c497-4877-a96a-3a432e006ca3", "comment": "Malware payload", "value": "91efba034ea5e87b63a35af2e25b693255619a143d43204d207556f2a3f72bb2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679052543, "uuid": "3adb0618-ee39-4e98-9659-db719dcf33f6", "comment": "Malware payload", "value": "1813d0c415d9ee4adb0b1f81d4ab56812e7dec44", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679052543, "uuid": "a891f051-7105-4a59-8085-ca92beeae0e6", "comment": "Malware payload", "value": "fbb595106833db836596764a71986a9926b2ffb72939925d13bcc5dbb5716e1ad3475ea1ea61c418db93b9b3f952cbcd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679052543, "uuid": "6a18319f-9cc4-4e35-bcb4-c10cddfc5b13", "value": "T17B2633197E2CA469D682CCF08C165B3DDD41B2094013B3379EF4F0A7A85267B2EE59BD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679052543, "uuid": "ad29524b-0d52-4168-8e73-189ab00c138e", "value": "9aebf3da4677af9275c461261e5abde3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679052543, "uuid": "b03c068b-1c6c-4f36-918c-24e11cf4329e", "value": "98304:w4I6Vtz+QkSlbsV6iaTDIrSCqzESpV6vEciXkMC+iArEp6WAq033dkCf5224Z:w9QlkSlbhD4SNPwv0XkLZAry6q0336Yw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679052543, "uuid": "2c7a1c59-3be6-4bf7-8f64-55c4d69b7d96", "value": 4509696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679052543, "uuid": "f641af90-1bd2-485f-bfbf-d96110b3248a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679052543, "uuid": "6aa844b7-890b-4737-ac10-450369bd22f4", "value": "SecuriteInfo.com.FileRepMalware.14484.23017", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "030c10d1-c4d2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679064179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679064179, "uuid": "b647ecc8-3849-4303-88f8-32443b4b14a7", "comment": "Malware payload (Mirai)", "value": "4195f2893004d5a7285b19da6f6d1f8f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679064179, "uuid": "f803f3b2-8f52-4dbd-b287-055b64b47004", "comment": "Malware payload (Mirai)", "value": "9296cfe908532fc2b6b6351de1a0698fff0e9801873eefae699063b630954b24", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679064179, "uuid": "bee07729-a0d8-4592-93e2-b179c5cb2b0a", "comment": "Malware payload (Mirai)", "value": "9f5f78d38aa74018fa54d75ebde86911937dcc30", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679064179, "uuid": "35db26bc-4502-434e-a044-4c4281d2b130", "comment": "Malware payload (Mirai)", "value": "7efe65533a4e760b9034fa83deed770868ef97a1c051cf0cf043d0cbdda342075296eef17db744ce9e6d9f2d66930a03", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679064179, "uuid": "b622bb30-1bb8-4da1-aa44-4ffaaad2abc8", "value": "T10682CF3062AF74E4DBF10430EAAD8EC697160BB9D0FD36A317586F78894510661F92DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679064179, "uuid": "fd43e9a4-6009-4c18-91a5-0c29129c2557", "value": "384:MnfzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMaghymdGUop5h5lY:2dV0P6+kom0tVAoNvm+to1gs3UoznlY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679064179, "uuid": "0bc8b87b-a7ca-414a-989b-d6724a5f5a57", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679064179, "uuid": "e971296e-b640-4355-b054-9a4e1a81132f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679064179, "uuid": "9e7ca285-1d14-4308-b173-d892d1765ca4", "value": "4195f2893004d5a7285b19da6f6d1f8f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a656ed1-c4a5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679045025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045025, "uuid": "f5eb39a3-178d-49f8-9691-76af6ca92876", "comment": "Malware payload (Smoke Loader)", "value": "b4045db6aa794490faf4bad9982e5f07", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045025, "uuid": "aa9b4199-e4f8-47da-8d61-5ecf18ab9dd6", "comment": "Malware payload (Smoke Loader)", "value": "92a5b282a453a1d71a1d800a95018b6248da4a8cdcc58e82c56266be169cc98c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045025, "uuid": "f9f1e5fe-ea24-4abb-b62c-ae12ca80e777", "comment": "Malware payload (Smoke Loader)", "value": "4592e8b5944e5bc4909081890da7e86a0aa4833f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045025, "uuid": "68f37218-063a-4cd6-8644-465b3e259611", "comment": "Malware payload (Smoke Loader)", "value": "f916e55f57fb35243c2e2eb54a655282e4e63e145a2ddfa583cea77bb0e5e66d828b531179cecc4cb5c75b1dac110257", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045025, "uuid": "c670f2cb-2e35-4d09-ba07-c2b7a5147c0d", "value": "T125048D1393E4BC64F5164B358E2FC2F4762EF4138E796F6B22185A2F08B21A2C56F751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045025, "uuid": "3da5ce4b-5495-4d30-a955-056310d89865", "value": "3391dcebdf72207e22a1ac369ab55c39", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045025, "uuid": "5a895b9a-47bf-4c9d-9b17-89ad2be8b1c9", "value": "3072:kuLO1A8cIuDtGZ0Nl5lWYs0oT35l2j+pKBIPwkWLLhkzePm/hVTOmdJB:rOqPGZ0FAYs0oT35l2j+iII7LuqO/h5/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679045025, "uuid": "96735f4b-bbe9-4b2e-9c52-751275b8b825", "value": 179200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679045025, "uuid": "1ff425e6-14c2-4784-8e54-9fb405b7d687", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045025, "uuid": "bb6acf9a-7ba4-48a7-9f68-6a0f34b200e7", "value": "b4045db6aa794490faf4bad9982e5f07.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b139e20-c4f4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679079010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079010, "uuid": "420a2fab-cbc2-4105-b0e0-fdeb0bc17824", "comment": "Malware payload (Mirai)", "value": "a8687ed3c3b9b3bc2da04f74cff91f65", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079010, "uuid": "24718440-6c41-4b31-9208-d5c8b21cee59", "comment": "Malware payload (Mirai)", "value": "92d072a9930bbaf0c9552aee712957c459c316a4c59e2544bb76614dde182252", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079010, "uuid": "59214ff8-c026-4814-96a9-c250deb43b2e", "comment": "Malware payload (Mirai)", "value": "0d0a0729d34f23eb428624f21250498b6788bd27", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079010, "uuid": "f0d22a76-ebd3-4eea-a500-80f58371950c", "comment": "Malware payload (Mirai)", "value": "7a8c34826d12adf9436b7e50f76dbb8c060159b06cddc61e38893db825c585d762692183933972237a7468cfb53037bb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079010, "uuid": "65ff58ef-1e2f-4234-877a-cbf18c34cac2", "value": "T14DD2E170A34B39B1C1B01135BA9C979A46872D74D0FF73B7622114B57DE71CA3AA01E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079010, "uuid": "52efc5f0-138b-4c70-aab6-86e46871e467", "value": "768:wA4uBc0T/nVvqV072G+IFYoXHZCx3GRs3UozF:wPuB7/nVMYn+Kf5SzF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679079010, "uuid": "f66d80a0-8942-4b80-9a5e-d4967f159213", "value": 29944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679079010, "uuid": "0932aafe-ec74-43e3-917c-85912afc986f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079010, "uuid": "1c438f70-5804-4ddd-bf80-74238f807269", "value": "xd.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46381bcf-c4be-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1679055701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679055701, "uuid": "a71619df-2f80-4935-a23d-6b864b53cc73", "comment": "Malware payload (Gafgyt)", "value": "41a6f34060a742f01dcd7cc55ccd8da3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679055701, "uuid": "85cdb7e5-3227-4e02-9ba4-1766b7254c94", "comment": "Malware payload (Gafgyt)", "value": "92e9bf4f23b912d0194887e817d243fa448ff75788d46b1740f0d14407f6fb46", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679055701, "uuid": "47ac8e89-b101-404d-8556-273129cffbac", "comment": "Malware payload (Gafgyt)", "value": "d0fc1f5b0051ddd4d7493ff9758df17c7a606633", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679055701, "uuid": "891afa46-f5f1-4449-8d67-681654e888ff", "comment": "Malware payload (Gafgyt)", "value": "f82d9cae5f489693409518c763fd6653322c3dd4cb66e870731e0d2d02005282ae684e89b00440be0da31c72b33ecdf3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679055701, "uuid": "fbbcd729-a12f-40c4-b70f-246078c07f2b", "value": "T124933A56A780D5B3D14305B316979B620033FE7B1A5EAE0AE35E7CF18F3A0987221B5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679055701, "uuid": "c39d1c4d-f185-457d-af34-cbc31e29517c", "value": "1536:mzqmXTbw7U+OU0Cf5UI8E8WwP6kHzgk81VwcG2emiGMUNLe5um7WAgcVjmZIcBI:mz52UVUtBUI8GwPfHkk8rYeLesmqAgcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679055701, "uuid": "25504f03-8d33-4313-a6db-65308331ad03", "value": 96268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679055701, "uuid": "78b5187c-160d-4d65-b933-a0532f684159", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679055701, "uuid": "abdfa819-1ae4-4625-a1dd-365c39986c5d", "value": "41a6f34060a742f01dcd7cc55ccd8da3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98ba16d9-c47b-11ed-88f6-42010a9c006e", "comment": "Malware payload (LockerGoga)", "timestamp": 1679027064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679027064, "uuid": "c3da6058-ad34-4912-a50d-403418930fe4", "comment": "Malware payload (LockerGoga)", "value": "493f41f96085669fe4a2821e4e864fd4", "object_relation": "md5", "Tag": [ { "name": "LockerGoga", "colour": "#D7EF8D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679027064, "uuid": "01e69b17-6853-42eb-bfdb-fbc77ae95752", "comment": "Malware payload (LockerGoga)", "value": "92f86215140ae1fd929e9f60d73b7b3c65567418cfff1aa3b63638c3adaf98e7", "object_relation": "sha256", "Tag": [ { "name": "LockerGoga", "colour": "#D7EF8D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679027064, "uuid": "badd7829-79d8-4082-95d1-ebe970793950", "comment": "Malware payload (LockerGoga)", "value": "62aafe2d9fce8fea964439bea85ffa6acb0720ad", "object_relation": "sha1", "Tag": [ { "name": "LockerGoga", "colour": "#D7EF8D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679027064, "uuid": "35e199a3-3fec-4e0d-861d-fb5c0eeccc46", "comment": "Malware payload (LockerGoga)", "value": "e61c2b10be40a49aea46a8b2b992db5780021df0e262cb11ec6ed6c0a5b035e47ce5f2f2e1d892e8dd771e4105224e98", "object_relation": "sha3-384", "Tag": [ { "name": "LockerGoga", "colour": "#D7EF8D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679027064, "uuid": "c8917d5a-70bd-4c2c-8172-b93d064b9133", "value": "T18B457CB1B683C63AE96250B08D2CDA5E505DBE240F7605C7F3D8672E6A314C35F3BA46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679027064, "uuid": "12fdaf99-9de7-45b8-bb20-3c220e89db41", "value": "c226ac4bab6f48634bacbb7a1d34f8f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679027064, "uuid": "dac53f57-675b-4a5e-8c1d-a1f047857877", "value": "24576:ZtjNyN2LPDCfSXu21PpIkfQYInn9RbEhHSO+SA+GnTQ/SOM:/jyMmajEDYInnjEocA+GTQ/SOM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679027064, "uuid": "b1e67a59-7bb1-4354-87be-e3d5835b75c1", "value": 1267728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679027064, "uuid": "5ec04935-7956-4a12-a1b6-bf703eac8c75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679027064, "uuid": "407a1828-0d4c-4833-b1ee-70b95a7986e0", "value": "2023-03-16_493f41f96085669fe4a2821e4e864fd4_locker-goga_metamorfo", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdb6767a-c4a4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1679044842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044842, "uuid": "b05e80d5-bb8e-4ca0-88bf-cbe56c688f18", "comment": "Malware payload (Rhadamanthys)", "value": "b43bee14387161a9dc5f3cbbba8382a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044842, "uuid": "debe5b90-0d5c-4f72-9f1f-5ef6b41a5b87", "comment": "Malware payload (Rhadamanthys)", "value": "92f8ab34d7e6a41dd7bfbfdedf73269950aba3f0ff0a8fec0aea049c81024cc6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044842, "uuid": "04935224-eb69-461c-98d6-2dfea3f8133d", "comment": "Malware payload (Rhadamanthys)", "value": "0cfc0daf528fc0147b0e9e9bb4b35275077faec6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044842, "uuid": "5625178d-7794-44b7-8fcf-3236a1e4d0c9", "comment": "Malware payload (Rhadamanthys)", "value": "e2e5b737d6bc6da1e19e4879bd7df92c3ae2e35ffa137114434d6ddadabf07f853008311b8e781b23007483409056fd6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044842, "uuid": "d6692046-4284-4bce-a223-1864e5b26665", "value": "T1EF34C00392E1B850F5A64B325F2FF2F8760FF4518E56EBD622455A2F08702B2D5A37D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044842, "uuid": "b7afa237-7373-44c4-bec7-9453fff398ee", "value": "6149c9f35229403fdda7d9d88d405383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044842, "uuid": "12413efa-b867-4f1d-a902-f2b44313b97d", "value": "3072:TFGrChboSFmoqBeRrc1MgOPNwswn3q9QGPDxMcc3cFJwCRvI72Qv+sZhmaRWHzXU:TmChMbo5cC1w3qPxP22uFzrWT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679044842, "uuid": "b2a99d25-3305-4d45-8287-fd336f7dbb95", "value": 252416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679044842, "uuid": "d85cc36f-7d40-46c3-8ff3-22d2e3a6f4ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044842, "uuid": "d2f15421-5b6e-4a38-ba43-39edde76433b", "value": "b43bee14387161a9dc5f3cbbba8382a7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1798dea2-c51d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679096425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679096425, "uuid": "58310795-b36a-49f0-9174-afbc0f1df029", "comment": "Malware payload (Mirai)", "value": "0c4eeba55b933304b34852a21905bd37", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679096425, "uuid": "e3df5e7a-8e8d-4ed8-85cf-409c56509966", "comment": "Malware payload (Mirai)", "value": "93c62abd2e97ceabcf673a576563d1b991281f4698ab353bf2779d655e86181c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679096425, "uuid": "cbc1a564-6ce9-4462-a562-c8092ed9e024", "comment": "Malware payload (Mirai)", "value": "ebea7600f2971c578f9dfc6cbaef3145d1b5af0b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679096425, "uuid": "fae69d11-e609-4180-861a-55d9e545cfaf", "comment": "Malware payload (Mirai)", "value": "320b30f0f3210753bc7116e8cba85657bb3892fae05a8d068087c4cbeef42ffffd30b39f14f8b6908ce21e8418fcd567", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679096425, "uuid": "747b5107-4962-4998-93dc-f4a9640750ab", "value": "T1C2E218E6F801AD7DF90EE3BE44134A4DB520775651830B3623B7FD53AD362A81E22E06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679096425, "uuid": "dcbb8509-ed26-4d1a-a741-2ba7a07671a2", "value": "384:KLleKFqtTXtyOo5SWUvZuyOXGSjD0CI8qUr8HAe7o26KFjqng5VRX4+O53Tn:KLleM4nJWUIjHrL8z7o26uwgvRX4+Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679096425, "uuid": "815de795-4cd4-4abd-8709-1242aef61e44", "value": 32144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679096425, "uuid": "ecabd499-c3f0-4e3a-9b7e-7835bb4d9e83", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679096425, "uuid": "c14e8a61-6225-412b-be25-47122a260189", "value": "0c4eeba55b933304b34852a21905bd37", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1d47f41-c51b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679095798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679095798, "uuid": "1f3d487d-baa5-41ff-a872-8c7be3ea31d7", "comment": "Malware payload (Mirai)", "value": "ee5ed432281e8eb9e88b64452b44c84d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679095798, "uuid": "33c98bb6-10be-4545-a4f2-1c4819bf2512", "comment": "Malware payload (Mirai)", "value": "93f4ba64e73e48cbd32144ac422fb76d6990a30392ce378b99559f0b73abb868", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679095798, "uuid": "05faf9e1-61d1-4fb1-a395-e335c23cd86e", "comment": "Malware payload (Mirai)", "value": "0e17e0517adbb29e8ea581c80cc8ccba361f61e7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679095798, "uuid": "8675940f-bd76-45d1-be5f-e3c43c9a7276", "comment": "Malware payload (Mirai)", "value": "ed8c800b9b247f225ab60bb873a72f353dd5784f4c2c0bc9d984fcc658f9ec554e4e2f1c918b19e2d63b11b0844779e9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679095798, "uuid": "c8d4d43c-ca50-4f03-9ae6-1577ed0bca22", "value": "T149732B96F801DD7EF84BD7764017090EB93063D00BA20E2773A7BDB7EC721A61926E45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679095798, "uuid": "d98aad6c-bfa4-4b24-9a6c-63e6da03377b", "value": "1536:fjNTzvfvi7NH6hEWMrld67b8h1PFjeJJyDh/b7c1n64FeTBnbX:fjNTzvipahBmT67gEJYDFp4FeTBnbX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679095798, "uuid": "4402261f-f2a9-4d6b-8b24-0db616e183d5", "value": 75864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679095798, "uuid": "8f2ae60c-328e-4798-8603-ac83802b93b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679095798, "uuid": "2d4b1a2a-c057-4709-adf8-7615767fb970", "value": "ee5ed432281e8eb9e88b64452b44c84d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83bf5da5-c4e3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1679071696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679071696, "uuid": "24e5f613-e94c-4afe-a429-aa27f66649c4", "comment": "Malware payload (Rhadamanthys)", "value": "f9d7f070931cf2b2e0b486d8d50c5b9b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679071696, "uuid": "6561a2a1-59e4-4743-aee2-a4617b869df2", "comment": "Malware payload (Rhadamanthys)", "value": "9443a0d5ce8e1e34c5c830f49be863e6a1305b1fed46f882bcb03171414b1930", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679071696, "uuid": "f59a0fe0-37c4-4170-a022-180c5125ea30", "comment": "Malware payload (Rhadamanthys)", "value": "c30dd3f1dd90e12d2adc1ae8a9ac26a85aa99b2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679071696, "uuid": "3a63c95b-e2f9-40ca-a305-5133c8689502", "comment": "Malware payload (Rhadamanthys)", "value": "6d020ab2bb5cb569953aca0c42a409b12f6d66b4fa3bf6bbb1d8ceb5cbe1ecd14606786bddef57ff88eb7e9a08dc9dee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679071696, "uuid": "10add29d-a439-4811-ad5d-db7a62a93eae", "value": "T176745B4396F17D40EA268B73AE1FC6E8761DF661CE4A77B62218DE1F04B0272D163712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679071696, "uuid": "b7b3c8ec-bd94-4050-85ba-7008233ae6b9", "value": "48e7bdebf7b90ec755513d967cfa38a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679071696, "uuid": "9bacff74-056f-4c20-858f-fd7ce8c6cc77", "value": "6144:vJ9LgjkH9aew2z6RUXYMCcVGDW7xMKPxpdtPMJ1SY:vJ9Kkdnz7B9NM+xpdtPo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679071696, "uuid": "ce4bd475-b607-4a2a-b52a-50a1e9d90f51", "value": 367104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679071696, "uuid": "19062612-7d50-4921-bdc5-15ec44cd30cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679071696, "uuid": "c8652114-fc16-4d4a-bc52-ad2704853665", "value": "f9d7f070931cf2b2e0b486d8d50c5b9b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00ed0088-c496-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679038405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038405, "uuid": "a8dc3444-c775-4a7b-87c2-e519283af861", "comment": "Malware payload (Mirai)", "value": "6b5a3bc7121336c41b61f5297da8f93c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038405, "uuid": "474f44e1-53d3-4340-b07e-95db419369e6", "comment": "Malware payload (Mirai)", "value": "94539b738cebd69d62e1cb3b2b53a6b84e1933e74179e2faf296b7aa5051b52c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038405, "uuid": "3bc8220c-9583-4ee7-8316-467873d722fe", "comment": "Malware payload (Mirai)", "value": "e065007441d00a858fb5c2fe53341c13ab2f812f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038405, "uuid": "cf3b67e0-5980-4b6d-838b-8bde6ab88be2", "comment": "Malware payload (Mirai)", "value": "34eab0d15203cf75fed5ecd0be61cfd8138838d79a820c4a5553ab399c813596d767ffdad16faa68cfd6cff84e748d43", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038405, "uuid": "97bb77e8-2cc3-4e8c-9961-b73c042627c5", "value": "T197C3C63B67170E23C0CA50B101E34332AE75DE9B34B952D7AAD07D686F36A843856BD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038405, "uuid": "173bf49b-6de7-4ae1-8e24-f5260c00d6f4", "value": "3072:wsrp9xV+GZTZepNPhj+e3fSqP+L7ymm/QMurB1nKGNb:SMQplV+amm/QMurB1nKGNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679038405, "uuid": "2e1f0013-9e80-492d-b694-ba33805295b8", "value": 129856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679038405, "uuid": "43e3bb7c-7316-47c2-9fc0-032b87199772", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038405, "uuid": "ef9cd8a1-03c4-4cef-b8dc-63ddc9e9eb98", "value": "6b5a3bc7121336c41b61f5297da8f93c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d13f00dc-c4aa-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679047345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679047345, "uuid": "7aa61fd5-4985-4ebb-93cb-38e71b3d9d0b", "comment": "Malware payload (Mirai)", "value": "3e07eb641db5dd8196c79b3f7d87b3c3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679047345, "uuid": "2f799849-3dae-45f9-afc5-15c44ef007f4", "comment": "Malware payload (Mirai)", "value": "95f312bcbe88e0404ebf829e99b82a638a80e37c5eacee2ff53006815192044c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679047345, "uuid": "c8c5899b-568b-458c-a497-58e81f797a9f", "comment": "Malware payload (Mirai)", "value": "6fff83fb7411bf8466b808bd2337de336ad0cfad", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679047345, "uuid": "c389a874-5f20-4018-a083-fef073578bae", "comment": "Malware payload (Mirai)", "value": "80a608c2783e7c2ab21a877e458fca3b226702d8b32316079b8b146607708916fea5894a0660e8e550a5523b15498b9c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679047345, "uuid": "d0107901-9743-492f-851a-e6648218a649", "value": "T166E3A53E7A11AFBEE168827107F29F70CF9529D326A19381E26CF6185E7118D0C9EB54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679047345, "uuid": "ea754077-4485-46fe-9f96-8803237c73ff", "value": "3072:JW6dm9tS1aRGQdK76t/zCVI5mrThPaLEnvPrNb:c6IG+LCKmrThPaLEnvPrNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679047345, "uuid": "bb1f9e67-7261-4ef1-997a-193e397b9b4d", "value": 155428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679047345, "uuid": "8eb8fcf9-1226-49d1-9b3d-446c5318389d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679047345, "uuid": "c1ed6901-bb35-45fe-8965-63e89bc4c96a", "value": "3e07eb641db5dd8196c79b3f7d87b3c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5da9ab32-c497-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1679038990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038990, "uuid": "e32dd0bf-fa3c-49b3-8d93-36365a339a8c", "comment": "Malware payload (Heodo)", "value": "a7f5b9a4f10f00bdee8ee343c02a0725", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038990, "uuid": "b2568b0e-f1f3-4809-a43c-94df22d6dea1", "comment": "Malware payload (Heodo)", "value": "96a8affe3734bf526a0d2df69ec660e6fd3299f2e6ae2d1a971d4c37832ead9c", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038990, "uuid": "06f584b5-9074-4cba-9ecd-6793b056dec0", "comment": "Malware payload (Heodo)", "value": "f3b28162958c4adfb3a33d9b2d00505c83b7b03e", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038990, "uuid": "59b7f8ad-62d5-4ee4-a33f-a384f55e1e7f", "comment": "Malware payload (Heodo)", "value": "1225734bb8e59eb0032899912d281df9f878605e05ef57c16f2a060350d9ad2270ab209803838519083cc040f32bad41", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038990, "uuid": "40bcca88-4f47-475a-b298-0c7d33767fee", "value": "T146C32BF1A8025C0AE123C976B1FB661399D051ED42283B2BF87D507DD978A20D6DD8EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038990, "uuid": "2c50296c-7630-413b-8111-bc3171e58ba3", "value": "1536:RDBoTVdaeNtuXndCrJJmT4HVnteV4FrdMiYcx7bfCb6HPdnXq:1BoC+tCYvSMVnte8ZP1Y6Ja", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679038990, "uuid": "93f5c118-c2d2-4a4a-a526-c748ae633363", "value": 120428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679038990, "uuid": "fa51aa8f-b269-4d9e-a4e5-14cc57491930", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038990, "uuid": "c5c95972-c600-4301-aae9-7674b7c5a573", "value": "OPAST GROUP.one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a47ede0-c4ba-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679054098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679054098, "uuid": "4a0f64a3-f69c-4c4b-aa42-070e49cdce21", "comment": "Malware payload (AgentTesla)", "value": "d1399aaabd8c5ae0e687e148e7708498", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679054098, "uuid": "0f3141c0-2761-4cf3-82d2-2b418ee595c6", "comment": "Malware payload (AgentTesla)", "value": "96dc07c4fc7b8ad2d15f5886dd7c59b7b3ef0a393b2a8605fa3e7e4966a5cbf9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679054098, "uuid": "c600d047-0634-409c-bbcf-e4b56d244424", "comment": "Malware payload (AgentTesla)", "value": "74b155b196a1b82416f2b5e196c55d76ee047b4e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679054098, "uuid": "7482d638-0a12-47c8-af04-6e33f8a73b24", "comment": "Malware payload (AgentTesla)", "value": "98da80c3eeccd4a2e1bec0a368e0b14024f99985faabb695547e24725c293cdce88ae598d1c7af53d187e7e1db15eb36", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679054098, "uuid": "357c1116-2ae0-4650-8926-63c2ffd663dc", "value": "T11135AD88F644EBA0DD299BB96536CC3143636DAEA934E15C1CDE3DEB3BB7B920011447", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679054098, "uuid": "93f5a546-020a-40e3-8b78-17a6e69802d3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679054098, "uuid": "0545021c-5891-4992-8904-fe913f3b7744", "value": "24576:W/jkj+gMWKS0KgvGo9xCEWdrZY3kKzAFlb3w1q:W/jkCSPgeo9AEWszs5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679054098, "uuid": "9f9ae032-176d-435f-8cd9-74539ef7fa1a", "value": 1068032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679054098, "uuid": "852991e7-496e-497d-819f-9261caa37d1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679054098, "uuid": "a3c7c11f-dedf-4014-90bd-8451f7d8c4df", "value": "DHL PO1001910 Sample Arrive.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91561e49-c51b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679095771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679095771, "uuid": "063de268-fdad-45cf-be1a-31b8ec0900d8", "comment": "Malware payload (Mirai)", "value": "a396c040c56a9510e78e913a35d9c719", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679095771, "uuid": "0376abfd-929c-4871-ae37-8eb60a1f1a66", "comment": "Malware payload (Mirai)", "value": "96e479c177edf85596fbd3eb235e6d20fbb12de9a4482afe68c07893ee57b5c5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679095771, "uuid": "e4b12079-6f01-48d6-bf38-958348fdd493", "comment": "Malware payload (Mirai)", "value": "e76b7ca1b67dcea37b27ee83934dc4c372007af9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679095771, "uuid": "77899e6e-3168-4524-a37e-05824e66087b", "comment": "Malware payload (Mirai)", "value": "e8c69798ae1e200fac224fd9d8c27b199a6f8282ad922ceed1968ad1c508ade55526101ddfc19a2ba2dce0a37dabbe5d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679095771, "uuid": "acea0a64-39cb-4c97-bbe5-616b18f36fe7", "value": "T14413F89AB8C18F11C5D4127AFA1E018D33131768E3DFB3229E116F647786A7B0E3B916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679095771, "uuid": "b218e1a1-c5fa-48ca-948a-85ca0c4ccb5c", "value": "768:yInuQxnpmaES32dp2S3SCrcboFnor9i5PUsfimk3ZsIb2l3LiRtVY0UjJKi1/VKE:yIn99VESQ2SsoFiiRlzFIwiRtZUjJK1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679095771, "uuid": "93cf3540-22b3-4494-9977-a05d18de0338", "value": 43380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679095771, "uuid": "f776eabf-c7a8-4d71-8e46-4c8a24d50ba7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679095771, "uuid": "435bff7a-1021-4293-8975-68ac490ad4ac", "value": "a396c040c56a9510e78e913a35d9c719", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f80174c4-c4c9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Fabookie)", "timestamp": 1679060724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679060724, "uuid": "ef1f2223-c6ba-4a38-baf3-a77a2a581db8", "comment": "Malware payload (Fabookie)", "value": "c316dc0dfeda91781d2dca0c527795ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679060724, "uuid": "521ff0d5-0e37-4f66-95e9-c94e99100ee0", "comment": "Malware payload (Fabookie)", "value": "96ef9b3ad05b1d5c3d710af88efa9bda7e91da9644d203cf93ef7ec03ca1b8f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679060724, "uuid": "7959de18-735e-4cbc-a470-3f14ba05fbe7", "comment": "Malware payload (Fabookie)", "value": "c52c3125c983b7be45d448060053840ab6e8fbdb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679060724, "uuid": "b5d7a590-41bb-4c3b-8570-3344bf8e63e1", "comment": "Malware payload (Fabookie)", "value": "0ed56e34a69f8aec457cc80aa08606602d9a20c7516b1d0f15e1cbd8334926ab64352cfd9388fe8fbbb7fa882d7ca438", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679060724, "uuid": "3f74838b-1c4d-4038-818f-41e76a786c2f", "value": "T1C0258009BE5E8080CC1156388976D775B7627CA81F2D86EBF197BF2E6F325949C39203", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679060724, "uuid": "14473bab-4d9d-4fd8-a2cf-15951817d003", "value": "7533beb38e834532b23ecbe6c94b2454", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679060724, "uuid": "b6b7c794-6aa9-4870-8c33-7f86ff270315", "value": "12288:hZJc/3ljJaKbZmkWi6dSsA1xsBwLgGLXKPXPiXuHNHGb6bH/zx/GCLW/nh/X:hZMa1iV37LgG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679060724, "uuid": "23e4ad97-aa65-422c-bb43-4d244735c002", "value": 973312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679060724, "uuid": "ab484a28-ad68-4dfe-bd04-0d1077f88ce7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679060724, "uuid": "90e2a4da-9a03-4e2c-a2e8-1347c9642862", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca16194e-c49d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1679041749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679041749, "uuid": "1f9c9db3-383c-47f5-8097-621214e31432", "comment": "Malware payload (Gafgyt)", "value": "680bf726555629fdca39728a88071393", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679041749, "uuid": "fc0c5c76-2fa2-4e61-95fa-f813e7ad8202", "comment": "Malware payload (Gafgyt)", "value": "97d30a4dff0b285e0603fe06e8443c0f12c2e48af49dff1dac9e26fc5bd1871d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679041749, "uuid": "67f3dd01-efc5-45a4-a3e1-cb5703de8079", "comment": "Malware payload (Gafgyt)", "value": "ebec0dedf32deb60e5b2b8a99aff0596c2eaa24a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679041749, "uuid": "5d36eec4-aa39-407a-8b4e-27f256fbcecb", "comment": "Malware payload (Gafgyt)", "value": "cda0ec71adc88220a53429386df8a4c40994f1eafdfcd60eba861f21dc1e7805dc4d112c5218db04a8b0ba48863c26bb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679041749, "uuid": "b5342bae-a6e0-409f-8aeb-56a9fdab6dd5", "value": "T167B31813B7B1DABEC08252B12BDB92F19423FD7D0732622B33957DA51B388D96D59302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679041749, "uuid": "bb063ca5-16cc-49e5-862f-75677fe2bb39", "value": "3072:od0w4SAewzi+Xn+8Uhw6W+aPcJmDk1c8xF6KjW:zfO8IBhJmDk1c8xF6KjW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679041749, "uuid": "9a6ebd0a-cd78-4476-bb81-2d37ee400066", "value": 114825, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679041749, "uuid": "f8db7c1b-6640-464a-8808-b59877e1542f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679041749, "uuid": "13d03dd6-aacc-4565-a7e2-24bbeec047b7", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49028d2f-c4c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1679056995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679056995, "uuid": "6e9729a0-565d-43b3-ab67-99dfe8138210", "comment": "Malware payload (GuLoader)", "value": "06bf8620598b674fc3506a2844d42d65", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679056995, "uuid": "7b5be4a3-f1d8-46f3-8c95-5bdede507879", "comment": "Malware payload (GuLoader)", "value": "98883d7d2678fd8cbdad8b8c1ca7cf13a797b1074f081dee24aba14dcc346ffe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679056995, "uuid": "bf5e2a2d-dc93-451d-b0a5-3a8904478dda", "comment": "Malware payload (GuLoader)", "value": "00e28bd96e338f7bfff9c41d985de05f010d8ea7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679056995, "uuid": "38343e90-475b-46d7-bf38-4deea9b89c2d", "comment": "Malware payload (GuLoader)", "value": "127883ac1c2addc7e704ba6276dfe97d47fd97fec6be67cdf90b39635f1666e39aade2c7636a2ba64e5648ee919dd2e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679056995, "uuid": "98975d6b-cb47-4262-adbf-e5471d52a0f8", "value": "T14C64F14176A1C823FD6A4630CD91E5F3E1BAFE04C828D10773A13FAFB9352858555EBA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679056995, "uuid": "e4a775ec-2c5b-41c1-831a-7797f30b4e8c", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679056995, "uuid": "87da5944-0c3d-4fae-a185-568da84e046a", "value": "6144:iDk/kgv+gAz2TU8tpVy+cofgwCNW8J++jMJnq2UroIbvt:ztD42TU8DdcjNFJgJnqbrh1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679056995, "uuid": "119a9d3c-f140-45a9-abfe-dcc7ab0d83c5", "value": 329072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679056995, "uuid": "283ec10d-c5ef-4102-86b8-cb3bc99a22a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679056995, "uuid": "3928b50e-c665-4c24-a3b7-b0c0616c6899", "value": "ePAY-Advice_Rf[UC7749879100].exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ede114d4-c4ae-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679049111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679049111, "uuid": "86301d8f-5f27-4dd8-abb1-931e75dcd39b", "comment": "Malware payload (Mirai)", "value": "03a1ab6438bd8d567df5dcf395e25b16", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679049111, "uuid": "b5af2778-8633-4bfa-bd45-53f5d7b3ed2a", "comment": "Malware payload (Mirai)", "value": "98b7d0a8507de507808a98cb0f04d0311e657c746b45e37b2445d53efcdaaf38", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679049111, "uuid": "849d55c9-393b-4453-80d6-5d214a830196", "comment": "Malware payload (Mirai)", "value": "28a73869cb322b7d063b4f3acab35436cf0ded87", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679049111, "uuid": "8f94f764-0702-4d44-bdb8-2d8a628352dd", "comment": "Malware payload (Mirai)", "value": "3fa3b7ddef82d0a54221b448a8de6b792291177bc5338a6000046f2c1b2308eb9ccbead2796867584cc72ef02976a01c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679049111, "uuid": "52d7e204-361b-45a4-a05a-f359db789588", "value": "T14A539FA5C5ACAE58C71441B8B654CD398723F408A5A76EFBD646C796800BEFCF0187F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679049111, "uuid": "39e4ec68-fb24-4db7-a93f-c87f0d2f214d", "value": "1536:PaAtVnz1/mUUNztiYmW6ihiYLTofs3wfpWIDNEJ7JC7:P/tVz1eUUfwN0T0f+whWONEJ7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679049111, "uuid": "5c851f79-d4c3-4531-b6ae-a8c94c933d11", "value": 63772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679049111, "uuid": "0e57462b-6fa5-4d29-b477-648fbc5273c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679049111, "uuid": "85777c3b-1ce2-4586-833f-9ebe49b1e6f5", "value": "03a1ab6438bd8d567df5dcf395e25b16", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c95e3d71-c49c-11ed-88f6-42010a9c006e", "comment": "Malware payload (SystemBC)", "timestamp": 1679041319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679041319, "uuid": "b705c674-0531-4d33-9960-9c264572fef8", "comment": "Malware payload (SystemBC)", "value": "060ec303e9be45255414096898eb6e5c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679041319, "uuid": "8aa58968-5697-4fa8-8caa-c8730b67c104", "comment": "Malware payload (SystemBC)", "value": "99a8e03d303efb09fa70f48f23cfd65ce56049d6b2e9755d415f0ae14d17530e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679041319, "uuid": "9d058e54-7ee3-44f4-b35f-0249e04c5c8d", "comment": "Malware payload (SystemBC)", "value": "08d4d4d90f2cecc392a68de2b0a34318aaf007a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679041319, "uuid": "324063fb-1363-4fb1-ae78-c92ab8156e96", "comment": "Malware payload (SystemBC)", "value": "f6ad41841bc4e2966f81857280ebf1895c35e769d3c022429d9bd759b7dfb2e05ce258d69c881c85ec18e16495f5267f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679041319, "uuid": "5ed8eb15-3d1e-4d01-8286-c6638c250f4d", "value": "T1749533EE36A255FCE4B29F70CE615E1D2B18605270C684A2DFF434C83BAD2D664BC54B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679041319, "uuid": "ffaa2966-ab55-4200-ae1f-4227f615202e", "value": "a42773291a156d2e19dedb85ed0dd0de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679041319, "uuid": "011d4ee3-6d4a-4c52-ba99-cadbea2cb682", "value": "49152:g2Lc3XgBs4l0z7P0dvA6ueSOz+vLZ27WjF2+qVmojkI:gvGsLHrI21tjFHpojkI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679041319, "uuid": "53e7ef13-2256-4dbd-931f-3113d729c00e", "value": 2057216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679041319, "uuid": "1f2c5c5f-95e8-4cc9-8f32-7321f8cbb238", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679041319, "uuid": "5e623816-75db-4c35-9bdb-b644b3259ac4", "value": "060ec303e9be45255414096898eb6e5c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "375a302e-c4a4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1679044510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044510, "uuid": "479fc10c-0e12-4d9a-8570-ea861c944c56", "comment": "Malware payload (Gafgyt)", "value": "bbb2979e8e5d576d4ece6e3feda19d96", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044510, "uuid": "eab0649d-aa0a-45a5-b504-6f553daa95cb", "comment": "Malware payload (Gafgyt)", "value": "9a4487bbb854b42fc4e1bdaac7bc4c7b153b58b025b8388fa7c3c691e1cb1f92", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044510, "uuid": "96474f95-865b-451b-b3c3-6f7fd2443c87", "comment": "Malware payload (Gafgyt)", "value": "65dd8f15151ffd35011fab0ddabb7939c7518e06", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044510, "uuid": "87e17332-f5d1-466d-a18a-2ac526b528c2", "comment": "Malware payload (Gafgyt)", "value": "679fa96a8cbf1b66a4cd7af72ffc11dcea51c8ddb8324d4945db010a8f0e481f7ff500a3db0d5307f89602368471f8b6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044510, "uuid": "b0813b89-f8d7-4f8f-98a6-a591d14d5182", "value": "T18FD31905F460875BC2D217BAB68A425D37231F7893CB33256A34BEB42FE1B981E79531", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044510, "uuid": "cef39629-3b0d-4cc0-b360-63dd1ec25760", "value": "3072:Sdf+fvEqa9FazYA7IboRhHe391CErktmCQA9FX9aH:ifWEqa9FaNhHe3DrktmCQA9Z9aH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679044510, "uuid": "1cee84d8-4e0c-4a78-80e9-590da3f2cd40", "value": 139585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679044510, "uuid": "2c481f37-be74-4eb2-93a9-0d3cce252f33", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044510, "uuid": "10a24ca5-6cd0-47a8-9325-f54cf1d2f7ac", "value": "bbb2979e8e5d576d4ece6e3feda19d96", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7822ef9-c4a5-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1679045208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045208, "uuid": "9db8bb75-f6e9-45c3-825b-b9e38c77e3bd", "comment": "Malware payload (AsyncRAT)", "value": "3eaca76030647d883ca5c109b43acc76", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045208, "uuid": "5ce6aa44-3772-4ae7-8e0c-b0df98d64cce", "comment": "Malware payload (AsyncRAT)", "value": "9a5d5b0ab46c1e25f4533c74017bf65c2da1ffcf1839b03391ddb2dd09aae609", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045208, "uuid": "c12f87a8-a10f-4ef3-b2e0-d0a64119d3f9", "comment": "Malware payload (AsyncRAT)", "value": "12e7356857095c917a87e2dc55de4a14d753d3c4", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045208, "uuid": "3e2f9eb3-0735-45b8-b42e-31b5444e5196", "comment": "Malware payload (AsyncRAT)", "value": "55915077d96bd9793902aecc102b006398de653abc6f69e084cbf50805d2d04e1ea259f701fccc384b96a88d28d38504", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045208, "uuid": "57372337-603d-4474-aae2-08d9387d20bf", "value": "T17EC1CC015EEF50DBE22707706BEAB27B1666E8B1552E62F870448A589F70BD0CC21FB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045208, "uuid": "77d81f28-bfbf-4c04-9ec2-3894948838b5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045208, "uuid": "9beeb610-1d4c-4c0b-bacf-72043445c7df", "value": "96:Nd79+3CFQ39t6drvk+aWSAYuGsyvk+aIiLvud3ojjrl:X9+yFY9kvkSfYxvkU2udk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679045208, "uuid": "cb7ee6e5-cf13-4087-bfee-4cfa5e414c47", "value": 5632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679045208, "uuid": "054c8274-3db7-4d7a-bb97-d22764a55545", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045208, "uuid": "ff66b975-1735-4dfd-b145-bb7767e6a63a", "value": "3eaca76030647d883ca5c109b43acc76.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00fbda94-c4ab-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679047425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679047425, "uuid": "d0212955-2d41-43c0-923b-0b92157f6f7a", "comment": "Malware payload (Mirai)", "value": "f292ba000c822708f5132199eeb2adf7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679047425, "uuid": "79663641-d84c-4444-85e0-d889418e26da", "comment": "Malware payload (Mirai)", "value": "9a7c2de5a2f36785e347b6e121516c6ec810c8789bc187601c7bbc75282eb1d5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679047425, "uuid": "4e2ca0b8-48b8-408d-a7ff-0dea47a2654c", "comment": "Malware payload (Mirai)", "value": "ffa914c6b252318ccf2031e78bf365ba558a1050", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679047425, "uuid": "157f9b51-4933-470d-8052-c9958654391d", "comment": "Malware payload (Mirai)", "value": "e38f95de5c14aff2c556304df18aa072fa237c9e20bade814d08ada40630166718ba5eae1f609605ccd86fe1db3b6930", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679047425, "uuid": "ca2b84f7-be01-4655-b8a8-069e09268377", "value": "T128E38536B7619E77D81ECE7305A985121C8CD98702D92B6BB2B4E51CEB6BC4F08D3D48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679047425, "uuid": "d6a06e46-b608-4d19-999a-d83329162b25", "value": "3072:dgZc9h1jlnLA2PiXYeyCcgVNMVGuo9mrThPaLEnvPrNb:dd7lnLA2PiIeyZgVWDo9mrThPaLEnvP5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679047425, "uuid": "a2d99002-9674-4005-809a-f70dab417bb1", "value": 155476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679047425, "uuid": "84216b54-dba3-4e20-8a06-fa09c43c5575", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679047425, "uuid": "90ca2378-b6cc-4f43-9768-3ff3b929f290", "value": "f292ba000c822708f5132199eeb2adf7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c48ff7e2-c506-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1679086837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679086837, "uuid": "654faf46-5441-43bf-a13a-a9e1d4d3888e", "comment": "Malware payload (njrat)", "value": "535644d4ec58e7f01017b11b2f446627", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679086837, "uuid": "91704b8d-7c1d-44f9-adf1-c9b0ca340cbb", "comment": "Malware payload (njrat)", "value": "9b21553d8024ff5bd5a445d3c8b1bb0943566ae89754f7b2aec383b9531ddce6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679086837, "uuid": "e9fa23b6-8c9b-4337-b34f-7e892ad11383", "comment": "Malware payload (njrat)", "value": "d47ee3cbedecc205f048c0ab58921eec35343c45", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679086837, "uuid": "ffbf56d6-2159-411e-9ba0-002d824530c9", "comment": "Malware payload (njrat)", "value": "b242fe7f9112bfa87ef55a81cfd582f472f03b247728f486fd55c5b7f8960690aa2915f0eef8fc4ed6584abb3a4d8a6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679086837, "uuid": "fde7240b-68c4-475a-a12d-c72db0f13115", "value": "T108033B4D7FE18168C5FD157B06B2D41207BAE14F6E23D90E8EE264AA37736C18B50AF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679086837, "uuid": "7e22612f-cf61-43e4-a11b-0f446caaa80f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679086837, "uuid": "67ebdf3b-e59f-4dae-856c-fdde3e4117a0", "value": "384:Xpick7sgwi+tx3+j/NSyszg8QPBI3mmbNrAF+rMRTyN/0L+EcoinblneHQM3epzQ:55kQLCNhszg8QeWmZrM+rMRa8NuDOt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679086837, "uuid": "5bcd3272-3d1d-4776-bf2c-2d151d899014", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679086837, "uuid": "94e88993-2c35-4ba0-9731-6c77fb89b68b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679086837, "uuid": "6e5e42dc-92ad-49b5-a863-4464cd25ee2e", "value": "535644d4ec58e7f01017b11b2f446627.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c80600a-c49d-11ed-88f6-42010a9c006e", "comment": "Malware payload (zgRAT)", "timestamp": 1679041673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679041673, "uuid": "d4cfe931-3c9a-4c9f-9aa3-68d98bf7dcaa", "comment": "Malware payload (zgRAT)", "value": "3c4befa78f291b855f09b39eb2c9b663", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679041673, "uuid": "8d7bf632-5ebe-4a0a-b0cb-ce631640fe0a", "comment": "Malware payload (zgRAT)", "value": "9b269029696ccce9b0c7ab6fc2c5ff395faa32341501a3f99fbbf3f9869b8078", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679041673, "uuid": "d71700ae-268b-4a2a-af22-ffbde5322da6", "comment": "Malware payload (zgRAT)", "value": "a88be7a9bd74c6d19d5e4ca5f705a039d6022109", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679041673, "uuid": "915dd0f7-1894-4fa1-8e24-79703bbac50c", "comment": "Malware payload (zgRAT)", "value": "8401062d5a677c86127653b4c97e1bfc7a14b07529b5b966af81268f0cc8a79a10d2608725510a0c5bbfd4db8624b095", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679041673, "uuid": "82ee8d0b-02f7-4273-ad93-01b1d02939c7", "value": "T15E06BEB11BD7EF85E2BF2E70E81424848C64541B56EED348BC852D874ED8798CEC96B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679041673, "uuid": "9e1d71fe-379d-4a91-bf5c-c37bf05c2512", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679041673, "uuid": "83ef11de-4551-4e50-9b6d-b2515c7b1a61", "value": "49152:ImPz3zC5TYs2BCEG2xwXMLwLXKo6MMbLy2V4Ofa:/E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679041673, "uuid": "4a060728-9e66-4978-bc2f-bb4754437563", "value": 3764224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679041673, "uuid": "6b204726-61dc-4a82-bd1c-877b9f187915", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679041673, "uuid": "a31b9f2a-a85b-46dd-ab4a-96efa0dc2fae", "value": "3c4befa78f291b855f09b39eb2c9b663.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55cea8b8-c4f6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679079779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079779, "uuid": "081d842f-5217-4143-90b1-595822bf3191", "comment": "Malware payload", "value": "4c3dbb7dce79a608b7a70950048269ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079779, "uuid": "43ec4934-643e-4c30-b083-35b44d212dee", "comment": "Malware payload", "value": "9b6cf78552cbf1c9f7a20b73c7c3f98a6d894ecc40331b82b6ca1f42ae5dc672", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079779, "uuid": "9989ba83-e3b4-4fb4-b6d1-0096d2c5b24e", "comment": "Malware payload", "value": "84b0169fdc6538538a9c8a2c0341a4f7986a9e7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079779, "uuid": "6be033dd-03d9-49c7-9fde-5b9e5c91b113", "comment": "Malware payload", "value": "312f630d21d4e51da4217edf82962e79f11d78ea0e00be7aa57cc7a4bb0ca7709afb8580fba28fa8280e489ec30a515c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079779, "uuid": "563a2729-8f14-41ca-8676-61fd5780f35d", "value": "T165D5230382927C89E5924B72DE1FC2D8331DF6918F9F7B6632159A2F14B21B2D133E91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079779, "uuid": "3d50b848-b417-4792-869d-9f69bf9910c2", "value": "967eb4f66af509da0d8ad27d2261daaf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079779, "uuid": "14662a12-e29f-43f3-8fb1-647da4dad7e4", "value": "49152:RsxsyS+VgeK3Jav1d3IGePGkTiqCRz0zMKEb/oGjJvsgbXWXUp7NkmDPElfrFvyZ:Rosy4e+8vheZ7CRz02/I4GXU5Ej9yL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679079779, "uuid": "50f29fd8-e34d-48df-8efc-a5dab970aece", "value": 2787840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679079779, "uuid": "92fbbe28-25fb-437b-b1d2-a7fb07bc9043", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079779, "uuid": "17ca1849-fdde-4f1d-a22c-3c9045a117ee", "value": "4c3dbb7dce79a608b7a70950048269ff.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f42bb0c-c4bd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679055287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679055287, "uuid": "803b2c7f-f16d-4fee-b301-e547772ec5b0", "comment": "Malware payload (Mirai)", "value": "5629b20e56b40316085fb370bf1587e7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679055287, "uuid": "e7b403f1-4e10-47a0-b298-d5f751ab719a", "comment": "Malware payload (Mirai)", "value": "9be307a5fbf92562fd85a0297f9e86ab2a9a301efdfbf17d02b4184821fed8f8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679055287, "uuid": "9bfa18aa-09f5-4fa3-8d09-19ae584086ad", "comment": "Malware payload (Mirai)", "value": "84dcc9e19d2415a4f78de07a0f2d29a2759f3892", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679055287, "uuid": "94f9b923-cbd2-469c-9266-6854157bd9b3", "comment": "Malware payload (Mirai)", "value": "dc7f16ba3614b72cec9dc63d25b7241e989d5b8e5d79a8b5364c3611362ae868b925ae7e6f87585d1df731e57caba673", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679055287, "uuid": "066e207c-24e9-46fa-8637-f44f5c2f801a", "value": "T1D1934C27F552C67BC08752B42BDBEA615833B4BC0B32720B73E47DA52B259C91E6DB01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679055287, "uuid": "1a5e8226-186d-4d0d-8115-b9e972a9e68d", "value": "1536:W7uJtxsVkeV7aDlvhE1hmkJ0S36W6bWjK3BjZmA+KWOXFseaZYxe:4SsVkeVslpmXJ0O6WpjKxlm/KWOXF7aR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679055287, "uuid": "c11aeeb5-b535-468f-83cd-6f663cc2a849", "value": 94676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679055287, "uuid": "0101281f-496d-451d-915e-235dc86fabe1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679055287, "uuid": "6f2ffccf-2e68-42e8-8efd-513b37ea88ae", "value": "x-8.6-.AXIS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b36f4d9-c473-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679023551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679023551, "uuid": "ce6de58c-1b5b-4982-ba9f-5b2214cdfe74", "comment": "Malware payload (Mirai)", "value": "6909b91deb6d5bbd17bd9e73d16e9892", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679023551, "uuid": "6b675ca0-ff03-459f-978a-ee1e4e4fb9ac", "comment": "Malware payload (Mirai)", "value": "9c266951f28a916820ba93180204fe0c1e5dded4a4c04cf4245d1719da4518a3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679023551, "uuid": "9e103be3-e534-4383-956b-3dd30b8db322", "comment": "Malware payload (Mirai)", "value": "4b360d1918ed78b3df718d0ba0e73f3ba4098df2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679023551, "uuid": "25069c59-ffd5-4539-b9c2-f7c5e6f5de7d", "comment": "Malware payload (Mirai)", "value": "cb13aed45451e40d60fb7a447aa46bfcb7dac4b76c1fe56eb4657f1ede74e1596a94f2c4b019094c4f4ddbe921aa5e60", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679023551, "uuid": "437fd9a0-0711-4ce8-940b-1a96708f29b8", "value": "T19682D025319B34B1CBF14835D66ECAC56B020BFCC2FC36D32749AB39D90640995BE2DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679023551, "uuid": "9ffb6db5-56fe-4276-94f1-ced05e6913ed", "value": "384:MjlzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtU5hKn3b3NeIhymdGUop5h5ld:6/V0P6+kom0tVAoNvm+tQhK3b9js3Uov", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679023551, "uuid": "af494dd3-c67d-49fe-9998-14944cb01422", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679023551, "uuid": "6dd42a09-88cd-4dbd-bf1a-c6c90b3a6ec5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679023551, "uuid": "10480e93-7b61-4f7e-911f-c9b83a85e320", "value": "6909b91deb6d5bbd17bd9e73d16e9892", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da33d5c5-c4aa-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679047360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679047360, "uuid": "6bb0486f-a5ad-42ca-b1ac-e2bdbda5d1a6", "comment": "Malware payload (Mirai)", "value": "f36a9ac89202b41c4ced43eeaa31477e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679047360, "uuid": "c7b706f0-e20e-4560-8274-628727bad889", "comment": "Malware payload (Mirai)", "value": "9c6d810354531b649d79a571a0ee23fe2eb861c7e2b3f00a046976647d38cb6a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679047360, "uuid": "c6f792bb-542f-4aea-85fd-c182e2043c71", "comment": "Malware payload (Mirai)", "value": "7ebc885ea2c0e6c913830027d67fe0ded0a54dee", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679047360, "uuid": "ae5f6438-dbbb-465a-ae9f-25a6fa61c90f", "comment": "Malware payload (Mirai)", "value": "d95db20f2fef621cf15629e97fa6e86521c8f9378b5e7169373fa122e987b0621b717aa80a96006d1241c9b7dddd2f12", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679047360, "uuid": "3cafc06d-9b47-48bd-aac5-c2d7b8803bc5", "value": "T17EE39D35C4A9A8D8C4A94634F9D889355B21B24842B32DF3ABD785B5048BEF8F504BF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679047360, "uuid": "5cbc423e-1139-44be-8075-a6a877deaac3", "value": "3072:AdgU80gb8Rmd/Ib3wg8f3MlYilDjIgQ/jf+MNo52VizHemIw:AdgigieIb3wg8f3jiK/jo8KHemI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679047360, "uuid": "8874e0d3-3410-4b4d-b35d-59d80f426321", "value": 144700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679047360, "uuid": "e2619a2c-9726-43fb-8504-5504a3290f96", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679047360, "uuid": "6fadad3f-fdc0-4cd9-85ac-e85d02dbf3f6", "value": "f36a9ac89202b41c4ced43eeaa31477e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fceeeacf-c4db-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679068463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679068463, "uuid": "200303ce-8154-4eb0-820c-f74d392ebf5a", "comment": "Malware payload (Smoke Loader)", "value": "5de59fef8675abeed24db139af0853bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679068463, "uuid": "130b80b2-0cdf-4926-9831-7794fa72f900", "comment": "Malware payload (Smoke Loader)", "value": "9cb4357e2a87559617f3adfcdcfe5dba5f02de53d9d7acd8cc5415bbab703e65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679068463, "uuid": "0a49e6b6-9964-45b1-a34b-333cc7ac063b", "comment": "Malware payload (Smoke Loader)", "value": "be73d3cef96fb50a6e168510805740b51016ca77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679068463, "uuid": "c4f1e2c1-8af6-4d7b-be39-0f12f19ebeae", "comment": "Malware payload (Smoke Loader)", "value": "ad9110445ec46649df66cb56fb46286ede889caaaa907ec6604c0195a5e6e7849fe305f46d7959341d5690274a77de75", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679068463, "uuid": "884288f0-5d9d-4ecf-8443-2847ec0e333b", "value": "T19354284396E17C50EA268B33AE1FC6E8761DF6618F497BB5321CEE1F06B0172D163612", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679068463, "uuid": "6599c802-fd6e-4eff-a00e-3714a6d1395c", "value": "48e7bdebf7b90ec755513d967cfa38a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679068463, "uuid": "bb87940b-cb16-4ac5-8bab-0a17f1a38341", "value": "3072:8wrjwHLJ2W6Hq//BgWDWwh1UGMEPFtpfRf1/5/Es6n60WI3cp8c:XwHLJf6yGmVaNEzFZ15EQHp8c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679068463, "uuid": "7237adb7-a72a-4763-9741-3f0e197e79b3", "value": 302592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679068463, "uuid": "a2bb4f9d-31f1-4f3f-b30d-633ad26735ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679068463, "uuid": "13a700b9-a2f9-4c0d-896a-afaa7a237e49", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "466b07e7-c4a9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679046682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679046682, "uuid": "a3c0fe0b-ac90-404e-98f9-f8a045df0d7a", "comment": "Malware payload (Mirai)", "value": "c83f5b03b6f8eaf7460c83c3cc3ae0f8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679046682, "uuid": "5bbc3ad6-4c37-45d5-a6b3-972ec085936d", "comment": "Malware payload (Mirai)", "value": "9d34fddc1b244fabb218ec349278ba4363647403a3976077ef4ab29f94a00e6d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679046682, "uuid": "66df26e1-c04d-466d-b89d-382332451d62", "comment": "Malware payload (Mirai)", "value": "ebb57d2a6b51123cc144114cee0200a8d806aef7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679046682, "uuid": "79eb4837-00f2-4a98-a5d3-471db7c06aad", "comment": "Malware payload (Mirai)", "value": "1ac67be90a3a9a99ea87833b5a0375ca367bfff46785f436639ab557bba2971403c1d8d41e6bf0925fbc79ba255e5654", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679046682, "uuid": "f1fecc76-805a-4a8e-a710-d8b03488f8da", "value": "T1E4436BC4F643D8F5EC8705702077FB379B72E1E922A8D647D3B4D932AC52651E606A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679046682, "uuid": "282569c4-94ad-4e26-ad0a-59e48af79b84", "value": "1536:JeESt/basV2rcZhG6ySN7na65lSR9zWOIaEjrqMHs:JeESt/basVTgS7na65QRVtXESo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679046682, "uuid": "82a48492-d404-49a4-bbf3-35fc086b1e48", "value": 55632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679046682, "uuid": "b6a976d2-071d-4cc3-96fc-012ea9b6d7fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679046682, "uuid": "069c3be8-1dd6-4e40-a2ad-73e8104a523f", "value": "c83f5b03b6f8eaf7460c83c3cc3ae0f8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bf5b29d-c497-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1679039014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679039014, "uuid": "f3a949e0-707a-4460-85cf-628ab6e99e85", "comment": "Malware payload (Loki)", "value": "4da2247af2a1dd3ae7be8efe9970dfb6", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679039014, "uuid": "0546a05f-f189-406e-877f-af57d4bbeb6f", "comment": "Malware payload (Loki)", "value": "9d51721a968f724d9568c98e4bc6315819254a6da619ac3a16fc0e2f9feb78dd", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679039014, "uuid": "a4a35700-86b3-40a4-b6de-119e930d2a0a", "comment": "Malware payload (Loki)", "value": "bdbd14b8edade9d7ef9242ecb3e54c0c0a318984", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679039014, "uuid": "1e56fa2e-51bf-4b01-b93b-bd8a17f0ba75", "comment": "Malware payload (Loki)", "value": "e3797b47277082ac31ff3308c5a0c418b429ad628efc263e8be11614611caf07a0eba6b2fa6386e6431ef4695e6314b9", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679039014, "uuid": "52bf0b18-32ef-412f-96ac-fff58a0c6561", "value": "T18045011FB244DF4AC5068BB8AE17F9D8020D7D64BBD4B1873681771F2E321A65AC72C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679039014, "uuid": "338c29eb-273a-46fe-a44a-2efb1cfa7b9d", "value": "24576:OLKcWQmmav30xgH9PH9ZCaixfCbY+kgGfey6aPKE:OLKxQmmQ30RvCbBGfZ6az", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679039014, "uuid": "0d8031a6-1e4a-433e-bac1-d6f9a57eaf7c", "value": 1224192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679039014, "uuid": "3e6e8748-b77d-4bbc-b056-ac84c233c0cc", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679039014, "uuid": "4d6d5fbb-68bb-4e86-a949-99f52a844fa9", "value": "QUOTATION FORM_#MV. CHIANG LAAN TRADER_1.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4562174d-c4a6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1679045392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045392, "uuid": "b73df91c-c28c-4e95-9acd-47489d28b2af", "comment": "Malware payload (Gafgyt)", "value": "e5b3b7e39265a93ca37d624a164881a5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045392, "uuid": "404cd588-b9a4-4e4b-872f-bf27c0ae06ab", "comment": "Malware payload (Gafgyt)", "value": "9d86b4afa8db290589c8c4230dc1d0f493d72e8e70e3134f0d445b0754725000", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045392, "uuid": "eb6a8fa8-e1e5-4aee-94b2-806ab9e10395", "comment": "Malware payload (Gafgyt)", "value": "f486eb5d1097b80a38ddd10c6d452875e2bc9cec", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045392, "uuid": "89e0d1c5-df9e-470d-b975-50d390c37ec5", "comment": "Malware payload (Gafgyt)", "value": "a2f0f58f5cfad15857d1761bdf0b9d5146d293165a2d83ab32bbe96fce9045522c22d93ade47037f591716aaed8b8b94", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045392, "uuid": "a7584ba4-fa01-47cb-bf6c-7455666323ef", "value": "T17B13F121BC84DCA0F0C01AB82EA6EC1EF5570B6C648B32162769863DEF57445F7FA593", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045392, "uuid": "34023d98-7165-4517-b35b-d1cfb4ab059a", "value": "768:BIObBN09gGi4CpACTFbozXObO2Dkk7jQMYbct3U+NV2KgA7Zr:BISBNQg1prTF0z+F4kX/UMV2KgA7Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679045392, "uuid": "e75612bd-6b20-41b4-8114-e5c8ddfe6808", "value": 42412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679045392, "uuid": "057c2689-fc45-4cf1-918f-e46ba21f59cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045392, "uuid": "bf7974f9-cc15-43d2-aa4f-f14260bf0e00", "value": "e5b3b7e39265a93ca37d624a164881a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b0c3591-c45a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679012679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679012679, "uuid": "70fa7696-e62b-406d-836f-a0aafa5c6107", "comment": "Malware payload (Mirai)", "value": "69973778d52202f50b8ff397c2b03875", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679012679, "uuid": "7ee188ad-83dc-4f0e-be93-93aa59996017", "comment": "Malware payload (Mirai)", "value": "9d994230bbc5393aba4d9e99e7a3ee185ba0585104895923956290a1e748cc20", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679012679, "uuid": "cb1e34bf-957e-4175-99f8-8e0fe36ad5f8", "comment": "Malware payload (Mirai)", "value": "6c34f6be5232950b9ed06de33df0e47befc57a3e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679012679, "uuid": "251fb868-d47d-4187-897a-1d1304d78d55", "comment": "Malware payload (Mirai)", "value": "62ceac98b3f548301746e7ee02013e5e0b234d8f93ba3d1cf4041aba9c726acfaede784d8d6e3dde238f54225a15bacc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679012679, "uuid": "37b6ef30-5282-4bcc-a783-3978abdf0299", "value": "T1D103E00CE6F9B844CC553DF8A41F0FBA8D1225B0779E4FEC9345C456E8A97C2791A438", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679012679, "uuid": "7c76d09e-67e7-49fe-8b77-52552c4ee716", "value": "768:wgE4zJigqMykrmZU/9tFNnCHMhpAQsE+bKouco8BIHT1uLrwrPWx:wd4zlqMsZU2MDflJi28rqU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679012679, "uuid": "2cfe8a72-dcfc-4912-a00b-fc12669f4121", "value": 38320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679012679, "uuid": "6b79f067-ad6a-4443-a757-63a03c673cbf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679012679, "uuid": "8c192a43-4b9f-40dc-acda-b63cac06642e", "value": "bok.mpsl-20230317-0024", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81c339cc-c47b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Chaos)", "timestamp": 1679027025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679027025, "uuid": "6a50c8fa-782e-42de-8858-4b4d9835cd7f", "comment": "Malware payload (Chaos)", "value": "88a65f4208e3527decd4128072084dd8", "object_relation": "md5", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679027025, "uuid": "bb359f85-b910-475b-bb96-bf033f345bbf", "comment": "Malware payload (Chaos)", "value": "9dab6749bdeef4e92502efed4e21f46f8590b7534d01b93576a63f4ac1e77851", "object_relation": "sha256", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679027025, "uuid": "8a8398bf-131b-46a6-ad70-0c4212fe6c4f", "comment": "Malware payload (Chaos)", "value": "aff3a50149617b1d84544e58a7f08baf06ac6473", "object_relation": "sha1", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679027025, "uuid": "565e6a1e-497d-4f01-9384-2b2fc23fe1e6", "comment": "Malware payload (Chaos)", "value": "e372db42094c959d160fa549300925f1c1dc20958956468b84435d7e7364f58604f48b5f08eaa4000d80b70a8cfebac4", "object_relation": "sha3-384", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679027025, "uuid": "90c18b56-d2d3-4b18-a62f-4ae7820f7874", "value": "T14F34CF342EFA502AF1B3EE7D9BE4759A955EB7A33707885D20B1038A0723943DDC153A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679027025, "uuid": "6957a933-97af-4e5a-8393-83d9bce93fa5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679027025, "uuid": "6e50200c-8bf9-4eb6-a548-a55d30405d06", "value": "3072:moKYar96VL9z3+wdSe1WcBRjpW5VFMNBDf5qIS/QWqGiUEJhREVUAISsdWBYf7Dx:qr9GLhxhdsVFGEeRJk8nrKfQ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679027025, "uuid": "a89bf54d-db73-4f91-b6e6-ecf89b151d9d", "value": 244224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679027025, "uuid": "bd65cce4-ed67-4217-bf06-f7e855535421", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679027025, "uuid": "073b8616-e8b2-4b10-86a6-ff63f81ed38c", "value": "2023-03-16_88a65f4208e3527decd4128072084dd8_wannacry", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d797e1f1-c4d9-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679067542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679067542, "uuid": "ef6b7615-a67e-4e3c-a9f5-8a72e4114b1a", "comment": "Malware payload (RedLineStealer)", "value": "5524bff303865946e93c25175328898e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679067542, "uuid": "5fdc57dc-1b62-4f8e-b252-b381daa12b78", "comment": "Malware payload (RedLineStealer)", "value": "9e18904bdc8ba6ceba052813c85295e96223569c766a4d35f4dc34ebfd97d6a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679067542, "uuid": "dacfa233-aefe-4de3-a03d-5df80aadd7ba", "comment": "Malware payload (RedLineStealer)", "value": "9799329e0e7629f25310705537f86c2b881988b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679067542, "uuid": "4d7c3709-b4a5-466e-b403-98000c14714f", "comment": "Malware payload (RedLineStealer)", "value": "2ebfe6aaf042b6dc9832c9a8f615432fe992085577701a974e20f256e9f57cf4cefd0f89bc035dbcf5bbe74bdefcde08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679067542, "uuid": "66fd7501-b076-433b-9da4-f80d7d4bd029", "value": "T16D450153A2917C4CF9268B7A9F1FC6EC771EB6608E49776931189A1F04B21B3C163F90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679067542, "uuid": "bbfdee45-2e23-4eeb-8d02-f1b4e5753f90", "value": "6e76b494f1a9946f83b6b72033f310be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679067542, "uuid": "8f63d253-e679-49a1-925b-6ebc9f529bf4", "value": "24576:euqnfwrbaCEihi1J5hMyHeFaH4pTOh9asj0bWcT9pyKBH:e/4rbF2MyHeFaiOh5cp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679067542, "uuid": "0a327e40-f63c-4b91-bfda-c03e666c1a54", "value": 1235968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679067542, "uuid": "5fc73d5f-dcf1-4809-8dd6-630ff5e58319", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679067542, "uuid": "209af5a3-9af4-4510-8641-e30d97c53cc4", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9023f22-c4c9-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1679060726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679060726, "uuid": "91df00b1-8451-4fcf-a8e1-04d44b78835c", "comment": "Malware payload (CoinMiner)", "value": "64b76b6eb0cefdeee6cdbbc7e19da59f", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679060726, "uuid": "438634d3-cfa1-4b26-ac62-85c6bf8a22cd", "comment": "Malware payload (CoinMiner)", "value": "9f2e5707c600da27affb9f9219ca42c61b3a2729b693417c42d7baf599526306", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679060726, "uuid": "3a9bc0d1-6e4b-4ae1-b13b-9a490eb311b5", "comment": "Malware payload (CoinMiner)", "value": "47b8a64967efddee6b60641435426484d1027b72", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679060726, "uuid": "2a8187fe-ad88-4216-863b-1c5f8904a0fa", "comment": "Malware payload (CoinMiner)", "value": "69cd2200e34fda92c38547c4d66095dd2c662a580ff343a3c2521b819e2ee5f76073babf51c1e8a3a4d74e6aedd21e41", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679060726, "uuid": "09d0cd9c-fbe8-44cb-b125-e62c80b38ebd", "value": "T174562329ABD4492BE5EE23B8B85196E4A370AD9D7C07EB071C453CDD6E763880D831D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679060726, "uuid": "f356a5ff-39bb-499d-be5e-663016d9d0c5", "value": "98304:jbdIm7f3IdBwZkjLJkoFnfpmbeJ/LobSPew1AOiJUAAkXBixIKpPe0j+rrLmvn9k:lIm7IGmJkoFUbbaAOiJMkXBiqyerHmv0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679060726, "uuid": "712770ec-f8d6-4764-9762-6a27adee5351", "value": 6237184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679060726, "uuid": "8073a165-d5be-4982-bfdd-d2a0ac1b6568", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679060726, "uuid": "d2b9e630-d931-40a5-a935-58c539e533e9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "732386e7-c4a6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1679045469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045469, "uuid": "48b123df-a295-49b8-bc6a-883cabc621a0", "comment": "Malware payload (Gafgyt)", "value": "43fa95d09cbfddef58971ff7495167d8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045469, "uuid": "3d4ca7ff-6f02-4d0b-ad28-bc8908829b5f", "comment": "Malware payload (Gafgyt)", "value": "9f5fd899a95a98084418212249f4fc3baddba87c547c13243fceb66446ccdcd2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045469, "uuid": "78e08f9d-1804-4c4f-a0b9-1a6e48094cfa", "comment": "Malware payload (Gafgyt)", "value": "2182f33204a9ea4cfbd29af147f355d88a05c63f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045469, "uuid": "94b31fa8-f830-4dae-a24b-36b65a369b34", "comment": "Malware payload (Gafgyt)", "value": "c3497cd941ae5e72573047ddd654cb0cac832a231022ee9db15be40fbd577e95811f2b22320856c7ec214a00ef6cf96c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045469, "uuid": "a4ec5af7-8c8e-46f8-a67b-f7d0b19bf7cf", "value": "T1F513F192B2DF7063D4AE0CF5A679010D5BC24EB8E2F3256A3BBE073495F24562DA90C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045469, "uuid": "dfce3c45-561b-47f2-9ef0-253473ac6866", "value": "768:lfL9Ccmukey7iGUWUBRictspY+pxueczDhuX10EEW3UGEvi11f5ARS3jUHdAWh:BJCcmPeywecOfp4/RuX10Hnvi1BIHdAE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679045469, "uuid": "4f319177-e9e7-4089-8dce-856d856e1ad7", "value": 44676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679045469, "uuid": "6b7f8ab8-90ca-4ac8-af01-c60158619c4d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045469, "uuid": "9a0cd5a9-2a1c-4933-8f89-025b6d60d05c", "value": "43fa95d09cbfddef58971ff7495167d8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c75e966a-c49c-11ed-88f6-42010a9c006e", "comment": "Malware payload (SystemBC)", "timestamp": 1679041315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679041315, "uuid": "676c3043-cf64-429d-a15f-d9c1de5e66c6", "comment": "Malware payload (SystemBC)", "value": "632a0af14d18fc2fefa2d7cd110b0068", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679041315, "uuid": "1870da0b-3746-4a09-9bde-9a827066caea", "comment": "Malware payload (SystemBC)", "value": "9f68f42e1d73a2c01282f85f4fd2dc88efa3ea5c3b86e19a134ccbbcc7afb536", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679041315, "uuid": "94ff5d45-43b6-454f-b416-ec7cabb50e3f", "comment": "Malware payload (SystemBC)", "value": "b38adc8bb6ad4ce5f50a0880c86eddb82e096eed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679041315, "uuid": "b9bfe992-e713-407c-959e-1d45ad039488", "comment": "Malware payload (SystemBC)", "value": "87f41d63471c7c0ed5f498b3239709d9e0b6c189c3ed09fe146ff0b171e7de883b1fae21fbbdc3df881161e90d1dfe60", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679041315, "uuid": "0a96715d-7a56-4476-9f17-613684755165", "value": "T14E52099775618DA6C016C6B03EAFA720D4BE617515399039EFF00E24773EA63DB2221F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679041315, "uuid": "3460621f-81d8-4d44-a78b-332eeecf0648", "value": "801793b2be29822524e8824fc3c47535", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679041315, "uuid": "ba09bae0-77d4-4fde-b329-faf149a3ed4e", "value": "192:C2WjQTbZ1eBppvfj/j2+cPM3P+Q/tCvwSw3uM76V9bdOkrUN:C2jTbZ0pj/vcqP+ctCYSw3GV9btrUN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679041315, "uuid": "4a2fe978-4fc7-4630-8c37-a1479686e360", "value": 13824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679041315, "uuid": "21dc3ff5-44f9-40a4-9d69-225d9697bfeb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679041315, "uuid": "78bc01bb-72fc-4bee-b966-6bec07fe227a", "value": "632a0af14d18fc2fefa2d7cd110b0068.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89d18b91-c4f4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679079008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079008, "uuid": "b537bf8d-1570-43ce-a1d8-9b39524e7f8d", "comment": "Malware payload (Mirai)", "value": "286d7cc261ec9f5257bf569b8c65bcbd", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079008, "uuid": "059a3b24-e578-4ad6-be1d-3199fed54781", "comment": "Malware payload (Mirai)", "value": "9f72c037f34d5b4c50b67674080577608d36407e74ecf19c74990da29e990ecb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079008, "uuid": "46bc99bb-0527-4867-87e3-53016b97dc0f", "comment": "Malware payload (Mirai)", "value": "52658598352a1ab008a37424cd9664af9b3bcb3b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079008, "uuid": "a391e62c-273e-45d4-96e8-27ec05687249", "comment": "Malware payload (Mirai)", "value": "8440988d578926b30a25344fcedfcf095668c624db9c6778559abaf0332dc92a168ec7f2a76548a8af464bb013a147ba", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079008, "uuid": "5b6d7ad7-7b37-4d00-871e-e0b1d09ea6c9", "value": "T11D33F1557404B161C6303637E8362193BF491BFFD2D63433066943E8A8E64E37AF6CA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079008, "uuid": "926e9c6d-c7ce-4b2b-b7d1-4b1919b1c42e", "value": "768:/Mte5B4PACtw/YcmRIe18D9q63TxZQbSORe7Su2QJnKE79TLrt359q3UELbOs8qE:/M84ISRX63dZQbS5rzZtcLIVmWj9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679079008, "uuid": "e5a369a4-466d-4ee8-8e13-862fc59b5cfb", "value": 53620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679079008, "uuid": "6b1a20f4-8f75-4e79-92a5-414e58e0192f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079008, "uuid": "bdb200b9-2796-46ac-8173-0596425f8811", "value": "xd.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d75dc71-c4f2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mekotio)", "timestamp": 1679078155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679078155, "uuid": "d46f48c5-68b9-4a40-9c8b-ba0e4528a89a", "comment": "Malware payload (Mekotio)", "value": "9c10a526a73893354ffda1070e3c438f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679078155, "uuid": "8d61f79b-2087-4a50-8b8f-5a11606c8d0c", "comment": "Malware payload (Mekotio)", "value": "9fc52a3f3062b09ef6fe25ceeead5bcf3f80c712e8468fe887a57fbe19884b2c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679078155, "uuid": "f3375e4b-e363-459c-91d8-ccf9a078a200", "comment": "Malware payload (Mekotio)", "value": "ce854ebd481c03df98625619bcc258614fc19515", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679078155, "uuid": "47a44574-d4c6-4464-89c2-b19d327931fe", "comment": "Malware payload (Mekotio)", "value": "efb903fcceeb7b7d5d76a5e02895ca8e8c54dbe6aa88786b4b5fee5064e6a30a1027c25b58dcdb23ffa3c6335f8e987e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679078155, "uuid": "47b80240-234f-454d-8fd2-6b9cf4b13455", "value": "T12AE6237313D06A46F6B297755C3B88484C36BC62AE32C52CA11F9D9D48A1A4CEFF5732", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679078155, "uuid": "ad8f61b0-50dd-4725-8b7a-70319dc44b4f", "value": "d101f7a5d94d599d72693c0ec35d0a4e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679078155, "uuid": "1ae6bbc9-2603-42eb-bef5-24051ca71b15", "value": "393216:y1+g8B3BQ6lV7Vb3LBgTovVLRAsDEI3mtPuQTC35BeI:y1Vs3BQmBFiMVLRAsYI3OGx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679078155, "uuid": "d0d9999f-7981-458f-a5a0-ba50e87b9d86", "value": 15230464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679078155, "uuid": "57c91083-7354-490c-92f8-47c4d42475a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679078155, "uuid": "72826daa-fe02-4e23-b7ba-62769c7c6fef", "value": "BIHBXRSIVW.rCJ", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f2826b4-c49a-11ed-88f6-42010a9c006e", "comment": "Malware payload (TrickBot)", "timestamp": 1679040174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679040174, "uuid": "9f40484e-1234-4310-83c4-149064091b02", "comment": "Malware payload (TrickBot)", "value": "77cbcf6dfcfc1102d9a8156b743051e3", "object_relation": "md5", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679040174, "uuid": "3b835e7c-1623-4940-8806-a6816cf87c52", "comment": "Malware payload (TrickBot)", "value": "a08fc81cd189984d84d771194a11ecbfc57c5c74df1c36c0c46157a30bcf23cf", "object_relation": "sha256", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679040174, "uuid": "228ef36e-ef17-42e2-95ec-9a7c21d59c93", "comment": "Malware payload (TrickBot)", "value": "6f5875c7f686d8880dad8e1e7c6aa76267a639b6", "object_relation": "sha1", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679040174, "uuid": "a93fafbe-0a00-458a-a63c-c180ba6a2e67", "comment": "Malware payload (TrickBot)", "value": "5c64b3afd2a0e4a2e9b50efed9f7b905400ec419dcad5c8f8a2e6ef17c837250b81fc28cb60b714c12746582233923b5", "object_relation": "sha3-384", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679040174, "uuid": "cf3aebec-5edd-4fa5-8e17-3eeed9a15874", "value": "T1BC14125CD6028EB9E4329CF5B159393C3729B592EC7B47D38280E37F7701A42193EA59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679040174, "uuid": "ca0e4d3f-67cd-4207-b974-1b84fb14704b", "value": "3072:uihhzqYSqqotoxBnMwEOr5IiNU4tdasHcBR7n3uDiPMtHQF/6r+dnxjF9UpgARfq:rhhzHFGMw/r5IV4tpHcn7fPyH2/6Yxj1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679040174, "uuid": "7f399332-ed9b-4d93-9810-b5818e27eae9", "value": 195748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679040174, "uuid": "22305d80-1baa-4e3d-bb93-5d1f75a4c1c8", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679040174, "uuid": "6d31aff2-6706-4f7c-bc5f-f4ca63fad852", "value": "Microstrategy - Global bank screen_16Mar2023.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ce45991-c4bb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1679054558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679054558, "uuid": "a024b736-95e9-4e6c-89d0-cc415a3dd8e2", "comment": "Malware payload (Formbook)", "value": "fe4aeaf3690ccd41e289591c914c09ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679054558, "uuid": "6a981162-f704-425f-a52a-2b0ca5428282", "comment": "Malware payload (Formbook)", "value": "a0ef6bd94fbfd6134e7ddbf54c78f8cbfb014223f7401198047d5715ddfaf93f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679054558, "uuid": "a9e74f15-73cd-42c8-9ebb-399ef38b01cf", "comment": "Malware payload (Formbook)", "value": "c0991278610d5492ae4ad5eb973cda53183ebfa8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679054558, "uuid": "c39442cb-8555-4781-bf1d-719f6be9aa94", "comment": "Malware payload (Formbook)", "value": "f6d3e6e89b34843ee9291719fea008949e6d00089d0412424eb5837a9f7ba43cc66374c7885eac6288e5b0a987fb6347", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679054558, "uuid": "f73b629b-4b62-449f-8e18-67221546a36c", "value": "T18E540243B19C86AFC5251FB1383E16715AE6AF236170928637ECCE2DB51721D9E1C3E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679054558, "uuid": "f3bbcdcd-e9ab-4f75-9200-b68cd170038a", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679054558, "uuid": "4f4882cf-828f-4f05-a50d-4f935bac0cb4", "value": "6144:2Ya6C+OqLPg35Nfj9GMV5jO4yPij7nhRJWhfMW8pXS2sRaF:2YLOq7UTHvUiZ4J2Wk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679054558, "uuid": "45a3c79c-9865-4997-b7ca-7ff945d0c7a1", "value": 287228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679054558, "uuid": "76f62f3b-01a4-40db-be12-73999c53080d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679054558, "uuid": "5d1c3f32-eaee-4f94-b4fa-8f471ecf8ca1", "value": "z1BankPayment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a02544bf-c4ca-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679061006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679061006, "uuid": "17b47dbf-10d7-401a-8cb2-37b3153e8f74", "comment": "Malware payload (Mirai)", "value": "18b97a1e0d964554f2244d7ee633234e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679061006, "uuid": "89e42ab5-d50e-405c-afe0-e7fa494d7b0e", "comment": "Malware payload (Mirai)", "value": "a19c730227206fe99da7e7239d061f4803dc10fe1a1e478713813e28d21a8ce8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679061006, "uuid": "77af4650-ca4d-4d19-8f56-321b38b3bfc8", "comment": "Malware payload (Mirai)", "value": "87fae873d41c9c8719afa4152d9cc83dc094b0bb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679061006, "uuid": "5bef12c7-b514-4d96-b5cc-b8684a2b1a7c", "comment": "Malware payload (Mirai)", "value": "a437cc077f679d6dfca277e08adf59a9e9f4663a60e80734bb93fc3dfb7263c954a7b2d2dbe5c017896f8216ba751f48", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679061006, "uuid": "a6c57957-e16b-431b-92a4-00ad897816d0", "value": "T1F8A2E12172632E55E3ED1C3DC96E8357F9671BFC90F632B679406620C94D20A3E39A4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679061006, "uuid": "69162af2-aec3-46c0-ae3d-f8ff32d76803", "value": "384:vvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjevhymdGUop5hv:vvQn4j+ZO5fKAlxKvs3Uozx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679061006, "uuid": "23b15719-33a2-45c5-90b5-917b6edd7db6", "value": 22160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679061006, "uuid": "cb5fd400-be18-46af-9c8b-a2821e6ababa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679061006, "uuid": "edf7661b-8017-4b44-9d51-c43651d87a1a", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0d8981a-c4e3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679071879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679071879, "uuid": "e9081b37-e393-42f8-b913-a36ff8d99a5e", "comment": "Malware payload", "value": "43808a03268c64bf3d12a8542436b742", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679071879, "uuid": "08ea4404-61ff-440a-a3e9-84f98cd5a08e", "comment": "Malware payload", "value": "a1e96b3a8422d11de6c28320208ae4cffb6533b313c1909f11840ba7132175e2", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679071879, "uuid": "37c1d93f-88e8-4e7c-b719-ab4cc29954b9", "comment": "Malware payload", "value": "eb5f851be527a48a68bb6cf5731da49dfb7dacf5", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679071879, "uuid": "71cd95f5-a367-4b20-9604-511fa2529bda", "comment": "Malware payload", "value": "fcf4f36d14e4b2cf178a8020e464155de590ab84a38f1139dfbabb18919222a480b1d96e6208339fe4211393bdd01346", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679071879, "uuid": "d8baf5b0-9c7c-4fcb-99b9-fd2e5c45daca", "value": "T17745011FB244DF4AC5568BB86E17F9D8020D7D60ABD4B18736917B1F2E350A26AC72CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679071879, "uuid": "507e1a73-f87c-461d-9eff-2c4da06c71b3", "value": "24576:ULKcWQmmav30xkeXKzatpcCUxi4Qc4aVamGEGSXOH4Z:ULKxQmmQ300lCUL3GEJXOYZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679071879, "uuid": "caf54a83-3849-4960-9a7e-2fd6ef5cf7b9", "value": 1238528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679071879, "uuid": "1637e765-61af-482c-af50-3eb40f9339e5", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679071879, "uuid": "609e4eb7-75f0-4d86-9890-a50c94358579", "value": "New Order Match 2023SI3.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30c072c4-c4a2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1679043640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679043640, "uuid": "3ded67f2-6be1-48e9-8554-408b6072129a", "comment": "Malware payload (Gafgyt)", "value": "2fec705ce6ccc1b5b50be9e912e62381", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679043640, "uuid": "49a5d8a0-e2d7-4f90-92a0-10312dfd2b83", "comment": "Malware payload (Gafgyt)", "value": "a232955b89eeedfef11353e3a0390f2779f27e5d9525672b210beb7ef955ed52", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679043640, "uuid": "dca5fb53-1dff-4eed-abc3-1a842679904b", "comment": "Malware payload (Gafgyt)", "value": "389367a74df1271745f5942656a45a5477da8862", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679043640, "uuid": "11390b3b-fab0-419e-8c43-4fd45b5863aa", "comment": "Malware payload (Gafgyt)", "value": "c618d46680d590f678481dc414b2913891a5c935eff38e8223ab71d757052d8d0e60b84ead1ddddb73966069dfceed2e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679043640, "uuid": "6084e607-1383-4131-9ded-029fc3a01060", "value": "T104E38366BB619EB7D80FCE7309A64501118CDD4642D93FAFB2A0E51CE76B84F08E3E54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679043640, "uuid": "d7c10f5a-0506-494f-9e90-94257dfaedfd", "value": "1536:bVeTpqCVvWRYx0O9vPBysZgvsgxqAz/0ufMytVHpLtaoLAImlP+s4zWfOodW:byvWmBx+sK/Pfl9gImlWs4zWfOodW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679043640, "uuid": "aedc7d1e-5da2-4889-9585-2724b3420d02", "value": 152201, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679043640, "uuid": "e91e2e61-0268-4523-95d1-96ff0cfc3587", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679043640, "uuid": "02e7b085-58b0-498b-8b41-b840079768c3", "value": "2fec705ce6ccc1b5b50be9e912e62381", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a44b5f83-c4d3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679064879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679064879, "uuid": "31a0f682-26c1-4b0f-bc0a-85cae18db09d", "comment": "Malware payload (Mirai)", "value": "88a68b2693f80213b6d86c3e66bc0132", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679064879, "uuid": "e4010d12-e615-4cb6-8349-0946967040d8", "comment": "Malware payload (Mirai)", "value": "a2489355d755bce424aa57304c126d3dec87ab5734e9e67ba3584b03bd45d92a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679064879, "uuid": "ee4ab11c-c07e-474d-b715-94a0db5b0a2d", "comment": "Malware payload (Mirai)", "value": "c87a403616f1c51131e22e4109d620de9e2402dd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679064879, "uuid": "11932cb9-2840-4e52-b751-d061b48315e4", "comment": "Malware payload (Mirai)", "value": "00afd66e3ce2f0a185781d1a3842d43d70e2056fe830df8f2e0248988d696a693e91777662ee314568c4e1fdfa80b17c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679064879, "uuid": "21894af3-2b57-4aac-99fd-4e3b72be4d3c", "value": "T1BCC2D1A07726FA31C420AC3DE52A4D8A3A51067C91FF353664658D398EC1A5B63F44F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679064879, "uuid": "20e9831e-c321-45ce-8cbc-826bc5c187b4", "value": "768:4MKyhegCCMqfizjoNpd2vJdX6vwrv9q3UELuH:PKy4qfqoeJdXWgeLG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679064879, "uuid": "064f8c9c-039f-416d-b0f1-72b5a2004130", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679064879, "uuid": "471e5d83-166c-460f-83de-97dde481d1b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679064879, "uuid": "5af1c745-4a44-4335-9f6b-52e038612679", "value": "88a68b2693f80213b6d86c3e66bc0132", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71cfe19f-c4a0-11ed-88f6-42010a9c006e", "comment": "Malware payload (WSHRAT)", "timestamp": 1679042890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679042890, "uuid": "d36a2a7c-fff2-4166-aaf8-0defc09c425f", "comment": "Malware payload (WSHRAT)", "value": "77a541634d4f73b6b242bdecd53c1231", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679042890, "uuid": "f1f0ff69-a71b-47dd-9a47-462de8b948a2", "comment": "Malware payload (WSHRAT)", "value": "a296d00447ab6ebd54fb78afdeab1605246b0913130b870571ccaf7ae0117033", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679042890, "uuid": "b4869545-21c9-426e-b4cb-c0e9a45c97ea", "comment": "Malware payload (WSHRAT)", "value": "e5d9ae28229954bb0097e057a45f957913ac163f", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679042890, "uuid": "74d518f5-d21a-4c46-98ea-f7cad9d811fb", "comment": "Malware payload (WSHRAT)", "value": "b34ceec8ee3c5cfe1aa0db5438879563343a8bef98b5e6ac5426419a2dd6b03d44d5fb4f1e9018629c5ada2a22175d63", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679042890, "uuid": "f2d5df1c-5bfe-47c9-8111-03b866d6a954", "value": "T19C2421033D57FA3C099F2D0064312E7A5F9EFE74C209A19626496F3983AB64D07BF529", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679042890, "uuid": "80bd4155-c482-4241-9e58-31a47656016e", "value": "768:DMYP16f3e2+DCn6F4jTF9aieJHRzzFaKE/x0hGmVxYAYe3BH7LFHY:IYQngUKS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679042890, "uuid": "bc23429d-f472-4e58-87a4-85d2db740533", "value": 211179, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679042890, "uuid": "f2027a02-453a-495d-b8a8-cc03d288634d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679042890, "uuid": "02a57492-7061-44df-ab90-636d79d42ab5", "value": "PO230317_COPY.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d0acd9b-c48f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1679035446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679035446, "uuid": "63db244f-9927-40c5-b155-7a0f815947c5", "comment": "Malware payload (Formbook)", "value": "5cb57c35d07be161a30922cea5dbf516", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679035446, "uuid": "fd210fda-6ee1-4dd9-aa2b-42c070584764", "comment": "Malware payload (Formbook)", "value": "a297ebcc0de208dd852acc81f673ce23ce6d27bc82a84662c3b33fc0c9f0f569", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679035446, "uuid": "370f119d-fed6-43f1-8d56-c14fddf47b2b", "comment": "Malware payload (Formbook)", "value": "d73d45dd0940c4a8c6adc9513241d96141c745e1", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679035446, "uuid": "1a679fa7-f966-43e2-b408-a812c8f6ca90", "comment": "Malware payload (Formbook)", "value": "14b0b51857c7ae77fdba5d80d6f9620adf34e50896cfe14fc0e7537b4751c313ebddf528781aa57f1161652683ac2244", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679035446, "uuid": "bccb0d14-aacb-4751-a831-00b4129d4968", "value": "T1D2F42353395FADA8F229479709E0AEC3D15BA0CEB7CC21A9637079F21064223975B1CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679035446, "uuid": "2b1d01ca-e9ef-4b6a-99e2-1969814fa491", "value": "12288:GPcDeBrquM9y6bZR8yOGGLcaFn5jFxZmPd3Ubvnr5Gey31SUHxXdadLzp:ReFqxE6bZjO4aXjbZWV8tGey3QUHxXdQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679035446, "uuid": "115e05ad-138d-4d68-9846-d004a6e8798e", "value": 734648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679035446, "uuid": "e76d3d6e-3f4b-42e4-8aaa-3f98ea6ddea7", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679035446, "uuid": "77b7ce5b-f9ad-4534-a867-503ee9124f37", "value": "Proforma Invoice.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bdd57d8-c471-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1679022532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679022532, "uuid": "e8722a12-7f78-42c6-bff5-36a08dcb9ce2", "comment": "Malware payload (Rhadamanthys)", "value": "cb93778b49f52b99416607cf7858a45a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679022532, "uuid": "38c88c79-5d60-4337-95c7-d9e35a00b4ab", "comment": "Malware payload (Rhadamanthys)", "value": "a2bfa96c2015c663e645d9eff3358dacf4be79168ee00f42d01d8648a4415721", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679022532, "uuid": "a1563e95-9b7f-4a87-b698-36e40e990091", "comment": "Malware payload (Rhadamanthys)", "value": "e2b7b37a0bf8f172d0be7636d4abf233c98d1baa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679022532, "uuid": "aaf226af-eb3a-4ac0-b78b-4f398885057b", "comment": "Malware payload (Rhadamanthys)", "value": "8ddd771910badc7d6c4aa38201146a975e2a9ed5c3be1d837f971c39e90fd6fe2539f6746a5dc8007331fb9d1da7aefc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679022532, "uuid": "1be1a911-689b-4c32-a8a4-962bdccf18ed", "value": "T1D734CF4392E57C60F5254B729F2EC6F5770EB923CE79AF5B22085A2F18701B2C56EB10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679022532, "uuid": "3874fb38-0f29-4c35-ba8c-2637a7096533", "value": "4b2faf5e2157c756cf2fd31d6cfd3d44", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679022532, "uuid": "cfd0dcb8-241d-411d-b14c-5a304ff0eda2", "value": "6144:0A0sAu5T5AVNPn6uVdd+aDPzql86jJOUWhTJ:0A0sA0T58B7Hd+aDzqltjYUW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679022532, "uuid": "a4ea1dbd-6363-4af5-938e-4345773a2966", "value": 252928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679022532, "uuid": "e3f499f6-e123-41ed-8ba2-d5fa7ce42656", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679022532, "uuid": "8cfb7945-9052-4d45-8fbc-bbbd1b459ccd", "value": "sample.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6748303c-c46d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679020968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679020968, "uuid": "777ba755-0c83-467f-b099-eea11826e70b", "comment": "Malware payload (Mirai)", "value": "03502e136b4cdf3c78090756e761a821", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679020968, "uuid": "eca50033-ed15-4fa8-91b7-445affc8b4ad", "comment": "Malware payload (Mirai)", "value": "a2c6ba087772f6202ff0d84c5d068596fbc112cc1e6d889528a11399e8405631", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679020968, "uuid": "836997a1-a075-4291-baa1-afbd38c2b65e", "comment": "Malware payload (Mirai)", "value": "1d11db2282c3fd7cdc049336530f68237c77e380", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679020968, "uuid": "4ee8f6c3-c1c7-45ed-a434-a0340fb9adbf", "comment": "Malware payload (Mirai)", "value": "3dd180dcfe9ba2a137ccdeeddae50c9c66602b11d6ae8a465f59fbf82699e5093216bbeb6b61fbd56a0f6f6952376f78", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679020968, "uuid": "c7529ae7-92d7-42ba-af7e-54ac9c326f34", "value": "T146A2E125395B5785D75DA83CCD7B8257BB5B1BECC2F830B112100A61D799B432F3878A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679020968, "uuid": "46f35fdb-911a-49c1-aa2e-92268817fab8", "value": "384:UvtIoZxrSniaXs+qx+bwqPXQ9o8lCtDcj3QhXSw5RjC+hymdGUop5hP:UvQn4j+V8ltAhXl5Rj9s3UozN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679020968, "uuid": "e011636b-8f8a-4fe5-8cb0-7a1ac40e574b", "value": 22160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679020968, "uuid": "0ffbc1b5-7c00-4673-9e9c-9910fe079034", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679020968, "uuid": "75c396e3-c247-401e-8dce-7dae08b7c662", "value": "03502e136b4cdf3c78090756e761a821", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "580fa392-c4f6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1679079783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079783, "uuid": "4dac2957-02a8-4083-8fb9-3c0a21a56646", "comment": "Malware payload (Rhadamanthys)", "value": "4ce1907bedf5f7b62e6b8b637c4d7c1b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079783, "uuid": "3d519f6a-a228-47bd-a97d-de261f86062d", "comment": "Malware payload (Rhadamanthys)", "value": "a2ee2e380c444d62824c944a9ed1a7d12e4b49d3d571d639eceb87680a259139", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079783, "uuid": "25e2e36d-8bce-444d-9cea-79a96a0feeab", "comment": "Malware payload (Rhadamanthys)", "value": "7b1c5ad0b74d0fa927243aaaf431e1c74d0c8ec5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079783, "uuid": "e306a16d-664e-4946-9021-118d259192ee", "comment": "Malware payload (Rhadamanthys)", "value": "3654731e0a3cd55fa7019f1cc93a9d7bb72fd101124d1f7fb6bd552b3a3354e813932fe470dc3ef9cebd4e44c0bf75e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079783, "uuid": "f15a2b3b-a054-43a0-8ccc-4ce5e0781929", "value": "T124745C4393E1FC48EA264B72AE1EC6E8771DB6D18E89776532189E1F04F2172D163F90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079783, "uuid": "7755902a-ca58-427f-ab21-cef0e7b25c4a", "value": "967eb4f66af509da0d8ad27d2261daaf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079783, "uuid": "670e9e59-b23e-4201-b53b-70d630f564bd", "value": "6144:qOJ5LERQl9pevRuqjevBnJj5R+u53VgxvLpZu:BJ5MQ3pXrvVJTvsfu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679079783, "uuid": "685bfaa2-1f1a-42be-9ea6-cf18a8c94371", "value": 367104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679079783, "uuid": "a44bbbd4-da6b-4702-8f4f-566287f2445f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079783, "uuid": "034154a0-d1ea-42ef-a30a-e07f4f4d5bc7", "value": "4ce1907bedf5f7b62e6b8b637c4d7c1b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b23d6ed7-c4e2-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1679071345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679071345, "uuid": "259ba843-c517-4e4d-9675-66a28bb0d93c", "comment": "Malware payload (SnakeKeylogger)", "value": "3e9308e2f99dd4d70da9b6b4ca32e40c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679071345, "uuid": "16867f9c-6e40-4c84-92e8-fff765ffcc11", "comment": "Malware payload (SnakeKeylogger)", "value": "a3245464c924b6be132cf5c4276e6d164188d5046eb9f93e479302419bf37faa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679071345, "uuid": "7cdd24cb-4ac1-4873-84b8-a32db440e595", "comment": "Malware payload (SnakeKeylogger)", "value": "086215cc869db56c4551aff7c339978dc4d82c32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679071345, "uuid": "29d1dabf-04dd-4dbd-a139-1ccb7294877b", "comment": "Malware payload (SnakeKeylogger)", "value": "e54753fc81cdfdc5cbe44201e17807bc5bcecfc2401b04691058989014b39c13e8485e82b1e461400f6452195563c088", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679071345, "uuid": "77da7f1f-fbf0-40df-80fc-bb6036021b93", "value": "T1D205015CB229EF50C67D87FAB175682493F3991F5236E3899CCF64EE2B62F90014190B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679071345, "uuid": "a6a577a7-e9fe-4bef-9c88-54ddb879a30c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679071345, "uuid": "41835518-3fd5-4da6-bda5-c2247018ef64", "value": "24576:O9jkj+sLSnVFSsRONGeVsA+45FG2y+Gk6AoSSt7gMJfcMR:O9jkhL0Rm/+WG2W3A8ts6fRR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679071345, "uuid": "e220476e-2e85-47a8-830f-2cdc40cf6238", "value": 824832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679071345, "uuid": "cabe4c12-c49b-4899-a367-bdd59a01beb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679071345, "uuid": "4c4610e5-d358-4d6d-9fab-b87a5c2c1d5a", "value": "INQUIRY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78f8a31f-c51b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679095730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679095730, "uuid": "157d4a55-d339-4fcb-9f45-fd3b9642e779", "comment": "Malware payload (Mirai)", "value": "631ff65fa3d77f422e5915fa8910bd9b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679095730, "uuid": "6c656c04-9696-42dd-8d5b-bcfdc89abe21", "comment": "Malware payload (Mirai)", "value": "a3359626fb95bb353c16eaedcbaa0291762cbc37f4847485f011b44530142a52", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679095730, "uuid": "268d8569-fb50-442e-8139-f847963d905e", "comment": "Malware payload (Mirai)", "value": "936b6432a70edab53e0914840f2a2c71277805eb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679095730, "uuid": "f51fbd25-692a-475f-baa3-f6a77fabf8a9", "comment": "Malware payload (Mirai)", "value": "caed5df5a9f845a23f1abdc960011d641a6f154c58c1409bf6b664c0c7fe5d221a53e5a0373da026e618dc7e9aad387d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679095730, "uuid": "1ee02eab-5001-4085-aa45-4c0abe11c767", "value": "T197E2E15294E6382BE28AD37B122B1DD771D18432D782A3CABF08E4475DE103D157ADED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679095730, "uuid": "17b4d83f-98d7-4240-a7b8-03e005a7aa8d", "value": "768:KvZ1hu4bg59cBhjaU8TLcU7KArPPhhm2CjytjfDdEPFCh:KvXi59cPILcKKArPPhVCjytjfGP2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679095730, "uuid": "44a8ddc1-35bc-4956-a3ae-2fabc837ae15", "value": 31908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679095730, "uuid": "249320b1-467d-428b-9afe-46e14bbc816a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679095730, "uuid": "5f8c6476-19f1-4782-bc6c-267dab170a6c", "value": "631ff65fa3d77f422e5915fa8910bd9b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c4963e2-c4f5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1679079253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079253, "uuid": "2da235b9-d507-4356-9a56-2bfb954990bd", "comment": "Malware payload (Quakbot)", "value": "25178faee98f554ca8e8d60c3a4038e7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079253, "uuid": "61a3071a-3a20-410b-8abf-81216efa809e", "comment": "Malware payload (Quakbot)", "value": "a34d104fa2f3913f42fbfff2f603af35c611a7edef490ed02a6d736eb12190dd", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079253, "uuid": "8f3b2637-3844-471b-9bfc-a00e42d15a18", "comment": "Malware payload (Quakbot)", "value": "a8f5756397fc927aa5f38a7f2252158136ae8b86", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079253, "uuid": "e74cc2be-46b8-433a-8342-1fe3c10f54eb", "comment": "Malware payload (Quakbot)", "value": "4f4cbb0392a53ceb886edcde4ab23a0715f7de067c3ea441ab5e76120d39c3bc81574a3f2fc10651877b7d89beed4851", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079253, "uuid": "537e504b-54e6-473d-90c4-a2e8b3ba2448", "value": "T18763C7509F4214A117377E27AB656860E7692B138390414BF87F7216FFEE90CC9D4EB1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079253, "uuid": "e16af192-cae0-4f68-ac69-65ace5e5d79b", "value": "768:N/qeNP+G+1G0pHsHl60LSoX52aNhXLy5/x0RRcr6XrA/X0wEA/kh7tM5DUXNQY74:NCLxP0fkh6RrA/0+kh7tMydb4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679079253, "uuid": "51610437-115e-4429-8080-41aed08c6a9e", "value": 67626, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679079253, "uuid": "cd871f8d-231c-4e86-8452-ec8ae1867f02", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079253, "uuid": "fab833ca-7558-4794-9815-a7728bdd18c0", "value": "voluptates.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a328d2d-c497-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1679038958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038958, "uuid": "8ffa39df-a9ab-4a4b-b0d1-190e7db73762", "comment": "Malware payload (Heodo)", "value": "face7505fbf149446fb9948e08676058", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038958, "uuid": "2812a55c-0cb1-4c3a-ab0f-a167a808448d", "comment": "Malware payload (Heodo)", "value": "a35ab561f69e3bedfd12987503fe43978ec38b3bc240ddd4f2ee419045ef7659", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038958, "uuid": "77c342f7-d05e-4f38-8c26-fc6df83dac6a", "comment": "Malware payload (Heodo)", "value": "f052f03c49bc57bb323eb65f40a25e0fa897603d", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038958, "uuid": "60648e73-5100-4610-a9d8-fdc291a23bf1", "comment": "Malware payload (Heodo)", "value": "5ec6a3b825b8a310defaa155f404a869f828d95fc4216970b23ed1c297d572324de8cb9c9f9c7455535afcbd04b2cd7b", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038958, "uuid": "be51260b-bf4e-4425-b80b-ef8c4b65052f", "value": "T1AAD3E8F17A520C85F013EC351AF4CA12EA34876E472D2B0FF5A904BE0DFBD499A585E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038958, "uuid": "3c14fde0-87ac-439d-b0df-e5829d8573ae", "value": "3072:PrfWMINYf3K19kzCnEEQvSMVnte8ZP1Y6J0cTgGk:d6nInM8TXJ5k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679038958, "uuid": "bf745ebc-6395-4938-b685-b1ae7be16e2a", "value": 134140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679038958, "uuid": "03369e84-76b4-4a29-be26-2bf402913b16", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038958, "uuid": "c34803e4-de55-4372-93a8-48f170b7a27e", "value": "Doc-425112299.one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3b97915-c4e3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679071777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679071777, "uuid": "31549882-2315-43db-87b8-c5f953f110cf", "comment": "Malware payload", "value": "48347d71215b181d90ec570f405f98b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679071777, "uuid": "f8e3ef61-8234-4074-9b37-0986a2b45e47", "comment": "Malware payload", "value": "a3ce4b4b8f6173d1fab0672bad02cd657add4e1d74bae82869883a96e99b3e77", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679071777, "uuid": "ec45faed-b59e-44fd-8173-c6f3dfc44d82", "comment": "Malware payload", "value": "83ab33b39f40a7e64cbd26c18d5602a4ce00facc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679071777, "uuid": "d97a7181-5dc2-4e21-ab3d-0cf7b24649be", "comment": "Malware payload", "value": "9e6782fa917bccc60d2f3b1febd05d1288c48fb57eacd3b9df562c19c65eaff487fda342ac9c57b853c91cd2c291ab79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679071777, "uuid": "0750e091-ada9-48ef-9877-44e6aa8fdc99", "value": "T17BF5BE6997040BE0D8AFD53CCFA2689E60B77C32E68B24BF5F4A3E795631087E4C4516", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679071777, "uuid": "94f8ac25-d495-4f8b-905d-2609516c8b26", "value": "0c901bafc3dc9a701eb7d97dcf772d0c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679071777, "uuid": "058d0343-b767-4537-956d-e03dc8906de9", "value": "98304:AoaD2xzt49ndR/hqOAX7Jhh15VRN6UnNOzFv:Vt4rqN19n2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679071777, "uuid": "182287a3-ac4f-4681-a176-0e09da712d22", "value": 3585944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679071777, "uuid": "619886bd-d587-40ad-9a12-8ec864092e9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679071777, "uuid": "6acb7c8f-736e-4785-b02e-5e6b7393a64f", "value": "48347d71215b181d90ec570f405f98b0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be5e6c3c-c4a1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679043448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679043448, "uuid": "f0817ce5-4649-4c1e-b55a-1d23d742b23b", "comment": "Malware payload (Mirai)", "value": "7af9776cf1f9acf383e688b936c2b36b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679043448, "uuid": "5f78dfbb-4783-4757-9ee4-e1d43d000d92", "comment": "Malware payload (Mirai)", "value": "a400f6d71dc242ecd626ab9fbed40cc0a34198aa0bf0db4610ec0050ad39aa52", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679043448, "uuid": "373391a6-5a76-4b6f-a192-f831270faab3", "comment": "Malware payload (Mirai)", "value": "3be53ad5457cf1863dd463bb156d5255109c7543", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679043448, "uuid": "5679a00d-c4b5-48d0-bb6e-2437611a9f6d", "comment": "Malware payload (Mirai)", "value": "95901bd7153eef16a439d917d07a71097b9a8b117763554cf20a27a0611716fbef35113c3760d6e8daa2371542a5c192", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679043448, "uuid": "903783fd-8f84-4876-b77c-2acc47eacb82", "value": "T1EC334AC5AB93DCF8ED1506713177EB328B77F03A612ADAD7C3899523A842B01E50729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679043448, "uuid": "c9821d0c-88f6-4455-956c-906a4463dfd8", "value": "1536:3hSgebzgP/AY+39afOsMJRdnhN66OQ6xpwhNbr/h:xZebkP/Ad39UMJRlhN7L6bIbDh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679043448, "uuid": "e44c66f6-6468-4e2e-9ad5-e0691c6336d8", "value": 50608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679043448, "uuid": "0656ac27-a029-4fb1-ba83-acc3f7848934", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679043448, "uuid": "80c75a13-464b-44a2-955b-16f8ac08f947", "value": "jew.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e77ca33-c4a9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679046615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679046615, "uuid": "20331094-b76d-491b-b749-40f7bd5faeee", "comment": "Malware payload (Mirai)", "value": "83d95f05f2233b8dc56ae0cfc389a9d4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679046615, "uuid": "eaf1488e-f1f8-44d1-aea6-e09bedf44f0c", "comment": "Malware payload (Mirai)", "value": "a403064a9daf1da64f0213b76ae581cabd94bebc064ff33c3d1b0f3eaf2ce7db", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679046615, "uuid": "ceace1a3-daeb-45c6-b495-a61f08807d24", "comment": "Malware payload (Mirai)", "value": "728080bc13c9717f8b4bf6f197352d26af3fb019", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679046615, "uuid": "08cefeb0-d425-4f99-a59f-0bbbdc84090e", "comment": "Malware payload (Mirai)", "value": "be411bafa7775a193e9d0e177675117650e0ba7a0490981f5e87dea6ac5c6b3f6628418520ef61f7ef57ec040b10cf7f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679046615, "uuid": "21c36552-3c8d-4bf8-a4f1-34a0def251cf", "value": "T1F1D34A46EE818F03C0D5177ABAAF424933229765D3DB73079D285FB43F86A9E0E63605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679046615, "uuid": "561d4e26-217a-4e53-b2a6-ffbdedeba585", "value": "3072:b2N8tJS98/uHv8BFVlX0CTgb7SzM/9Lqfe:yNgSGuHv8BF7X0rb7GM/9Wfe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679046615, "uuid": "dbde9417-df8c-409e-a229-adf9873904b3", "value": 131489, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679046615, "uuid": "cae27876-1558-479f-a085-8a5419f3c65b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679046615, "uuid": "c3071010-9aca-41d7-a724-db72a1310972", "value": "83d95f05f2233b8dc56ae0cfc389a9d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64ca92fa-c497-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679039002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679039002, "uuid": "d59c2e6d-4ef9-4862-954a-f4e2fd7d76cb", "comment": "Malware payload", "value": "a10a585ec78b5c769f5dca2ed052525e", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679039002, "uuid": "c4bb40cc-9273-452f-9fa7-5a322053cf49", "comment": "Malware payload", "value": "a4137b1d2336f03a59fcfc3f9273e75d1b2ba18e547b17cc50d894d67b960eb5", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679039002, "uuid": "62caf28e-b99a-40e4-ba84-d3ee0e58fca6", "comment": "Malware payload", "value": "479ce29d88dd108bcadd5b84768633fe768a45d0", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679039002, "uuid": "c1b2bd3a-bd6e-4799-90f6-55d7763697f6", "comment": "Malware payload", "value": "d2b639c7e36759e145346737f28c635600927bab1b9dad44d24c877160016ca896ff10ed1e26a1c7c3a139145bc50557", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679039002, "uuid": "8d2bf2a2-53ce-48a1-852d-d4d9d7e72e89", "value": "T1F2B56CB21193FFC4D72F1D7481042A409C14186B5BAC9B98FDC93EA767E52A4EF9C6B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679039002, "uuid": "4831a342-1ae8-478d-a3e2-036f83c17f78", "value": "24576:gKJ4Bu9Ot09OX7l348A5NyTrgrXBebbxwB0BGpUnYAHyOkBuuotyo+u9N8Esj6tE:6ocbOab1r8EsWLqO357", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679039002, "uuid": "b9c0ccf6-5c88-443c-84dc-80ea4342860e", "value": 2347008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679039002, "uuid": "31ab60ba-96b4-4fda-83ff-44398ebc573c", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679039002, "uuid": "624e7ef2-298a-452b-aeb1-7863550ffe9c", "value": "Purchase Order-20230315 & Leaflets_1.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a1d2934-c513-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1679092135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679092135, "uuid": "10dda564-bb15-4df4-ab74-3132dac19248", "comment": "Malware payload (GCleaner)", "value": "dd57d3e8aa35f0b8218af7af8f3a65e7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679092135, "uuid": "e2309341-cd67-413d-8a26-d5d75de5c45d", "comment": "Malware payload (GCleaner)", "value": "a41e45e14795bb60ef20aa47780ddd8cdc491e7e23c16594a7af91c4f3e817cd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679092135, "uuid": "05cc42bd-0eeb-46b9-8cf5-6ecaf2672476", "comment": "Malware payload (GCleaner)", "value": "5f5980c3c94aca9ca9011505a003fe7b9c8217bf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679092135, "uuid": "4e90ce74-d0cd-4431-9b66-17353adc1fe5", "comment": "Malware payload (GCleaner)", "value": "e1dae624217129c337167d8be2f1f9b4e9b93dcf7005b470454aac4a226a8d114e87b29d83d2a66b48f87a89bcbeb70d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679092135, "uuid": "09063c42-d7c7-408d-a53c-8bfd4f1592de", "value": "T140C53356814D4533E1138E712E0E9A69A7B675513F713CA832BCDADF2B279E3C8C4B12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679092135, "uuid": "ab9e3f3b-009d-4bc0-a2e1-09ea9260382f", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679092135, "uuid": "278285d0-3719-4524-8521-8599fc5dcde6", "value": "49152:EGlJfse+Lz4cMzjsb0MAb8MIYHKeTxmRL6yQtV6rWfXw+aYy6+g54d5dlLYp:5j2z4PzjsbGIQaREEOAIL+gCrPYp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679092135, "uuid": "021fb149-a001-4e70-a582-9789de937f66", "value": 2554700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679092135, "uuid": "a18ba677-e9a2-42d4-b75c-347c683caa81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679092135, "uuid": "dcada3a1-1b78-4858-a7d6-256f3f207138", "value": "dd57d3e8aa35f0b8218af7af8f3a65e7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10e14a7f-c507-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679086965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679086965, "uuid": "6821a8e3-df12-446b-8096-ce1411a327ac", "comment": "Malware payload", "value": "b951629aedffbabc180ee80f9725f024", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679086965, "uuid": "1ea02a91-e3ff-4f71-a4e7-fabe3949e2de", "comment": "Malware payload", "value": "a43e0864905fe7afd6d8dbf26bd27d898a2effd386e81cfbc08cae9cf94ed968", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679086965, "uuid": "5b8c050b-be54-40a1-936a-3c191517b87f", "comment": "Malware payload", "value": "73c17369f2c4e3ce36d4f8917d011dde9a26eb07", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679086965, "uuid": "ada9f6ab-f1d1-473c-9727-06b89a9995a6", "comment": "Malware payload", "value": "f99c5549699b94721d489b948417cb82032d731ef699eb6b5b0cf8d734a2cb8c69380f8be60d5bf26dc174af12a64154", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679086965, "uuid": "6cb121ec-0c91-469a-be39-fdb85b12d3b6", "value": "T102545B10E78424A3D55D4732665BAD8AA17709737559CE1E038FA38A2FD3BE0EFB0C49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679086965, "uuid": "9f24da03-8a66-4d3c-920a-c938817679c3", "value": "3072:Q7pvc2vetOepE76wtghUVkJlD1HUjCu/tewu4UhKg+012FYrQAwNLhbrUzJr9EQ3:Q1veXwtVElijRcwuzKg+NAw3bI/Z+9mX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679086965, "uuid": "8cfa0729-152d-477c-94d4-720aefa9d4fb", "value": 300120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679086965, "uuid": "4d1e2676-7119-408b-9cb6-2e1e25221f56", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679086965, "uuid": "e9d95736-34ce-4e3f-b8a8-c65ff7e1b15f", "value": "info_9316876362.one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "893c5a52-c4d4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stealc)", "timestamp": 1679065263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679065263, "uuid": "a5eb68af-9212-4845-80cd-6a55c85c71cb", "comment": "Malware payload (Stealc)", "value": "b19c24870f768fcafbfe739c96f1566f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679065263, "uuid": "8e6f9580-81ad-40ac-953a-cd3978d5cf82", "comment": "Malware payload (Stealc)", "value": "a46844ca8aac1630877f85b10245c97334de38a93f4a9aa722d287d5316c16c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679065263, "uuid": "75f30ec1-ef79-4af3-a73e-c123e3b96353", "comment": "Malware payload (Stealc)", "value": "5a7980d34ae16188c3ffc02660b26f74713107ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679065263, "uuid": "404e57b6-81e7-4ac6-ae95-fbd877b8e6df", "comment": "Malware payload (Stealc)", "value": "c458b53b452c270dc569419ab81989b6cc31c326d4be10838f5206a0ffd7fade85c27d5b50bd6471e97a743e85b6c03b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679065263, "uuid": "10aad74a-4e4b-45a5-b12a-f41033a16f19", "value": "T14754185397E17C40EA278B73BE1EC6E8761DB661CF4977B52218EE2F04B11B2C163612", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679065263, "uuid": "7fb559d8-60b8-4215-a038-05964b61b28e", "value": "800c211657980cdb5c72386d0a0450fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679065263, "uuid": "967010b6-d643-43b3-9dac-8a63b36f0c47", "value": "3072:F1dwdLGFWfBBF/2OPyUbrieCljINBTq0jiv6LWziI3T:dwdLGkfBb/2obrjIeBTqdPP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679065263, "uuid": "0bb81de8-7bed-41f9-9977-c2d7acf0a0c8", "value": 302080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679065263, "uuid": "e5f4b41e-3e88-4cdb-b2df-b874f9be53d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679065263, "uuid": "c3aed7d7-a5f3-45f7-9afa-c8105148ce38", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "076c1da3-c496-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679038416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038416, "uuid": "321d1a20-26a1-4d30-927a-6a49f34950a4", "comment": "Malware payload (Mirai)", "value": "2ea464603df35f705194eabfb1e20f87", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038416, "uuid": "04bde0c3-d475-4692-b599-d1072cb55dd7", "comment": "Malware payload (Mirai)", "value": "a5548e8f7a8d1f2ee908778c536469968087f5e87f05497b913d4553d25cb8ca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038416, "uuid": "c5284de7-52ba-4f9a-853f-46a11f365de2", "comment": "Malware payload (Mirai)", "value": "ac7db208efd1c06723ba4dc0087360bbc30ac451", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038416, "uuid": "396a017a-2ace-461a-8c2d-e7dd40f42711", "comment": "Malware payload (Mirai)", "value": "c54151b3352d056d31fcea95badba032c2d43e4f0c89ad3452a0d4ce151fec3fbd9b33101bb8b5aad90df9100ce119bd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038416, "uuid": "72b153aa-f6e5-4381-87d2-f08b4e8c2957", "value": "T1CAC3F731E8044B1BC2D223F6E75A469E3F351E9793E733115A3879B06FF27992E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038416, "uuid": "d673aaba-59cb-4a10-94b4-ee5c29c5110c", "value": "3072:6jVlyaL5JCrIpv04snbttiEiTmP46aQyfPlfKsNb:yoCJCN4snbHemP46aQyfPlfKsNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679038416, "uuid": "90126705-b11f-4401-a863-d0cdd1bd031d", "value": 129898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679038416, "uuid": "187f6139-77c7-4e4e-ae47-e5d152f2323e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038416, "uuid": "64f3f616-fe0e-4751-8479-0572306e00b6", "value": "2ea464603df35f705194eabfb1e20f87", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16625c5d-c4db-11ed-88f6-42010a9c006e", "comment": "Malware payload (TeamBot)", "timestamp": 1679068077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679068077, "uuid": "3148b037-cbb8-408a-84c0-dc1f392d9926", "comment": "Malware payload (TeamBot)", "value": "8959a24324d191708c6a47602ec86609", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679068077, "uuid": "ea639512-705b-4636-9a5c-a07eb9a71efb", "comment": "Malware payload (TeamBot)", "value": "a5c07463c5365c413d3edc8d11979925ad0d120673d7d2daf39959f41e93e4d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679068077, "uuid": "b5f1fdfa-a0b8-46bc-b6da-f160224c48f0", "comment": "Malware payload (TeamBot)", "value": "cea1b9d295e765c1b38f57ca2e6f28432c031e8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679068077, "uuid": "a431d4b8-7e5f-4a7d-8ff8-f6e36f38dda5", "comment": "Malware payload (TeamBot)", "value": "23ab1dcfb5eb33485b0e96e24617ea1d6e50aadd4d8f3a9959995937386e59a94db0f9adbb79a80a6c01b6b3876a20c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679068077, "uuid": "605481b3-b72f-453d-8fbc-b3dbea5aa1cd", "value": "T14205D0438AE17D44EA278F33AE1FC6E8761DB5208F4D7BBA22589E1F04B1172D563712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679068077, "uuid": "7dd23ea3-538d-4563-a63a-fcd3ff1e9fd1", "value": "abe3ddf8623240e0db2d6ab65f42f1d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679068077, "uuid": "388d2c8d-191c-4e12-9083-9318f3f0e5a5", "value": "12288:TwyMG8z9zWWIMrzu8dSmfIuQCnymtUoE1rRPcN86v/mxb0HMThmX6hWF:GlfxfS9majpibeZ0sThmqhWF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679068077, "uuid": "96853bab-0914-46d2-ae37-67db92cc60b0", "value": 817664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679068077, "uuid": "c9a67863-80ac-4214-b83f-9a2819947835", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679068077, "uuid": "a3e11d58-b62d-4295-ba86-65ab267a0622", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1612c2c6-c4d5-11ed-88f6-42010a9c006e", "comment": "Malware payload (LaplasClipper)", "timestamp": 1679065499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679065499, "uuid": "11a3b96f-eaad-4826-9b0a-056a8255adaf", "comment": "Malware payload (LaplasClipper)", "value": "4ac3b05f28208a1c41831fd781327f12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679065499, "uuid": "70358f50-19f9-4d9b-a3dc-47bc13f2529a", "comment": "Malware payload (LaplasClipper)", "value": "a6a66627e3422140f5e1bb3eaca83d8b124c85734029b9ce216d5d33a35af69a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679065499, "uuid": "2e5df615-7095-4bcc-b16b-de61c00c8d1e", "comment": "Malware payload (LaplasClipper)", "value": "7660c9502daf62105414244e07b5e594874d45be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679065499, "uuid": "83764b18-72a4-4b76-9244-b08bbdf8d828", "comment": "Malware payload (LaplasClipper)", "value": "60f4a3b6ef87c86bdb7c03ffc3d5417ea9fce40eef18078386f683a44a8901b289b06d3d5185b84806521bc39493a7eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679065499, "uuid": "6b63e46e-7f9f-4ee5-91f7-ff6021b0efbb", "value": "T14895121296D17D85EA568B33AF2EC6E8751DF621CF4937762718EE1F00B11B2C263E12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679065499, "uuid": "6c684c87-cb5f-41d7-9f1e-4bcd2480fe35", "value": "abe3ddf8623240e0db2d6ab65f42f1d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679065499, "uuid": "6c2de6d7-3ccc-4467-89fe-8194c9b9b985", "value": "49152:nVM1o+LRAoWrYMgxE407GpZl44dphdLVMh3/fYgnPfX09:nVM1okOoaYzxE40Kp44PfUjf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679065499, "uuid": "438a5dbb-9727-4f3b-965e-35469bdda29a", "value": 1965568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679065499, "uuid": "4d299716-2cee-443c-a5d2-9b12d91f9b98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679065499, "uuid": "2bd13c92-7350-4368-b6dd-e21bd3fb4637", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df9bb05a-c488-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679032766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679032766, "uuid": "2493679e-82cf-4d11-8a5a-a81cc53cbc32", "comment": "Malware payload (Mirai)", "value": "e90d01f97142472768d823e8791d577c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679032766, "uuid": "6285e843-5baf-4a17-bb5e-5ef0f613e3b7", "comment": "Malware payload (Mirai)", "value": "a72de83ec5d6d74ba8f4e2bfec5d5ffa6919e9b5af830826422cca8003e7e5d2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679032766, "uuid": "8760dcf4-fd3a-4a7a-8b78-ded91d56acd7", "comment": "Malware payload (Mirai)", "value": "20ab05b122ae83f2b3a88e931fb6b0a1e5eb831d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679032766, "uuid": "439a8c4f-d29e-4121-9214-91d55a431ecf", "comment": "Malware payload (Mirai)", "value": "234293ed79997e01399eb423b2fdb0a326e422859aa89de4a513a76d4e9f55f66e1833e886eb3b1660a468df26858103", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679032766, "uuid": "03074da5-c8e6-4d35-b0b9-76fdac423ff8", "value": "T1CEB2D0021759896AC647FF3BE17A4F4A654ED8200FB74358E3F605D6628F56708AF83C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679032766, "uuid": "05be9e67-c4c0-4272-a86a-63d9c1c7b486", "value": "384:M4B6Yj833S7YSpsGE0m1SAqMaECTS2lPrvklG38/wYb7fLhT/dNx7pKg6L5+v1RV:H3j8tB0m1SAiTxFrzs/wYbDggDV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679032766, "uuid": "97425d1d-da13-449c-a4bb-5bc504cda7d5", "value": 23616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679032766, "uuid": "75199b48-58f8-4335-93c4-b165c7556680", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679032766, "uuid": "44b3dc53-0ce8-48d9-bf51-465433864c60", "value": "e90d01f97142472768d823e8791d577c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7ec2dfc-c4fa-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679081635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679081635, "uuid": "803e7fa2-8786-4898-81cf-ad14289b9c49", "comment": "Malware payload (Mirai)", "value": "5ecf7db86e9f6a80feb8ca2924ac37a9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679081635, "uuid": "84bacd73-196c-48a1-8c6b-3bcd913400a2", "comment": "Malware payload (Mirai)", "value": "a745eaac0b9f670a3a8a34dbd75a6513840b7a3fa330c4ff110afc8f10330160", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679081635, "uuid": "c318b357-c73b-437c-9cb9-975411d435f7", "comment": "Malware payload (Mirai)", "value": "bdcdab933ef94e5c0f39e91e8d90fbe7352d8bf4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679081635, "uuid": "3e59a3a8-0db3-418c-a369-0672a3e3535a", "comment": "Malware payload (Mirai)", "value": "d4422c68b8b9a8a32d3b2f4b954840562eda62a9c0228da5e5e7a1b8120db5429a44311fdbe7c7150e1f5d35de71efb9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679081635, "uuid": "db3ac1b4-2e1c-4ff8-b08c-a024bbb9c6cc", "value": "T18DC2E1B42514B970D3300139FBEDC9875BA7D1F082E43215295416FE560B896B9BB78F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679081635, "uuid": "8d95288d-097b-45c2-b3af-e215e61fee29", "value": "768:4RSa8ZS/L6rze3OXrFKg9KZrqoDuPos3UozYe:eSjFJXZBCJDuPdzZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679081635, "uuid": "aa81dab9-936a-412d-bfc8-64e3a6f0c0e4", "value": 26292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679081635, "uuid": "aedc486b-b586-4c7f-bd3c-6ecd55e9281a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679081635, "uuid": "c26bf0dd-007f-497a-9a33-2d3ea83a21f8", "value": "5ecf7db86e9f6a80feb8ca2924ac37a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ac60b13-c4d2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679064192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679064192, "uuid": "75e48f2b-b7ae-4c4f-b662-7efc0addc6a8", "comment": "Malware payload (Mirai)", "value": "bc324e83ea1388359ac69d348b81edf2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679064192, "uuid": "e0dadcbe-b4f3-46a0-9791-3cfc6b1c189b", "comment": "Malware payload (Mirai)", "value": "a76f357d1a47822efc507a9e22c10b7e4a4f0e43bef739d5637bd5ba073e78b4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679064192, "uuid": "1c9852d8-f6df-4826-be97-13b54f1b826c", "comment": "Malware payload (Mirai)", "value": "141fa05fb51078a1946656e4c30a2be80a9af6a1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679064192, "uuid": "e9a75ee4-3f8c-4598-ba51-99095869e387", "comment": "Malware payload (Mirai)", "value": "18c17c0ce75f6f7ad89004cfdd9dfbedadbd2b9675de62aa8c390c3a226412e22bdfa40623ea2949cadcead0430f3e62", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679064192, "uuid": "1f5f49f1-bdb5-44ea-9104-6afef087d77f", "value": "T19AB2C0DC61943084C98D7C7C178D4A664F6CA1D0BAED9B26E354CD98B3BEA8F3859078", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679064192, "uuid": "32417198-05d8-42c1-84a7-cb3683d42c76", "value": "768:obrQlS07dEv0UXqUhvQE+CXQKMQKCXBpsFZqSWvB:4QlS07FUXqIYSXQKqumqZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679064192, "uuid": "a17d48cf-d46e-49e8-a71b-5253c498beb4", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679064192, "uuid": "f0d71c05-8f3b-4e05-85ec-d13255ffba14", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679064192, "uuid": "ab5eae48-40c7-43e1-a827-747821fd0111", "value": "bc324e83ea1388359ac69d348b81edf2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19480a4c-c4a7-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679045748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045748, "uuid": "695d854f-efe4-49c0-9b42-53dc71f35e31", "comment": "Malware payload", "value": "2ba7b7647ad73da9e5fbfa864889546e", "object_relation": "md5", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx86", "colour": "#7C59EF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045748, "uuid": "a2d74aab-d7ef-4613-a2f5-14efeb8f874a", "comment": "Malware payload", "value": "a7d1f304613ea6cb32a7dcf156da59ae4714d81d7c5f6342556765399fc780c2", "object_relation": "sha256", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx86", "colour": "#7C59EF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045748, "uuid": "580490da-54cd-4cbc-92ae-6f4fbea27512", "comment": "Malware payload", "value": "68ed8ec1ebf06e778610baeae45ebee9b62bea3b", "object_relation": "sha1", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx86", "colour": "#7C59EF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045748, "uuid": "b895ce5f-223d-4b32-bc6f-8692b1ec083a", "comment": "Malware payload", "value": "d008c2608d6ac3ba78131d21f9c2d3fecd07b6cd3b22f6edc7da63b7d14d57c340cc0c692c36eeeb1bedfcb91b65c172", "object_relation": "sha3-384", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx86", "colour": "#7C59EF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045748, "uuid": "242abe3a-11fd-4284-b54e-a5d4fa075c53", "value": "T1BC726AC23485F7EE82A243317B5857D6D17EC60791CBAA04758C6F69AFF8C9B11A87C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045748, "uuid": "a4997d89-0640-41ba-8460-0742b678472b", "value": "192:YUF+3w360U5dSK787C5T3q5TNYlCH5T3f0l5TNYEBKTBswDy5g5+5jIpEuS8t+nP:Y8+A7U5dFBCq3BKT1HEuQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679045748, "uuid": "0a8eaddf-dc90-46fa-afab-03bdeaf724bc", "value": 17053, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679045748, "uuid": "d7e0f4ce-ded1-4dc0-8ca9-572db511c702", "value": "text/x-c++", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045748, "uuid": "d3bf415b-49e3-4a16-9c7d-24541a08c51c", "value": "ijhP9bHj.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51825c4b-c4a5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1679044983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044983, "uuid": "e8a09de2-b60c-4765-8ed2-9553f3e6b33d", "comment": "Malware payload (Rhadamanthys)", "value": "93ae777c9f3d3fd33c577da4aa0e1982", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044983, "uuid": "170c5336-72df-4580-a311-9be09569ecbf", "comment": "Malware payload (Rhadamanthys)", "value": "a829fa420f1df8e575312fd0b110fee2ee6c68ea9c7b36ba8be9aa5991a4f010", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044983, "uuid": "72390d16-fdca-4ad8-8f11-259fe30bb230", "comment": "Malware payload (Rhadamanthys)", "value": "91fd0e4f743bfe56fe3a7b440cbb2aeca41e7c27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044983, "uuid": "a95f5e24-7e7a-4c16-8643-8ba2cdeba3c5", "comment": "Malware payload (Rhadamanthys)", "value": "96fc31b39d935ec9195eaaad4213ccac84edfa7c1efba6646a03bfa85a49654f22cfd9bd8e8a2a1f3c9caf25d5bfd15a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044983, "uuid": "3bbf3dbe-7d80-41b0-880b-819ec9bf7ed5", "value": "T1DA34BF0393E47CA4F5124B319E2EC2F47B5EB8638E756B6723099A2F08B11B2C56F751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044983, "uuid": "5cd53441-bd10-4e6f-bfcd-255956f6f96b", "value": "4b2faf5e2157c756cf2fd31d6cfd3d44", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044983, "uuid": "eb50a09a-586a-4b48-afb4-10ac1e0ae2b9", "value": "3072:V3XLiNDjsYQZwOddrDeEwZg5G+4m5hIlEIWVgV6R1yd2vq1PXVZd7k7fhVsdJB:lLa6aEwaMAjIlhuydzvVZV4hkJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679044983, "uuid": "f80c88fc-091d-4511-8c12-ca6e2a5e1749", "value": 252416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679044983, "uuid": "5a48937e-b235-4b06-b8be-f65d517457db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044983, "uuid": "fc2dba84-316e-49e4-b72b-fc5c79bb6250", "value": "93ae777c9f3d3fd33c577da4aa0e1982.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "856c2196-c4e3-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679071699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679071699, "uuid": "41b0c250-9096-4c63-8e44-543366cdc41c", "comment": "Malware payload (RedLineStealer)", "value": "57e3fc905b5cb1811f155ec4aef82795", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679071699, "uuid": "7b81ba64-900f-41a6-993c-456832271cdb", "comment": "Malware payload (RedLineStealer)", "value": "a8509b53acec11ea8c6ca3845a9110d0c3477a60f4ca418f7dfd1a29f320765d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679071699, "uuid": "86486f5c-7d5c-402a-9594-444132141026", "comment": "Malware payload (RedLineStealer)", "value": "2ca77867f751067d96d1eb27828de238b403e414", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679071699, "uuid": "ca58b46c-bc1a-48b5-93d7-bb2c269c27c1", "comment": "Malware payload (RedLineStealer)", "value": "0f75633606daac7cac4fca4e32f70c3618fd70d39a71960920b45e9fe3718fc56062e61f10deb23d4c2696ffb8422fa1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679071699, "uuid": "a2dc5ade-d523-4a0e-b6c2-5e380bb8d618", "value": "T16455DF11B5E3C473D57211320AF4D7B46A3DB96209A2CDFFA7E41F6E8F30281D622666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679071699, "uuid": "9a181234-c099-4530-81e9-c39c99c48b2f", "value": "ad9a9e653c662aac447a2ff29709f237", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679071699, "uuid": "cf2b14fb-0cf2-4c47-a336-3de648ced34a", "value": "6144:4mh3jJZ9TCrzK/AO3d+2FaVc7xbciJSf7jLi7tlSd3njau:4oz/zts24Vc7xbjUf7i7tQdt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679071699, "uuid": "ad21b525-c894-42da-83f5-7c51f5af50a7", "value": 1335808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679071699, "uuid": "9bb80a06-f178-4918-92a7-8893cce3b906", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679071699, "uuid": "f436931f-3407-41ca-b54b-662348e4c10e", "value": "57e3fc905b5cb1811f155ec4aef82795.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f35f93e0-c4a4-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679044825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044825, "uuid": "03281483-b728-40e1-a05d-2e4671c6db1e", "comment": "Malware payload", "value": "993768d0c639952153dbc880fc45faa8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044825, "uuid": "3e911968-a69c-4a5e-8c3f-1518c8970b43", "comment": "Malware payload", "value": "a8d02444af732b67cd53f424dae1f5983634d55c04082f5884b28a42d772926c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044825, "uuid": "e2c5ff3b-99ce-4648-baf0-a2eed5f1fbb9", "comment": "Malware payload", "value": "46db94312c75ff71b89e53ee10682b3ccd9a26cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044825, "uuid": "26b62737-3678-48fc-9e6c-26ebc28d3837", "comment": "Malware payload", "value": "31bad7b885bb8412751d943a2bec052e28f459f847e4a408e7078f188620f94a91e7565f3b5ff1c7c8f378908ecc6450", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044825, "uuid": "1f1ad90b-4e4e-4c3d-b7ad-4f54574a427e", "value": "T1036522027AC545F1E57309365F689F22267C7C202F21CADBB3A4752DCE766C0A536BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044825, "uuid": "5d085914-2add-435b-89c2-1b4d00bf8428", "value": "b4070734502a100c8f90bbd445995533", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044825, "uuid": "c7a22121-1a9f-4422-a0c8-c279cc0f6d9c", "value": "24576:rconAINPy/C7r34l4pkbk9b8MX3AagtTZZZbX//S9Gdeqz7haCLIEkXmkcf7J0:bRx7r34ckQ7cpPq9G8Y7haCLIEhZDS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679044825, "uuid": "b9003810-95f5-49db-b881-8e4623137d75", "value": 1493233, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679044825, "uuid": "1b90da9e-e38d-4235-8d2b-fedd8bee99f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044825, "uuid": "070b1eaa-ad4b-4c14-9369-fb206f694fa5", "value": "993768d0c639952153dbc880fc45faa8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe18f9bc-c49e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679042266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679042266, "uuid": "3bb47700-9e53-4826-9228-943570d83bb2", "comment": "Malware payload (Mirai)", "value": "013eea6a87b43092d487d23ce884e202", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679042266, "uuid": "d2f6d79d-db72-460a-81a8-ca34c4762c3f", "comment": "Malware payload (Mirai)", "value": "a8dbe704615866dd9f66077027186cf93b02921779f1a13439e0ae573fdbd3ee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679042266, "uuid": "d52e1d75-6591-4bb8-9682-2f8f050086c2", "comment": "Malware payload (Mirai)", "value": "e85a37d3c8d2e155f5c27d37dde5893ffb1add66", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679042266, "uuid": "956ecb39-21f1-489f-b581-1a3134045550", "comment": "Malware payload (Mirai)", "value": "ea8e09952c6b37580faf447c26b8f30e5ad995decb4f7f3184b402e226a155993b616e07264222ea07e0c4a0c1c2b2ce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679042266, "uuid": "4e96c3df-ad77-4baa-8695-ee87cf871b5c", "value": "T17F534B17B54280FDC09AC1744B2BBA3AD93775FD0378B2A67BD0EB222CA6D211E1DD44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679042266, "uuid": "9a4a26a1-2005-4e7f-a649-36dcc82ae321", "value": "1536:dpmbSQ6U3q7cCBT/lZsK/0DiQaLiKimfFoktCe3fYRMS:WShU3q7cEDlCK/0Dy9i8Fok06fYRZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679042266, "uuid": "2f46f8f7-a39c-496e-8b73-001551a2c534", "value": 63296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679042266, "uuid": "2c7c04ff-8b40-40ee-b11f-d4ceb9ef08e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679042266, "uuid": "b61f1ca6-ccfc-43bb-843c-2020dac99028", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d1e4de1-c4a9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679046667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679046667, "uuid": "f51402be-e015-49b1-8bef-9a73e8e79889", "comment": "Malware payload (Mirai)", "value": "1150a21d317b52be966601dc580a1afd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679046667, "uuid": "5bca5b2c-ced8-4112-a7ff-d5a82c444df7", "comment": "Malware payload (Mirai)", "value": "a94981a0e1c42fca68b9f405226adf5ab8f26fab3c52299986070b2131df7776", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679046667, "uuid": "b2d0f971-067d-4190-9d6a-89a6840bb79e", "comment": "Malware payload (Mirai)", "value": "98cf9737f12023d9b68536bddb6a829e9c2e008e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679046667, "uuid": "32d831cc-a085-4abc-8fe9-f984207d47b8", "comment": "Malware payload (Mirai)", "value": "51c1c0d2306f713fa65945e76a21d387d81dd60312e3c9ef213c2625b6900309e59c92443a94fa8570cfc10c4f0038dc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679046667, "uuid": "c0309160-a93c-45ae-ad06-bc066e94aec4", "value": "T19A14B60E6E25CF3DFBA9863847B79F26965823C636E1D881D15CEB011E6038F641BF58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679046667, "uuid": "de720276-421f-43d6-a9ee-d6aede87c30b", "value": "6144:YnvltJn+OWXjnWuSl+KcbYhyrwHZaNo/TQJRkhd4/0M4O2LsKGAeTKKG/d3SWAdJ:QG14diHM0VvQ6V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679046667, "uuid": "bfe892d7-c382-4389-adf7-46dff071a55c", "value": 198620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679046667, "uuid": "0938e252-9664-4b36-89a3-a6db5a838ee4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679046667, "uuid": "a6f30d0a-a098-4a84-8fbd-17f409f2674a", "value": "1150a21d317b52be966601dc580a1afd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40f82404-c4f6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679079744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079744, "uuid": "d8364d1b-eeb5-452d-bffb-a13746b512ab", "comment": "Malware payload", "value": "cf1ec985662c4e9087741bd5d405e22a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079744, "uuid": "9c586eae-caf2-48b0-ab38-2a141c6b2957", "comment": "Malware payload", "value": "a9554e16bae1fe7df460614d3eb0134b4ff22aeae920d49bacf9c28462c7c8be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079744, "uuid": "c9f9dde2-c7c2-432b-a105-b5c9f057d2c5", "comment": "Malware payload", "value": "0d579f524a9e1f8b113b62748ab0c9d93bbeb2dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079744, "uuid": "65315120-92a2-4ee9-9913-e68115b91acc", "comment": "Malware payload", "value": "649009f708d7859f63da77cd41bae43ee8b7c7d2dab27fa1c428c759cbb4cdd02deb765d02894d7457b06158ed5e09dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079744, "uuid": "c4e4d7d0-4021-42ae-b5d1-484d00bff707", "value": "T1E4E423327240E036F49269BD1915CFB75B2E48329262D8C7AF252212DE317D2A3BB757", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079744, "uuid": "d1646891-79e5-42c7-b8f4-3f7a2ce0527d", "value": "12288:W2P+xxbSpRnfS5rb/FkM4MjQhiiS/6FBWPxcRTJ57NMytT0qjifNaHMiBGlpFdWd:/uqnfwrbaCEihi1J5hMyHeFaH4pT2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679079744, "uuid": "929a566c-d1df-4f82-802f-f9c6065a7969", "value": 679965, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679079744, "uuid": "27f0de8b-b3c8-4aa2-a6f5-28caa9ab8748", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079744, "uuid": "236ce6bf-8ad4-49a4-bc08-cdf241a955ce", "value": "cf1ec985662c4e9087741bd5d405e22a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c95dc0b5-c488-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679032729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679032729, "uuid": "434723df-43b4-476a-8512-d69e40be17c4", "comment": "Malware payload (Mirai)", "value": "bf7ee5acb1b1492214013d8fb2133db5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679032729, "uuid": "996460b1-927f-43c3-85c2-78d1dcfa37d6", "comment": "Malware payload (Mirai)", "value": "aa6d22db582f23f529f8c5666abe08f94d88cfb9b411c9b15f64f7b5192ebdd7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679032729, "uuid": "0ee42d49-c0d4-4c56-aeaf-7dedd95d41b5", "comment": "Malware payload (Mirai)", "value": "60c489fa7bff4b8ac2be4e3f1b3306d7e4619fad", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679032729, "uuid": "56b17b58-8bb5-4298-b4dd-a9587749486c", "comment": "Malware payload (Mirai)", "value": "d7c26153e77b235a3dbfa6d4339c179739b7ad89a7b974f9d0767a3e16b68c2bb9e6a201f99042228aa8b9969e26ba60", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679032729, "uuid": "9e6fa2a7-7ea6-497f-99ae-50a1b60852d2", "value": "T1EDB2D114F2566E95EFBDB871BCE1DCCC77D82B0D72B28DB182107E21A106911FA16BD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679032729, "uuid": "eee5b001-b30e-4cd4-8979-5f0741ed549d", "value": "768:wLExZlAmh0PMTKXfrnB0p76vZD3r4uVcqgw09g:wLE3loQKXDnCUt74u+qgw09g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679032729, "uuid": "74549032-9554-4e0b-b635-8347c4bcd6d9", "value": 25636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679032729, "uuid": "252cdfec-0336-49dc-b2d3-59482f94f15a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679032729, "uuid": "d984bdf5-5067-43a9-a84d-09931147d128", "value": "bf7ee5acb1b1492214013d8fb2133db5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f10bacaa-c4aa-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679047398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679047398, "uuid": "ac6959a9-18c7-443d-a126-58f2e8bcda9f", "comment": "Malware payload (Mirai)", "value": "f11b42b89b9ad32c54265ee40a762308", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679047398, "uuid": "491178dd-7a57-498a-b697-36365f0a4b5b", "comment": "Malware payload (Mirai)", "value": "aa753be6573e164792eb3ffafc79771529a995dd753919d939bc25a755a25962", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679047398, "uuid": "81fd468d-d9a7-4b84-991b-d5c322c75149", "comment": "Malware payload (Mirai)", "value": "35b1f8abb0e89a7f2eca30fd8434b31e9114583f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679047398, "uuid": "a151e502-4298-4ec0-b09e-6ff2af8072eb", "comment": "Malware payload (Mirai)", "value": "b08550a173c2dff2936a90cc4a5cfc60cd74f1ad39acfe75f6e5fb192459f6088208b3d92a1f9187ffe8c0ea417769c4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679047398, "uuid": "727a6ffc-45bf-4f9e-85de-9500903eded9", "value": "T154E2F1A7D3629012DE383BF2F96D85CB2BBD4BACD17A70A21B0556287E460435F3C852", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679047398, "uuid": "069265db-8b66-4a3f-94cf-3a1f5e1ac8fd", "value": "768:noiWiO031vpAPbrVWZK3XVGxm9XEL9q3UEL5Ie:norm1vpALgUJEqLR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679047398, "uuid": "32a07608-59c3-40f9-8fe2-3382b3a292e4", "value": 33036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679047398, "uuid": "1bfa7591-7d23-4f8c-817e-fafa68c2f95e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679047398, "uuid": "36e7453d-ebe9-46fe-914a-1d9a6b68c768", "value": "f11b42b89b9ad32c54265ee40a762308", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51528443-c497-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1679038970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038970, "uuid": "fae0d6b6-9046-4c96-9922-38a9caa781c5", "comment": "Malware payload (Heodo)", "value": "87e6d4c09602d4ad3fffa14f0859e4ab", "object_relation": "md5", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038970, "uuid": "00de29dd-d4f0-48f1-9f82-b1541c5cd042", "comment": "Malware payload (Heodo)", "value": "ab29f7e0adb4c813c74e69ab272ec00f0e9e1270e50fc3e38ce85c3c679dbc6f", "object_relation": "sha256", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038970, "uuid": "6b9fab6f-3c89-4da2-b0ea-e1159a183b27", "comment": "Malware payload (Heodo)", "value": "8655b4753c3bc2c24c3c4ac43ce51401a9248fc7", "object_relation": "sha1", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038970, "uuid": "c54f71e2-ac22-4fec-885e-b3e81e578549", "comment": "Malware payload (Heodo)", "value": "e27e1d5f1e07802f455daf705bee69c2966084d1481433597c408ab0c89deebf9e805e7ce19da13c994a4f20a25e5e08", "object_relation": "sha3-384", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038970, "uuid": "983eebd9-9066-4dbc-acc9-7d421d01f951", "value": "T1D6C33BF1A8025C0AE123C976B1FB661399D051ED42283B2BF87D507DD978A20D6DD8EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038970, "uuid": "136c452a-b64d-4c31-9e6d-4113a808c58a", "value": "1536:RDBoTVdaeNtuXndCrJJmT4HVnteV4FrdMiYcx7bfCb6HPdnXo:1BoC+tCYvSMVnte8ZP1Y6J4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679038970, "uuid": "baa65424-dd77-44f2-9d0f-af409a863005", "value": 120428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679038970, "uuid": "a59c193c-c9c0-4748-9292-ad820d6289ca", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038970, "uuid": "f68e6d9f-3d3d-44a9-a69b-8a45aa1f211b", "value": "INNOVINC.one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43236c5f-c4a4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1679044529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044529, "uuid": "2d4606d8-e068-4f99-9507-2b40e48aaf64", "comment": "Malware payload (Gafgyt)", "value": "61ce623ddf1a209a218d2828075d9588", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044529, "uuid": "3a0b0aac-cad2-40ee-a7c0-4b1f096088bc", "comment": "Malware payload (Gafgyt)", "value": "ab43eb18d3989b54cf34b072e47b654bd68db584eef98a3b6240a9a31c57fb73", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044529, "uuid": "2ff2902c-29a3-4e15-a68b-0d31f25776be", "comment": "Malware payload (Gafgyt)", "value": "cab031446450a627c939920c31c32c988a2edd8d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044529, "uuid": "4c515879-593e-4296-b67f-e8577d6d9407", "comment": "Malware payload (Gafgyt)", "value": "1ac256f1b63d099aa40c773cb7c31e25f0d08053d880ff90587648a011aacff58acb1c3f0441a2706e7c06c89068191c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044529, "uuid": "4ca1fe96-d69b-4d3f-8ad5-f0c42f3503d7", "value": "T1CC833B43772D1B93C49BA9F02DF727F183A9F96112A255C0A10EFFC44376AB02516F69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044529, "uuid": "6eb0415a-47fc-4a99-a203-c9e7138c99bf", "value": "1536:CQGr7TyU7Y7gPpcO5CFPQ0LgbI1wKgXLS96rm7yVqp4v8nkmS:Clb/7pc/pDnSXLS96rm7yVqpU8nkmS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679044529, "uuid": "7b445ed5-9c05-4c6b-8b16-17a33c8badc9", "value": 84832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679044529, "uuid": "f354da1d-9733-486c-b69d-a680e8172061", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044529, "uuid": "7679f397-fb68-4bbd-bbec-926cd09d4829", "value": "61ce623ddf1a209a218d2828075d9588", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e35b9673-c4d6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679066273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679066273, "uuid": "981a6777-f5e9-4e03-ac8c-bf906999a69c", "comment": "Malware payload", "value": "30e9080923e6188573c1167c60e79f73", "object_relation": "md5", "Tag": [ { "name": "docm", "colour": "#502578", "exportable": true, "hide_tag": false }, { "name": "maldoc", "colour": "#51DB1D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679066273, "uuid": "4d8dc280-b0c3-4f41-b220-482fe0f32150", "comment": "Malware payload", "value": "ab4d7740ac5322ec82f286477da1b147413b93218fa230d6f7692418314c002e", "object_relation": "sha256", "Tag": [ { "name": "docm", "colour": "#502578", "exportable": true, "hide_tag": false }, { "name": "maldoc", "colour": "#51DB1D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679066273, "uuid": "4be8290c-429c-4fe2-b1c5-d59fcca2c3fe", "comment": "Malware payload", "value": "4fd2149c32c044ef407dedef73494ade2b62f716", "object_relation": "sha1", "Tag": [ { "name": "docm", "colour": "#502578", "exportable": true, "hide_tag": false }, { "name": "maldoc", "colour": "#51DB1D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679066273, "uuid": "137f7779-40e9-43f6-a999-127ac2aa7db4", "comment": "Malware payload", "value": "d86906ab410425aab4cd7afc0b7e38066e755a45b6ff8100e8108d973405cbcbd584114ea0d7ccd618ab65b89c2cb365", "object_relation": "sha3-384", "Tag": [ { "name": "docm", "colour": "#502578", "exportable": true, "hide_tag": false }, { "name": "maldoc", "colour": "#51DB1D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679066273, "uuid": "eac2c359-93ad-48a2-aa4a-380648e485e0", "value": "T171A2C0B5ED17D0A5E233B13057929062F6680D5A9AAF346B1FA833CDCD10948972B8CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679066273, "uuid": "da09161e-380d-48d0-bd22-ab8b4a4af4ce", "value": "384:PXqMlP1Y25EI+7hh1NPNrLRw7281AxFN2G+20Z60R2VnzL9/yIsb/r2WGyEdcvA7:T1YIEHj1rPM2YAxFN2/2zxQD7idLkc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679066273, "uuid": "1df96749-a8a9-4cb6-83fe-ba098a7ad552", "value": 22050, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679066273, "uuid": "ad040538-3e03-443e-bd78-e8a4b76fe70e", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679066273, "uuid": "c9be3bcb-2dda-4f01-ad3c-2bb506d0ba59", "value": "Bul letin Alert.docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65d57252-c4db-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679068210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679068210, "uuid": "ec97a146-c7c2-4706-add6-681ffd9bf6a1", "comment": "Malware payload (Mirai)", "value": "00ab0c36ed9b50085d2b3efc9553b121", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679068210, "uuid": "b0e54090-03f6-427f-8289-e827de2dca8c", "comment": "Malware payload (Mirai)", "value": "abee6d61a2fc02699532f07e481f8c77ba560afee17f594f7ea65904088f71bd", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679068210, "uuid": "a823e1c0-113e-4ee3-ac0d-f226c552e57b", "comment": "Malware payload (Mirai)", "value": "55b0c3c032619f2788dd4ec793c399fefa9265e1", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679068210, "uuid": "b3807183-20c7-49f6-87c4-ae0f9ed7fd83", "comment": "Malware payload (Mirai)", "value": "67be6f0e80392e1182b8c76f182b2cddb5a80d41b182e51b7349f71a7941872f3bda25babd189f4ed4c1d8dbbb8390f7", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679068210, "uuid": "e64faed2-512e-4213-a89e-d55f59184869", "value": "T11333F14196DBFDA1D6BC387ADD3587412D6B4FBEA1E85CF31144A73D98B1C03AC69180", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679068210, "uuid": "62513533-0c87-43b1-a958-db3c813da71b", "value": "768:DRlxCkeVD1RrqpdbEdVvdy+OCPZU0wRG7Nc+URuT9q3UELJVlRYibiV/maDT:DRlxu7rWgnvdzdxUjRXRuSLJVkV/mo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679068210, "uuid": "b491c1aa-d40d-4d44-a366-b04eabd13a77", "value": 51812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679068210, "uuid": "0174f89a-dc0a-49a3-a4d4-54392d064d39", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679068210, "uuid": "a55702c0-7764-4f6a-9e31-27c5bc85f92f", "value": "arm7-20230317-1550", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aff095ce-c4a2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mekotio)", "timestamp": 1679043853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679043853, "uuid": "4f59af89-d48a-4ddb-a805-98e73b10f0ec", "comment": "Malware payload (Mekotio)", "value": "a6f2f458f16134d9906f219c5a6f37e4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Luxottica", "colour": "#1FA906", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679043853, "uuid": "36c2b15a-dba0-40bb-800a-56b8d8ce803d", "comment": "Malware payload (Mekotio)", "value": "acce97ae8802f1622e40ca50c01fbd28afea196ca6b3e2dcf905918a99bcf85b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Luxottica", "colour": "#1FA906", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679043853, "uuid": "2b5a0d4f-9752-4377-a0c2-206348de5e37", "comment": "Malware payload (Mekotio)", "value": "f86a2276d7a06294aa2a33c93a38679c30eaa436", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Luxottica", "colour": "#1FA906", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679043853, "uuid": "b9884c02-24d2-4b1a-a3ed-ff2062d22728", "comment": "Malware payload (Mekotio)", "value": "6457c29e0ab2a8edba19389e009018148c3dbed4644e1937368a9893d9939554073f4937c53c9413963af31d37a50baf", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Luxottica", "colour": "#1FA906", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679043853, "uuid": "acfb6517-d8e5-4e5b-ad4d-9446f028cb14", "value": "T1CB862363769A1150D5FEC7798F23BED135F2132C9161403AF8A4ABCB34D47E4DAA2A43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679043853, "uuid": "9663498d-da32-4b74-90e2-aecb3b99f3ea", "value": "f85ec7edf92d250a4753232b13c06fb1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679043853, "uuid": "11723a8c-3810-485b-910c-d50006888aad", "value": "196608:E+UBdpyjrn34Rl0oTvVlRXIrIdIPsgM4FCK7Kf0QDs:ujyIz02vFXIrI1wfKfr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679043853, "uuid": "cd7278ee-3279-4547-9b98-364d4fbb2386", "value": 8381440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679043853, "uuid": "d638ee66-98bb-4fde-854c-f6c9837eaff2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679043853, "uuid": "ad5977f9-7a4d-4882-b86a-37b2e12a8676", "value": "MSID8D6.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a679216-c4b6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1679052326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679052326, "uuid": "7d8a694c-ad0e-4baa-b1f9-aee7343c416f", "comment": "Malware payload (Gafgyt)", "value": "bc8a4da3d15a1c5a31eba01bb609d67c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "Ladvix", "colour": "#45ECE4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679052326, "uuid": "7c957d53-a234-4683-b48d-92208f4de6c8", "comment": "Malware payload (Gafgyt)", "value": "acef6f73e8edd482ddc6fd032489dddbcd026ab6ff8b02ce4b6b922caa868664", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "Ladvix", "colour": "#45ECE4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679052326, "uuid": "9616edb1-2e8d-476a-9be2-bb87613fbee0", "comment": "Malware payload (Gafgyt)", "value": "ba29e8a02a439ec4d3af5fafebaeaec68ea75b54", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "Ladvix", "colour": "#45ECE4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679052326, "uuid": "955eafd0-86b5-4f0f-8ace-95ab328b5ed7", "comment": "Malware payload (Gafgyt)", "value": "835f33a3932260282fdac8b30bd8479542b4fed45ebe8a1203e1074d4ad38955b5375fecf0ebc83f5541cd5cb1c12511", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "Ladvix", "colour": "#45ECE4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679052326, "uuid": "89ad80e2-7745-4eb5-95df-15cfed28c1b7", "value": "T15DC31913B7A1DABEC08252B12BDF92F19423FC7D0732622B33947DA51B399D96D59302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679052326, "uuid": "8cc69b42-735b-46c7-9bc7-b512ee443620", "value": "3072:62Rfd0wrSAewzi+Xn+8Uhw6W+aPLJmDk1c8xF6KjW:6IZfO8IBeJmDk1c8xF6KjW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679052326, "uuid": "0f502393-7626-4ab0-b799-a36e28a34bd6", "value": 123232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679052326, "uuid": "230e9f96-4ba7-41b5-934a-dc60d53834ab", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679052326, "uuid": "18a9ed4c-7e5c-4782-86eb-1601e80d538d", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77a00612-c4c4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679058361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679058361, "uuid": "51d59258-fc93-4278-a88d-75733fb63135", "comment": "Malware payload (Mirai)", "value": "a976d7231138de090441c1a98e42d707", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679058361, "uuid": "eb144a61-d643-4e1f-b4ae-d7bae6df2baf", "comment": "Malware payload (Mirai)", "value": "ad5d1c60685f3ad46d916efd94b48ab8e19bd316c4b3b41fb2325a5651d49bed", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679058361, "uuid": "8b37bf09-7e6a-43b3-bf96-c366e286dd8f", "comment": "Malware payload (Mirai)", "value": "a7759b399eff3e4fea66019f4e26b147a9d30933", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679058361, "uuid": "7495b086-dd27-4f3c-8f26-aa86096d5ce4", "comment": "Malware payload (Mirai)", "value": "5a965c9c2ad4bc68aba4cbcc6dceec4d31cc01ea38c5fce30f513c6d7bb62880e2ff36a91af0f421098d7b41f5c5df30", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679058361, "uuid": "200651ff-f391-4279-aa56-82f9e0ab0e92", "value": "T176B31945F8408727C3D327BAE78F478D3B36679467DB33116938BEB42BC17992A29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679058361, "uuid": "e2bd2be1-f376-4a5a-bad6-d075c3367d80", "value": "3072:tS0+G6m1qWvpEQUPN+bPmkZrQAhPDCXFke:b6mgWvOQUPimkZrQAhPDCXFke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679058361, "uuid": "f2d731f0-b0e9-4ca8-8e70-e6b58256df9a", "value": 108414, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679058361, "uuid": "1aa03a59-c56f-4f4e-a37b-a693b85ca327", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679058361, "uuid": "e72f7a76-0924-4124-844b-71e228c2aa12", "value": "a976d7231138de090441c1a98e42d707", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d96282d7-c49c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1679041345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679041345, "uuid": "b750234c-9317-4b9e-af40-61b1df814655", "comment": "Malware payload (RecordBreaker)", "value": "a2ab383cdde5675d7c562ff7e36ad8a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679041345, "uuid": "0944d2fb-ca90-49a5-befc-bfa0d56ecd5b", "comment": "Malware payload (RecordBreaker)", "value": "adaa35694c74c94657d548eab91db02feed194aa94497b5e99473427ac5de6cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679041345, "uuid": "2ad06c69-ef74-4f14-baee-0c7274f668e5", "comment": "Malware payload (RecordBreaker)", "value": "99fb0b12d1b471695eb4619d83cd137b512094ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679041345, "uuid": "80e4252a-95f2-4622-8b23-7dbb57a4df2d", "comment": "Malware payload (RecordBreaker)", "value": "39f9ae6b738da3ab8c1047bd5d7f98e690a21d15c34b743cb8ec1669e27db97348e02cf925fbf1f5e42605971642b41c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679041345, "uuid": "a6fe65ac-dee6-4d66-a51b-0b4af09a9d21", "value": "T1B32726A8DC2D3BC6B3EB9329F81094749E944C7F99CA6017B0679B20043F7861A9D77D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679041345, "uuid": "2639ac1c-b556-4073-8216-c92ed6020ddd", "value": "00de631d57481fec13b7898c99324f13", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679041345, "uuid": "c4ca9845-f095-4ecd-af4c-bbff95666970", "value": "98304:3Vde8FivCeGDRsiSc/XBgZrzyWGgRSL6O2jSk6adBNWuz+VRD0MbQA:HZFwAur6XBazEgRSSjS5aT1z+/D0yQA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679041345, "uuid": "4728afc6-47c6-467f-985b-cf06eeb9c4be", "value": 20375812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679041345, "uuid": "d28e0f33-62a3-48b6-8165-ab603e7fee99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679041345, "uuid": "832ec804-643b-49b0-a035-ec449dedff91", "value": "a2ab383cdde5675d7c562ff7e36ad8a1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffc30e58-c4ca-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679061167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679061167, "uuid": "52b8e0f5-d86e-452d-a781-81c57ad749fb", "comment": "Malware payload", "value": "d2fa4fa1b7f8d5d6b5d0bc2518b5d5ed", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679061167, "uuid": "89f8ff06-a04f-46de-bf28-9f2a8c2ddf82", "comment": "Malware payload", "value": "ade78d767004ac92021c519bd14e21d769a87b70020cbe8e9b660d7ae85ae101", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679061167, "uuid": "9a436e42-72eb-421f-856b-5e2ded67dced", "comment": "Malware payload", "value": "9fc30b168c81af53d2fc6cd04f5a9d85dcbe0f73", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679061167, "uuid": "5575cc59-c390-42a9-81b7-4fae1a1bdb8c", "comment": "Malware payload", "value": "37f5d892fb7ffcb5aca7b11cb2ae43cf10b5018831094d9c259aae1190ea2a6007f2915feabcc309153c70572bba07bf", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679061167, "uuid": "5ebcf37d-0b6f-40c8-9a2e-7403cdf51fb5", "value": "T16455BE405F9D9B1BE48D63BAB43157DBABB4E056998FF70F44013CD84E8A7C86C4B292", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679061167, "uuid": "cdeec5fe-68c4-4acd-8a29-806c83117a02", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679061167, "uuid": "6812c0e9-726e-4d8d-ab65-0cf27100e972", "value": "24576:dUZqSpHqcyazRcQonCx2Wlw2GiYf7xIf+OR8oTZgohmbTO6iPM:CZqStyaFQWl9Gic7xI2Oa+yKr6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679061167, "uuid": "bc9f3c4c-98a9-4554-94ec-9f0a9c41a648", "value": 1344512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679061167, "uuid": "ebc07c68-3bdb-45dd-9260-842f837d9544", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679061167, "uuid": "21f7ce9f-f792-4815-a537-fd1262555af5", "value": "Anrwqjqr.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ddf55cd-c4c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1679057003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679057003, "uuid": "f5a1ef30-e70b-4ecd-9e25-20213823ab58", "comment": "Malware payload (Formbook)", "value": "cb3076776575b46d148767869b6bbe28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679057003, "uuid": "2c065c03-55b4-4046-88e2-267988c64e00", "comment": "Malware payload (Formbook)", "value": "ae5b981a55ba0eaa4cb03700d54e3a78799590691315b2973ef1e4e16b2e8c9d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679057003, "uuid": "a792cac3-7ffb-474e-88ff-f687dac2066b", "comment": "Malware payload (Formbook)", "value": "83a7f44415ce3ab15f22957fbc2111d11cdeb301", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679057003, "uuid": "b89249c7-30f9-4b23-b8ae-4b1cdc2efe94", "comment": "Malware payload (Formbook)", "value": "b051c7fec738317915760697084592ed837be8d931a40ed58003e5374c7a281cf436599dba40155c8f8930e6e55de78a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679057003, "uuid": "dd2871a1-a820-4eaa-a76b-7aa63437ff3c", "value": "T17E05024EE6E4952AC81C0BFAA4A3A450527169276F82DB1F6CDD81F62F127FFD4019C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679057003, "uuid": "ed994cb7-f9e7-4c98-a370-17ceaf4b904f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679057003, "uuid": "0bc11868-d63f-4a90-8203-0a114970a499", "value": "12288:MmERQwoL8zaV5kTOWV/EMzrW0Ud4OG1ZIwExfPlupDLPGiE1lwgMyicvQ:eRQwc8zaHomMdUuBIFxne2KoQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679057003, "uuid": "4e557513-dc8b-4a79-adad-c35533ac4417", "value": 843264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679057003, "uuid": "c84fde00-a6d4-43ac-9707-2622782773a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679057003, "uuid": "19aaa07a-9821-4609-877b-a3b36a76df45", "value": "BS Orden de Pago 20230315-1000_0000015444552000_001888.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71c3b925-c4a8-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679046326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679046326, "uuid": "227c678e-aca6-46d5-97ab-f4b606382049", "comment": "Malware payload (RedLineStealer)", "value": "d4da20f99003446d674869a51d350673", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679046326, "uuid": "8b9c0b8c-008e-4243-9b0c-4caa5cc6ae14", "comment": "Malware payload (RedLineStealer)", "value": "ae8fabf1b80c3cdd3b427b0932de0e819b4658f0e639165296f8d6c6494ffb2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679046326, "uuid": "a6c92bba-bc87-414c-8aca-ef9bfb58a03f", "comment": "Malware payload (RedLineStealer)", "value": "fc2109cf566af92b5ad7dd2ba03bad4af72feff5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679046326, "uuid": "e4efdee3-d418-40ee-8c06-f1389f887524", "comment": "Malware payload (RedLineStealer)", "value": "051277168fe1ebc5a7e82f5347589f263342ef2ccecfd6082e75da80c4d69402f75a7ff5c2da147f412c55567f4c815a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679046326, "uuid": "a23e433e-8cba-4725-8aa9-e4d01fc77a8a", "value": "T10C04D62437FCCD11E1BA1A3F6961A05146BF98026C52F25B76C367CD1E32B40F957AA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679046326, "uuid": "a345ed61-0500-47dd-998d-be7f7fcb5f4d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679046326, "uuid": "cf978202-f265-480f-b3d7-d1c243fe7922", "value": "3072:dxqZWJnaxIF63jRSMqt4uejh97hyHxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jq:nqZBjRSD6p7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679046326, "uuid": "2675a861-0ab8-4c39-bcbd-fdd163d92d30", "value": 179200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679046326, "uuid": "3ae6fa07-f9f6-4902-892d-704856b66888", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679046326, "uuid": "ed519518-a890-4e7c-95f0-c7bef2f2a4fc", "value": "ae8fabf1b80c3cdd3b427b0932de0e819b4658f0e6391.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbe2fe22-c49c-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1679041323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679041323, "uuid": "641a5b80-b6b8-4205-8b1c-05fd342e1625", "comment": "Malware payload (SnakeKeylogger)", "value": "b873bf4d1862b8a0fc6ccf7f04c80567", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679041323, "uuid": "5693e0c4-4ea9-4f7b-8ded-31622aa79d38", "comment": "Malware payload (SnakeKeylogger)", "value": "aeaad26f7cefaefbc5bb668ac5891281bf21c63c7aa82e727c0a4ee39250b33c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679041323, "uuid": "8b2a4f3b-d93d-43b0-a031-1bb4f77e8027", "comment": "Malware payload (SnakeKeylogger)", "value": "e2f12377c8a7581cfa1d528b60c40e8f05500e31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679041323, "uuid": "a86cc360-54b4-42af-9894-a653d5c25b44", "comment": "Malware payload (SnakeKeylogger)", "value": "4622d1f8a5de2bfc44df5f3b8a463e31e4a3896210262165c82e9d8b0f7aff5abddaca8c255900d70b19498b0be2316b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679041323, "uuid": "9acfcf61-bf37-498e-aa7c-0d0051de9f81", "value": "T1D1050258B215EF61CA7D87FEB0B4202193F3980E962AF3485DCE64EE6A73FA10505D47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679041323, "uuid": "7e53cb15-f0ba-4034-af09-4fd353a7d91e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679041323, "uuid": "e2fde828-468a-4a2c-a8a6-dc6311b0ad24", "value": "24576:HBjkj+SMQt1Yr3KYCQf5CG6DEfuuWcrhHza:HBjk03aeJrA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679041323, "uuid": "cf4306ff-45dd-4f50-9eb6-fa1bf228474f", "value": 824320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679041323, "uuid": "ac2bc1bb-3f90-44cb-b42e-c545e8a867b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679041323, "uuid": "9bd58a7f-4ca0-4973-a7fc-ae7d115f485c", "value": "Order Ref 53089.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf226901-c488-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679032738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679032738, "uuid": "af2dc655-3196-493f-8bec-192bfe2bb057", "comment": "Malware payload (Mirai)", "value": "d330e9e843e7981c91d1762665a3208c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679032738, "uuid": "0e04e681-a7b8-4fc4-920c-f73bf04ae841", "comment": "Malware payload (Mirai)", "value": "aefefa25a2f92ac3a41e0ab88eca08cb70efe79bef600b165480a0f40ffebf2d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679032738, "uuid": "3213e2c3-0b84-43c8-9fc8-6eae04cc0c16", "comment": "Malware payload (Mirai)", "value": "8c4a681de29692b41a5c9502ef890e0f87b9f8dc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679032738, "uuid": "bab25a92-dc09-4cf0-827f-2756e1c2a794", "comment": "Malware payload (Mirai)", "value": "ddb61493822dd8b061babd03ed1329558bf3ba84cd6074b9888cf3de2f3575635cea69cd168c02df9ffbae5f9ab94c29", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679032738, "uuid": "e391c9b3-e738-4894-af7d-816d63485257", "value": "T127C2D020151B6D13D2717832E97C426B1E6986ECE0F7A562172A5B11AEC2003A9FDEC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679032738, "uuid": "e760b95b-9a5f-4dae-a8f6-970d41b6e3d1", "value": "768:HZ5DJvjb5M8CqaV9Yr67ie+8KEnpgwkChgJo2b9q3UELe:5NJvpvCqu9YrTePCChbLe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679032738, "uuid": "5255c590-b12a-457a-b2bd-c050683fd6ec", "value": 28056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679032738, "uuid": "7249582b-fff0-4a5d-876f-e0ae9549b938", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679032738, "uuid": "6bca9558-5c9f-4d0b-8ab7-65bd1d242deb", "value": "d330e9e843e7981c91d1762665a3208c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e75478db-c4a4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Nitol)", "timestamp": 1679044805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044805, "uuid": "161623e3-3924-4839-99c8-0d21646c80e6", "comment": "Malware payload (Nitol)", "value": "36a8cbbbd3bff900881efd9982bbf5c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044805, "uuid": "8f108162-7e30-46ee-a7c0-525c131c01c7", "comment": "Malware payload (Nitol)", "value": "af1d011c95382ac51486221561ec920b4606ff2083c29fd4667c61d3338fd5b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044805, "uuid": "b24e7ed8-2d70-4ba3-9e22-21c41eba700d", "comment": "Malware payload (Nitol)", "value": "c52ac18145b9e6d2e294798eb5c4d5ae58b80dff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044805, "uuid": "46e34849-fd85-4b6b-a2a9-8c787776a228", "comment": "Malware payload (Nitol)", "value": "24b3af774fa686073492249bb85c2f876056f021ddd7e0d1ef808d8bbaa4d798da736f1af6df5643331e57fb8f16c7dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044805, "uuid": "ab61e784-4236-439c-9c29-4689fe767c17", "value": "T1124523750E051922E3E2DE718AFBD28ABE7868410116C213F179D53EFC2B7E27995327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044805, "uuid": "d59c6aa7-d221-461d-982d-a9deb535cbc6", "value": "1f32788688d13577260c655bbaea02b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044805, "uuid": "afa4e256-0fd4-479d-a2f7-f0105ea5da03", "value": "12288:9Z/q3ViIZG9N2/pBi6hSKiWXg7y+/gUlymNChQS8dKKTo:Xq3VN0S/pBicSAg7zYLTKT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679044805, "uuid": "f4267c36-c7f8-449c-ac05-84fadd9655e9", "value": 1208320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679044805, "uuid": "e61abfda-1cd3-46b3-96cb-e2a5bba0288e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044805, "uuid": "481dd5a8-b152-4319-b38e-b58b62aa2f38", "value": "36a8cbbbd3bff900881efd9982bbf5c1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c64f951-c4dc-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679068731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679068731, "uuid": "d8298367-f388-41b4-811f-6adcef7366c5", "comment": "Malware payload (RedLineStealer)", "value": "675866059db486b4a5209bde11918032", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679068731, "uuid": "2d02737e-8ce9-44a0-92da-709897840d9f", "comment": "Malware payload (RedLineStealer)", "value": "afe24a0eff34830714bf290b21f7291fc7000c57b9588ebc5ccb2d069ef0b2d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679068731, "uuid": "0237a9c4-105f-47fb-8540-915fa678b03a", "comment": "Malware payload (RedLineStealer)", "value": "16473b58702a45906e3759b190ed3b83fc4718dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679068731, "uuid": "ef1f7475-35cd-4a79-98ef-5fa2423831e8", "comment": "Malware payload (RedLineStealer)", "value": "66113dd62796475f102b3ff7d5d61629ab1797c4539f56366289e3010616e8da68101f4bb3e55ff9f53bc411265c1b2e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679068731, "uuid": "90ffc1b1-e253-49dd-ae9e-f90bcf9948d7", "value": "T19F450153A2917C4CF9268B7A9F1FC6EC771EB6608E49776931189A1F04B21B3C163F90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679068731, "uuid": "dab2dcfe-e1d5-49c4-ab1e-48283d0f67d1", "value": "6e76b494f1a9946f83b6b72033f310be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679068731, "uuid": "89b5bfd6-0dc2-4501-a4b3-7ec04b49be3b", "value": "24576:DuqnfwrbaCEihi1J5hMyHeFaH4pTOh9asj0bWcT9pyKBH:D/4rbF2MyHeFaiOh5cp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679068731, "uuid": "cff3872f-8275-432b-b87b-09eeb3bc279f", "value": 1235968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679068731, "uuid": "5f9b5e96-24f4-42ef-90a2-28b9daddc17a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679068731, "uuid": "b27c8416-cff5-4c3a-8b90-a23622d75c9a", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47517db6-c497-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679038953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038953, "uuid": "4a0c9820-7aae-4229-951d-cd56dd7dc8ed", "comment": "Malware payload (AgentTesla)", "value": "e00884af2e09405dada9c65994d9a6cb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038953, "uuid": "902f7b6d-a70a-490f-a302-2eda5617f450", "comment": "Malware payload (AgentTesla)", "value": "b05951994381eb4d953d58b7ffa7c428be1f640d8c70d70adbfb4a046fb6dc6c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038953, "uuid": "2508c4d2-1879-466f-bbe7-8f0f02779a78", "comment": "Malware payload (AgentTesla)", "value": "3a0071ce7a0056f82304ab9b81c1dccf802496c7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038953, "uuid": "a6638c23-e440-47d0-a45c-1897093dba26", "comment": "Malware payload (AgentTesla)", "value": "e6342b2487a7bc4f801aa8f9579a54cf5496bf7454636e644301ec9f3e59520c25d1dd78d4eaa244ab61f6ac53751d3c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038953, "uuid": "09fad302-11a3-4863-9004-8030a7cc1b57", "value": "T18C05331CB7AB3C5DC3F640F3492928981F09E01396421F952B2FBAEDC295E78C563862", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038953, "uuid": "4971ca3e-14bb-4dd7-9e43-7bdeaaae967d", "value": "12288:oML7nvXmvK+nAFIslcM2psx5MZiTyJ8JkwrIHI1dZ3vjIPpkEHty1wHpvglDpsr9:FmvKs2ItMT5Mc+qGW/jIxC1wHppSBK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679038953, "uuid": "2b2d5830-060f-4df6-8075-816e96ca5bc0", "value": 824896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679038953, "uuid": "38ccf3bf-fffd-46de-bcde-e6a428022d1f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038953, "uuid": "8c824272-bcd4-47da-97af-fea267fcd30e", "value": "DHL008_documentos.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a54e57e-c4f6-11ed-88f6-42010a9c006e", "comment": "Malware payload (CryptOne)", "timestamp": 1679079814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079814, "uuid": "53e6d676-212d-4810-ba6a-60ffe1b175ee", "comment": "Malware payload (CryptOne)", "value": "039c220499e81869412e2dac17a6df7f", "object_relation": "md5", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079814, "uuid": "76744d8f-7627-4d3f-8eb8-bbc42dde8e96", "comment": "Malware payload (CryptOne)", "value": "b0f03beb2deb788f046bfe4e6ffcb120af1bdf0bfa538dbd262e560034ca2241", "object_relation": "sha256", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079814, "uuid": "e76bc4d7-f9bf-4658-98c9-1b6dce82ba95", "comment": "Malware payload (CryptOne)", "value": "7060770a9c5fb7a2be4b94c0375b2eb6b79a2ccd", "object_relation": "sha1", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079814, "uuid": "03d402de-af65-49d0-a6fb-22f851a2f926", "comment": "Malware payload (CryptOne)", "value": "9be7d620d363ffa1333bb9226606473659fd71401f7a81e785d93d96fdc06698fd84a86f0996cb0d230115ca3e1eb6b0", "object_relation": "sha3-384", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079814, "uuid": "4dbd9eb8-e1a5-458f-a9a8-4a1d43d4ee39", "value": "T10D652251BAC1C8B0E572117A1AFA9630A67DBD2157BACDDB43487B1E9B301D0D336B32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079814, "uuid": "a6a2fae9-0532-469d-b408-28847b6aeb86", "value": "e92b2275a730f59940462780c383a1b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079814, "uuid": "96fb569b-511b-4e8f-8bed-5dcce61845b8", "value": "24576:VLeTtjJF5HrKwx/NGBgD05Xp61lAZOHh/4M1Z+gIN8TePXU7L5bzHvESvA3VfA:VLYgwV081lsOHh/H1Z+gI6SPXebzHvEw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679079814, "uuid": "3abd53b6-5f20-4e08-bc71-5ae73dfedfd2", "value": 1444845, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679079814, "uuid": "3c113d63-2d68-41cc-87ad-bf83c5703ee8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079814, "uuid": "76e95b03-1d40-4db4-93ff-048d17edde76", "value": "039c220499e81869412e2dac17a6df7f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bdca6e3-c4a5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679044920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044920, "uuid": "b0cf7a5e-a041-44be-a41b-9049cc74d2a3", "comment": "Malware payload", "value": "5b58f78a17ab74c8d88110df250f2e67", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044920, "uuid": "3718b970-b980-4a4f-b3dc-06fae3b75734", "comment": "Malware payload", "value": "b1e0f396a9d3881fcbc2414a65a8d3d5681297fdf62ba9a2ca50f94db7696af9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044920, "uuid": "f565b8b3-0120-48c0-89d6-4f345e7274dc", "comment": "Malware payload", "value": "322f087c0fbb26cde9a771fbc5dfbc2078716326", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044920, "uuid": "6c8f694a-b8aa-43a3-854b-31c05bca1377", "comment": "Malware payload", "value": "d7d4dc9d19012efae5d9b86e1c22ab3c55398078aafac17acc083046f6595fb2c76451c529b3b542bd192999f2d0586a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044920, "uuid": "65d25e72-e036-4876-bde3-09389c0d701e", "value": "T115F5BE6997040BE0D8AFD53CCFA2689E60B77C32E68B24BF5F4A3E795631087E4C4516", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044920, "uuid": "c1062fa6-53d3-4259-a279-cf9c12529c85", "value": "0c901bafc3dc9a701eb7d97dcf772d0c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044920, "uuid": "2380287b-577f-42dc-8dfb-39e5fa149a69", "value": "98304:DqaD2xzt49ndR/hqOAX7Jhh15VRN6UnNOzF6:yt4rqN19nf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679044920, "uuid": "0eccb0b4-d8dc-4cdb-92e2-5d25f222a576", "value": 3586456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679044920, "uuid": "14beec41-8ba7-423c-8b57-68fe0e268cfb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044920, "uuid": "13710ef7-366e-430d-ac92-c309375ecdbf", "value": "5b58f78a17ab74c8d88110df250f2e67.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3af691a-c488-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679032719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679032719, "uuid": "9e4b8601-304d-46d3-b17f-a29677fc060c", "comment": "Malware payload (Mirai)", "value": "b2013d5326b2fa8f80914573ea189048", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679032719, "uuid": "3c247049-41ea-4859-9222-16dd64643708", "comment": "Malware payload (Mirai)", "value": "b21270ab059985258549690fab381d420e16f1bf4785a60793f1892f84d6e33c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679032719, "uuid": "7882a848-54c0-4c32-8fe7-caaeb1c20998", "comment": "Malware payload (Mirai)", "value": "e3f24d76d73ba6af7419fa70827de60d8fee7113", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679032719, "uuid": "3fb7628f-e77e-48e5-9c0d-005317f2bf05", "comment": "Malware payload (Mirai)", "value": "7db3c634c7a233bc327073e29bd8fa7f1135829d3b122e1456b2ee6720572b8764f7249f6a40d1a920284e6302088f22", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679032719, "uuid": "bea50e86-e553-4130-897a-017cb90b226e", "value": "T178242A627A3A1B22C4F1647950EB9B5AB2FA4BCD1554C24F3EB20D4EBF549703143AF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679032719, "uuid": "9aaee53c-250e-4538-97f1-ae6dcd8db578", "value": "1536:BW/BskZoqKZTeSZWVGqGAsZdno8C4JKomIkQiXmw0qgJEZyT7/:B+uKGq4e6mIbgAqNyT7/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679032719, "uuid": "742f4d1c-80dc-4d7e-9e0e-2cbbaac8a2ae", "value": 213628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679032719, "uuid": "76ce4e9d-766e-4d1b-b993-187d6a0f4035", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679032719, "uuid": "4f1c1780-bec5-4dbf-9dc8-a0ee94fe9246", "value": "b2013d5326b2fa8f80914573ea189048", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cc2a346-c51b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679095736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679095736, "uuid": "21389793-373b-4d60-886f-0d1fe58f8d91", "comment": "Malware payload (Mirai)", "value": "4bc6bc45351c7f4a5963d04b1169f8c3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679095736, "uuid": "cbb09667-bd17-463c-8cdf-ebda0793ec3f", "comment": "Malware payload (Mirai)", "value": "b2c1a3692f82b6cc9a7fcf478e20be5fa5e82baa1df9243498f001d0cdba226e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679095736, "uuid": "2cb7dfd7-ea5e-4848-a0af-84a199cad45e", "comment": "Malware payload (Mirai)", "value": "fb4167216c26680a97b732d02c2da738f39f33cb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679095736, "uuid": "fd258d06-7034-4f2f-acb1-90ed5a84b62b", "comment": "Malware payload (Mirai)", "value": "14c0f1987967306e10d9c5bd8271b871fdb3be9c939c25c4ec5cdd7f5da0aa38d9f048f03ccb2c1b209d39d5ae6a9a41", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679095736, "uuid": "7b01b135-9775-443b-a587-442f1de21ef6", "value": "T1F813A515BFA54EB7DCABCC3309A8170135DDA51B21B93B667934D828F50F60F1AE38A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679095736, "uuid": "a393ddbb-6e07-4d0f-9bc3-cb8aac0c1e75", "value": "768:4UnoUllV41C0ZIhse7KGeFeVQeZLbwHZbCyXiK/l9zK1:4Unv541ZOk4Q8iZbCS/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679095736, "uuid": "881dad6d-1556-4790-881f-b74f83e9f90f", "value": 43776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679095736, "uuid": "5df6ff50-1fe9-42e9-aa45-6a6db352b5ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679095736, "uuid": "6df4a268-7765-402f-b800-e50a54b1d091", "value": "4bc6bc45351c7f4a5963d04b1169f8c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09bfc2cc-c4c5-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679058606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679058606, "uuid": "19644899-8d17-4dea-ab08-28c3189e807c", "comment": "Malware payload (AgentTesla)", "value": "2bee8990c19dc53b413c8e267f4b8e95", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679058606, "uuid": "ebb369de-78e9-4d65-b49c-7131d9d4699a", "comment": "Malware payload (AgentTesla)", "value": "b36729fe425ed9de3c8fc7c9fb4962cb55152e21cc151326465145a6247c2edf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679058606, "uuid": "cab03d54-2080-466d-b284-101513348da0", "comment": "Malware payload (AgentTesla)", "value": "9fe270fc77d4a0a22daa0e47c88ba86def071819", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679058606, "uuid": "f03e8dc1-8c15-481d-b0a8-4e8a0fcbce94", "comment": "Malware payload (AgentTesla)", "value": "5bbd4fd85bd0c30917452b5fc11bb08d5cae33e522a3e99be344f50a4cc624b3a56a2822aaaf7382792c71931e1b110b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679058606, "uuid": "b59f42d4-3517-48f0-8446-b9b7ecc32854", "value": "T18D357AC65330480EFDA01E7E375464B3DE53CD99E8EBB2AF1A93BC2A64F844405DD962", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679058606, "uuid": "d03e519a-e166-4475-a92e-00598260509e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679058606, "uuid": "0be5cc97-dd22-4b45-a50b-d151ff6c1582", "value": "12288:v3l1K8tUyZmMRxEy0gE0A2HGelPsyWyEeoaaQBmuizy8/bkxRU9bJbhOFW5kgsH8:UamelXWf3atxykTyJN959s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679058606, "uuid": "beaaa714-4642-472a-b9be-a7b9a2c41c10", "value": 1078272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679058606, "uuid": "c7477d50-a3ff-4319-a80d-8c820cd447f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679058606, "uuid": "8892d7b8-9393-4cc5-9718-2cd66a1f5b8a", "value": "20230313_TRF8012561011_Swift Message.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7740be59-c49e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679042040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679042040, "uuid": "67ad35de-3479-4507-be65-59862405c8ea", "comment": "Malware payload (Smoke Loader)", "value": "8303a933175b4650eb14f68d7ae68df7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679042040, "uuid": "079d480f-1f72-43ce-a67f-f167a880e34c", "comment": "Malware payload (Smoke Loader)", "value": "b47e9bc0fdba5ddfa2b30048ef6fa2e7dd3f6bd5314d6593d614bd748c970b92", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679042040, "uuid": "fe7a7100-3432-4140-a57b-fb856071d380", "comment": "Malware payload (Smoke Loader)", "value": "70b7eafa1338c5368904c0b0c91a45441a2b0205", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679042040, "uuid": "640e9e58-efb8-4573-b1a9-e90bb06b05ee", "comment": "Malware payload (Smoke Loader)", "value": "7857957c848c5a71694849b124a1dbf1b23046aa5695c3cee31db32d5bda69980782f3ffc4e8f256fd0609f78141b2fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679042040, "uuid": "7e829e66-c960-4f8d-8ee9-b133b348c795", "value": "T1E4049E0393E07865EA264A319F2EF2F4771FF9518E5AE7E522489B2F08705B2C5633D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679042040, "uuid": "9effd1a8-0c67-429c-82a6-6c3221ca08fd", "value": "9bf03dbaa4f43e7b3f88544a0f4bef62", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679042040, "uuid": "76754df1-1f71-4397-a51b-fa567e7f9f0f", "value": "3072:t++5niWenyv7ez9zfxzLebwFpSi6kLNXAoBMrantId4XJa:Dl9cpzJzppZ6kLdHirq5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679042040, "uuid": "dbd82a8b-1a0e-449b-9719-1028051a12e5", "value": 178176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679042040, "uuid": "bd6fab96-9de6-4304-97ec-7f3edaef7eaa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679042040, "uuid": "aab6eafa-f1cc-486b-877a-20bc2dd91f98", "value": "8303a933175b4650eb14f68d7ae68df7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6514f89d-c49a-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679040291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679040291, "uuid": "1be4807b-1c2d-4861-bb3f-1ba74643ce1e", "comment": "Malware payload (AgentTesla)", "value": "5c4d5da888c4d61825cf4d290a95abf5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679040291, "uuid": "199c8a58-833b-4676-adb2-61d72c650d97", "comment": "Malware payload (AgentTesla)", "value": "b499cbf56149c33fc6e105f9121d8c985e5dff6f5e4201184a012673a94b98b4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679040291, "uuid": "ba195bee-2919-4d94-b857-bb22069b4889", "comment": "Malware payload (AgentTesla)", "value": "b88086851b6386079bde76b55663f2d6c848def2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679040291, "uuid": "bbe85880-f592-4072-959c-9ff308719a18", "comment": "Malware payload (AgentTesla)", "value": "9b2692ca2e91778cd29c2971b8e208cf39947c1323a16e6062a8a8c07669bb77e255122cdb07b8e727df43d4b8f87bbf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679040291, "uuid": "b48a10c5-a1af-421b-a08e-6ddc05e23319", "value": "T174C50C2DC82B0D2BD17ACA388EDD4733BD91681A321CDB7974F293FE9796482748245D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679040291, "uuid": "656f844f-b20d-4d2e-9d07-74601efc09ab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679040291, "uuid": "ffb070a6-8067-47c5-9f93-daa784660720", "value": "6144:PiboWCEJKwDNP5lc0oFZdX/JQ70PfZ78lXXgFbhr0fK73dlnZ0IXjA1tQ9:PiwE9hPXc0ohhQ7OfJ+6bhwfK7p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679040291, "uuid": "12e33cc0-d79b-44aa-9b5d-c8ca6f478616", "value": 2596352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679040291, "uuid": "eb5b700c-47e3-455c-9238-30420c2a8b0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679040291, "uuid": "f8db37da-38b2-4cf8-b1bc-ab117dd717d8", "value": "$45,000.00 USD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99111e01-c4c6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1679059276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679059276, "uuid": "38d4d60b-c81a-420d-a99b-bccafe7d4113", "comment": "Malware payload (Gafgyt)", "value": "23cb40e050e0b90f3f54f6d6b38d0fbb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679059276, "uuid": "e8749f5a-c460-4572-bbd0-b5ad7e7f7786", "comment": "Malware payload (Gafgyt)", "value": "b4af719261aae54790d8d95c6ad189e89db3f5280056a27e2aaf505b793f0875", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679059276, "uuid": "e25481ce-abfa-45cb-a8f5-cf0dab139119", "comment": "Malware payload (Gafgyt)", "value": "a608f32ef636fcf591d949e047b6e9250f3326f2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679059276, "uuid": "529ad9f6-2d13-4cde-9bf6-5608a7c607d6", "comment": "Malware payload (Gafgyt)", "value": "7fccb58c65c3c6b62f4359d86566457ae9f738a4ef39ae80e9e564079a292ff73f13a1c511264d751deb5bc24c7d272f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679059276, "uuid": "0a39c16e-2275-4636-90f4-995c46c26ce3", "value": "T163A3401B6721DE77D85ECE7B069A451210CDAD4A02DDAF2F72A0F61CE3AB88E44D3D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679059276, "uuid": "c4c1bd28-8f49-4fe9-88df-96c0de740604", "value": "1536:grbzJzeTovWSjD8e/OYCZVple8yW+OXnTmb:grbBjsV6a+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679059276, "uuid": "d71cf859-0aa6-4cc6-836f-809b6eb602a3", "value": 98870, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679059276, "uuid": "130533f3-71b3-4071-becb-5f3bf661ca78", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679059276, "uuid": "4f62a24a-ac63-4aca-8ba6-4bd28de8dcb3", "value": "23cb40e050e0b90f3f54f6d6b38d0fbb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dd310ed-c4a2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1679043608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679043608, "uuid": "03e6ab48-2540-4549-8121-dfc3c3ecb5fb", "comment": "Malware payload (Gafgyt)", "value": "5ef1d6e2821289b53546375f4572fac6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679043608, "uuid": "430a105c-6602-4cb7-b005-0cc57cf15a42", "comment": "Malware payload (Gafgyt)", "value": "b4c84063662dc3d0d3d90ea3c5228dfe600ba5886406bf0885ada0d51c4c3b59", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679043608, "uuid": "5035a70f-27b3-498e-b83b-750a88d12977", "comment": "Malware payload (Gafgyt)", "value": "28de2f3227b49f5e45e012dc4e30be0e38905c74", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679043608, "uuid": "9effcc93-f9c3-4d53-a2d1-9f36a2c78b35", "comment": "Malware payload (Gafgyt)", "value": "78cdfd7177529a6a59c780b108813b27742624642dae3dc5033d1c27516ebdcffe7cd7784e0d493ae0ee379117a0ce81", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679043608, "uuid": "236b00e8-1bb7-4fc4-8ca8-d7441a21b1e8", "value": "T157B30692F900DFF2F40AE67604C34B2566B0BF660F536A66B21739A79E721C43867F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679043608, "uuid": "9c9b09e9-7a62-4f59-9cc7-8602af8323dd", "value": "3072:gLWUEK1FSHGfs1QbEE6QyPwps/avcWVRm2pgYMx3IPtW:gDsGfs1QHyPqsSc2Rm2pgYMx3IPtW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679043608, "uuid": "27ae098c-9900-4975-8ca9-32ee95d304fd", "value": 113759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679043608, "uuid": "386b8114-75da-458c-a556-15b26669490f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679043608, "uuid": "e028ff3e-056a-4500-86df-10f886b78bcc", "value": "5ef1d6e2821289b53546375f4572fac6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f00b74a1-c4c9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stealc)", "timestamp": 1679060711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679060711, "uuid": "dde5da87-8933-4acb-b2fa-17dd17afb7eb", "comment": "Malware payload (Stealc)", "value": "4d9c620616b98cdd72968e60b3076500", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679060711, "uuid": "fce27e3c-d46b-4e76-90c4-3248f56092bc", "comment": "Malware payload (Stealc)", "value": "b4e6f0c29edcaf748bcd0593eacbf5b91ba70beb5f2a8110433a1d3b1069a21f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679060711, "uuid": "57735578-6aef-4612-803c-3eabfd9507b2", "comment": "Malware payload (Stealc)", "value": "f1c1da9ff0f6fee5318dac9dc1b339b23d1f0e31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679060711, "uuid": "0708be6b-7cf8-469c-9dda-75057ba6af41", "comment": "Malware payload (Stealc)", "value": "9a15fc6cd430fe039ad50183f4a55bd829fa39fb03c89783a22618d5bb010ef8a56af1e1d19cddb66a5257678f7124f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679060711, "uuid": "501f8f94-df5a-46af-90fd-a58770d71398", "value": "T1C2643B0393E1BEA4E92B8B729E1FD6F8760DF5508E09376922299F1F44B11B7C263711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679060711, "uuid": "368fcccb-9c26-400a-ac6b-409a158842ea", "value": "bb1da332f7212d9c576b80377a6c6ffb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679060711, "uuid": "cfda833d-8fca-49bc-8bb7-0815a03b96a7", "value": "3072:MOkC0vLTSqXPd0mwkA2esK8LvZS3UAScrcsvTczU6NlfYM:RktL/XPSmdesx1GUGTczt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679060711, "uuid": "affcb00c-adf1-4cbb-81f2-3f15bb526aa5", "value": 307712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679060711, "uuid": "49e69b73-7c0e-42ef-89c3-f92dc91e1b5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679060711, "uuid": "db50c9c4-cac4-47e7-ad9f-beccf2b4a331", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9590f046-c4ec-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679075591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679075591, "uuid": "ebbc1798-40b9-4a08-9d26-584fddc574cc", "comment": "Malware payload (RedLineStealer)", "value": "c59eb6e95605d14bf679c9f8576fd1c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679075591, "uuid": "be47c8d6-a26c-4a1a-9f00-b050257ecfa0", "comment": "Malware payload (RedLineStealer)", "value": "b51c6dd05d5fd5e76b174fd872644e510d8ce438883b0491951a9112a2e9d429", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679075591, "uuid": "4e769d03-190c-49d8-8282-ccf9c58f3340", "comment": "Malware payload (RedLineStealer)", "value": "a9750a21d1b82e4413e76e6092fd7a1043864571", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679075591, "uuid": "57aad183-f602-4d6b-a571-03b86a4d5f0a", "comment": "Malware payload (RedLineStealer)", "value": "cb31e96c389a4ff3eb8d392d04aa1a4eb9c5f3a3b53153bb480fd56626d148b5929f9ab66c125bdd4584b83aa6a07bcc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679075591, "uuid": "85823baf-bb12-44f2-9653-3c3cd19c0841", "value": "T1B4544A72A5D38222E067E8FE15F552080BDA9D0429246A4EFA9C4FC3A746EF4247F537", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679075591, "uuid": "61eb54db-21a7-4ddc-9045-6551d0c837af", "value": "43f7ea495c8b275ba41e03ccb9017646", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679075591, "uuid": "400dd33e-9dde-483f-a840-45896105ca31", "value": "3072:9ImZzeXUFlsEBy5IBGeLEEoZZvMIcN60Qksit00fSIEswbAy/w12BJBQjN:9ImxpF+0BbSvMRAFgO0Z7MraGU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679075591, "uuid": "58887a3f-b301-4925-9d1a-e650e6f3b112", "value": 290200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679075591, "uuid": "80379967-d4f8-4643-bcef-a2c621c72ffc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679075591, "uuid": "af16a9c3-7fd4-496c-9026-1f94e60848fb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a22ed662-c4c6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1679059292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679059292, "uuid": "167b96cf-19ad-455e-8b20-9f09a695614e", "comment": "Malware payload (Gafgyt)", "value": "d65ddf2961ea01125a5b68fb56554f72", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679059292, "uuid": "0b7a1275-547b-4832-ac6c-ddcbb9ca9a15", "comment": "Malware payload (Gafgyt)", "value": "b548d8bf7f9b71732da269d2cda1eeb3bf4707b7117676616117d0a2b531a393", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679059292, "uuid": "669d3c50-54b7-4888-9546-35ae97761bdb", "comment": "Malware payload (Gafgyt)", "value": "5501e8862401ca63c248669587121c7228518146", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679059292, "uuid": "1f0f3eea-c62a-48c3-b3b8-07c2e93899da", "comment": "Malware payload (Gafgyt)", "value": "60fedca19e55a684cc6368d38089aecdf468a09ef6b4b879d688bdf63ccdb33ae51af039f575b81fdfc50fa63fb3fb7a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679059292, "uuid": "996621ce-1632-4d0e-9a31-9e04a2ad1da3", "value": "T1AEA313AA6E51BBBEE5E8873547F75FB0C385299222A1D741D26CFA185F7128C0C8F350", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679059292, "uuid": "bfb60f76-96e7-4245-b241-e949f5e81b36", "value": "1536:hVNy7KqvBVTaGeg7nwx3mYIykHZE2rKGqglEW7/D7pGKUpRT8SvnTmb:YlC4Drk/F+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679059292, "uuid": "34674dc0-2d5f-4007-8193-4cab5e3e0feb", "value": 98870, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679059292, "uuid": "fde8888b-8e8c-4172-b074-fa401dac9382", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679059292, "uuid": "34da37a1-5145-4978-977d-3dc98bf8dd29", "value": "d65ddf2961ea01125a5b68fb56554f72", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f44d257-c4be-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1679055717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679055717, "uuid": "73859ddb-fc11-4590-b96e-3cd04d76867f", "comment": "Malware payload (Gafgyt)", "value": "bb65a62f2e860734abac3b3388ae81e8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679055717, "uuid": "63eee050-4ed1-4b3e-87fa-74d791f35df1", "comment": "Malware payload (Gafgyt)", "value": "b5b124e64d497eaadcceb2930f5c994062234b9711a90caf3974ec00735e451c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679055717, "uuid": "578442e0-983b-4dcf-9567-1738b56eed3e", "comment": "Malware payload (Gafgyt)", "value": "e38f5d95275dc9b9c34fbf665a8f076f25bda758", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679055717, "uuid": "e99ae0cc-f306-43ff-bf49-f4d9126dcd7c", "comment": "Malware payload (Gafgyt)", "value": "8d58e33feaf266a2abbbb707ae0848db0ea625d702057a6d2c9c8ba56767aada6aeac979fbd220a129cbae435d82eeec", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679055717, "uuid": "0dd1dabc-556d-47b9-b086-1388c499ddd6", "value": "T175C30A45F941875BC3D327BAE74E428C37355E2897DB33156A38BDB42BF2B982D29120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679055717, "uuid": "e3ac6290-f3f5-4de3-b973-164d68326298", "value": "3072:hQrFRNfuLrGhEPOD0Dg3gNlmBoHQuQekQnYW:IFzuaEGQDg3CmBoHQuQekQnYW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679055717, "uuid": "63e4676e-b999-40fd-88c1-1af560639dcc", "value": 120177, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679055717, "uuid": "ddb5ea8a-5f28-4b1e-95de-6c04de9f1d45", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679055717, "uuid": "af58c367-343c-4f72-8673-ea6c5352c6b4", "value": "bb65a62f2e860734abac3b3388ae81e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c039a3f0-c4a6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1679045598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045598, "uuid": "f06e4e1b-2bbd-4689-8d95-4a14a70de312", "comment": "Malware payload (Gafgyt)", "value": "21cf04456428b3e2e45d73ee8ba59c5f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045598, "uuid": "1ec12362-c864-4303-83ec-7f12f2acc501", "comment": "Malware payload (Gafgyt)", "value": "b5b202e8079d6b266852876564342066a82845b33af0c9eea18434930577f262", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045598, "uuid": "14c4e235-aeb9-4461-b410-791124053756", "comment": "Malware payload (Gafgyt)", "value": "8733fc2da09aa67044e68212cd8536299accc7ff", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045598, "uuid": "e4a3e9b9-4df1-41c1-98d4-8ddabdd18a8b", "comment": "Malware payload (Gafgyt)", "value": "7af383a37e46f946303d0965f359ffc689b1737565ae07f10d96adf5218fe03265a89a50b70399f73617ef8384e248d0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045598, "uuid": "b5c0be8b-80c1-43f1-8210-3b6ecc7fd00e", "value": "T19613E1D3966FC449826C407F4E9FB78E18F08B1E54110BA7EFD825B285727B936694F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045598, "uuid": "ff4fbde1-21ae-412f-8a8f-4ee7b71f1902", "value": "768:Bka8p0Bvys7132KxKbRDhZkdZJ5bOxrghvgP09bnbcuyD7UryqalCzHbQ5OhoM8:Bkoysh2KUFDhZkdIrghvz9bnouy8mqaz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679045598, "uuid": "89388ae8-47dd-4d49-a649-4fcee074307f", "value": 41484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679045598, "uuid": "526d892a-eee4-46a0-82f5-ef5a6e47a825", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045598, "uuid": "024849f1-f59e-47bf-971e-58bdc5176ef9", "value": "21cf04456428b3e2e45d73ee8ba59c5f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64a61fe6-c4a9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679046733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679046733, "uuid": "0074878f-139f-4bc5-ad04-9f8732b1b5a6", "comment": "Malware payload (Mirai)", "value": "bc488bda5df3c4b480f1f52cab9b544f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679046733, "uuid": "cd15a871-fd6e-440d-a515-bf1ea6f95cd6", "comment": "Malware payload (Mirai)", "value": "b63ef45e9232569d22882af30641fd8accbfbbad63af271f1b20d173373832b3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679046733, "uuid": "ab500df2-69e0-423a-a08b-7b926ca2f71b", "comment": "Malware payload (Mirai)", "value": "08cf0183508c5be5195fbc71f4fd3364b50ba658", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679046733, "uuid": "ea926e4f-2553-40ce-81bf-038b909572ef", "comment": "Malware payload (Mirai)", "value": "8f71ba01db1c545cc7b3efc49ff33e45bc0dfb8bed015a6985f8fb05197af16b5f85fa428833782633b94ac546e972c4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679046733, "uuid": "5b29f056-4e64-4ff0-bd89-373ece663b7a", "value": "T105632A21BA761E1BC4C1947621F74B25B2F143CA26ECCA0A3DB20D9EFF71A446543AF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679046733, "uuid": "eedd9b05-7e80-440f-aeac-9a1c865bb258", "value": "1536:lGBVg7AOotXhGIAsQXt3AYQxQm75YH/tatlV:lSCzxBmQmVN/V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679046733, "uuid": "b385d38b-d89d-4c02-972c-39379cb27bd3", "value": 67312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679046733, "uuid": "71c569e9-83d1-4a14-851d-f3e96d4075a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679046733, "uuid": "6aaddf7c-fbee-4cdd-ba93-94f0eb4d35a2", "value": "bc488bda5df3c4b480f1f52cab9b544f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11fd5ed0-c516-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679093410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679093410, "uuid": "2c19264e-e470-4816-bb64-f8c4d85318df", "comment": "Malware payload (Mirai)", "value": "53c0cfcb252d65b0d55e07d85549c561", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679093410, "uuid": "4183ad94-aca5-4dd9-906f-1b8a2685a93c", "comment": "Malware payload (Mirai)", "value": "b64e240a4f9bb47f63b04eb222598c149b524a15009ae4176a31f8786b61bb11", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679093410, "uuid": "476f50f8-82bf-4df2-a6dc-8dda8030785a", "comment": "Malware payload (Mirai)", "value": "98dff33000f9d93a7fb61802cfb6bf81e98c904d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679093410, "uuid": "e84dc4e4-9526-40f3-89ee-736e03d28ebc", "comment": "Malware payload (Mirai)", "value": "ae6479286ee68af59ad963163cdec79905876935268eaf0edeebd6dd4ac05f5bbda82415c26ee2b2ecb9424aced8f7ac", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679093410, "uuid": "461b434f-128a-4a7b-aac2-d18ff83d8ace", "value": "T160B31946E7408F03C4D62775BADF42553323EB50A7EB63065928BFF43F8669A0E63606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679093410, "uuid": "e503d982-52ab-47aa-9090-73be6da46377", "value": "1536:ZBnnWsJSxmSjAkrA9CZSItAtellDVi7g5ULKFWcZ6opkpUpX7zw/9jhSsI0suO9:3JrwbA9CZSIt54g56cWPoXM/9osIpR9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679093410, "uuid": "ea686431-8e8b-4ddb-806b-ba8e00c66c2b", "value": 108868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679093410, "uuid": "d2b446b0-3fa5-471a-acd9-0a8732a55aa3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679093410, "uuid": "e3efa113-0b0e-45f6-ac98-518a65353513", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bf0b37e-c4c4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679058369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679058369, "uuid": "22b9b0f6-fc5f-4e38-af33-f17c7c1b077f", "comment": "Malware payload (Mirai)", "value": "fa470fef05b6569db8e3b35db6bb787c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679058369, "uuid": "629caf40-3a11-4e71-a5ad-bfeebdff20c4", "comment": "Malware payload (Mirai)", "value": "b6d09b5681cdb910219d0b9837bbda0f131dfe6827619ac12c34193e9a6ba374", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679058369, "uuid": "141134c2-93d0-4740-be25-3eaf50a9eda6", "comment": "Malware payload (Mirai)", "value": "784c11640302d6af4a2590b99f280be049cc2ebc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679058369, "uuid": "e989eacb-a912-4bea-bd4c-756ba65b29e8", "comment": "Malware payload (Mirai)", "value": "37abbc6bccf5f4c2c073797e57c3310b2a153cb1f22e2a3a48d313379cc14b796aef0251f541640112540319e41fc337", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679058369, "uuid": "bf6920fb-0b72-4306-8d17-c5d3ba13b4dd", "value": "T14CC3941BBB618FB7D81FDE33059A4902108DE58A12D96F6BB2B4C92CE74B94F08D3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679058369, "uuid": "787a63aa-e45d-46a0-850b-c2a490d315a4", "value": "1536:KHeTxSA2cMYWZ2IV6oQ43wc4wUYkOcdpXPlYUrmW+IFB1Df11hR/:KZ55QGwc4McdlPqUrmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679058369, "uuid": "a85dad9d-63e0-4796-808b-32d4fa648b94", "value": 126023, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679058369, "uuid": "ba3ab025-13d6-45a8-b349-edb69e9154fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679058369, "uuid": "3fd7fe30-bd9e-4470-9bfa-ddb71a6c006e", "value": "fa470fef05b6569db8e3b35db6bb787c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1f987ae-c472-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679023240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679023240, "uuid": "1aae08bf-0cad-457e-a452-ed4a7296dab6", "comment": "Malware payload (RedLineStealer)", "value": "127500698928db1935273dde6395ed4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679023240, "uuid": "4efc16af-41ec-4d03-b80f-32d6088ff787", "comment": "Malware payload (RedLineStealer)", "value": "b6d2705e905238bb509c107378f5c3e1ec13b6a207cc445ed1320f83ea9e3b1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679023240, "uuid": "5df5603e-b774-4d14-99ad-824b94d90cb0", "comment": "Malware payload (RedLineStealer)", "value": "aba93472bbcb38cdaa450f017ccb78abc648ff51", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679023240, "uuid": "f31d652c-79bf-4006-8404-24d372c21b8a", "comment": "Malware payload (RedLineStealer)", "value": "1a7b2f562ee3ce88381348ad40f5195f4995fe4bfd83e2c622958143192e5f96f26f738b41caa4f25040a90c99404932", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679023240, "uuid": "a49d1f1d-d8b0-4c01-b5c2-008a4e8f8ef8", "value": "T176E4120BE7ED9023E8B453701DFA02C3063ABDA16674535B7B4F5C5A0EB21B4A935B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679023240, "uuid": "ee500a0b-6a7b-4e20-a2fb-d03463e3ced2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679023240, "uuid": "61b70960-5771-489c-8d63-1b13f75a06de", "value": "12288:bMrcy90Nb64dO31H6b4EaZXVeyHGt9DB+Gtk0iy7xjbH/J7myNID1:fyo24GH6jumnDB3tk0iy7xjbH/VmyNQ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679023240, "uuid": "b0444126-b564-4f3f-a1c4-a501ddf49c93", "value": 672256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679023240, "uuid": "b767ad0d-15fc-4bb6-98a9-2fda2f9014ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679023240, "uuid": "faff864f-07fb-40e0-9a2d-6aa41d0c8c1f", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08e8c234-c4b7-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679052592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679052592, "uuid": "9e845f0c-01bb-48a3-be53-3e33b98edd3d", "comment": "Malware payload", "value": "f974bbe206b1024d07b92ddcd3066e69", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "TA558", "colour": "#589E21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679052592, "uuid": "e6e6b979-2492-4ef2-a985-4466e09d9eeb", "comment": "Malware payload", "value": "b72e2fb08b6d2863b4cf984fb2e89868527010a15e6d4689986b8d704ad63440", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "TA558", "colour": "#589E21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679052592, "uuid": "afcd5a0f-69a3-48cc-b554-54d6843d2d19", "comment": "Malware payload", "value": "5412c243cb04bcdbba46aa6fb816383b7d7fbed3", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "TA558", "colour": "#589E21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679052592, "uuid": "59f39062-a8b5-444a-a5c5-a4619eff29e6", "comment": "Malware payload", "value": "4c670535822970e48637d2ce9deda9e5e8eb8b643b14ea6a5051e4886857ef7660c6514e21265741719221ac3bf70c6d", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "TA558", "colour": "#589E21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679052592, "uuid": "84eaa4ac-efc4-4f8d-bf8e-aab776a1251b", "value": "T141014438C1529BC3B809FA3327DB29B02034F7D386ED50D4498045CF15FE059909917B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679052592, "uuid": "edee107c-6122-4bb8-af7a-890cdaf34747", "value": "12:fTTTTTTTTTjk3pLx2VoAmI0opeLbff++2NrJWrFRbbqFuAwACYT/OddWTjTC:fTTTTTTTTTjk5dRAmIDMLbffINr8bXqE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679052592, "uuid": "96a069b8-d780-4f9c-9262-8c5a4a26dc0a", "value": 766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679052592, "uuid": "55cea715-390b-495c-a112-5a2423fd61c7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679052592, "uuid": "93d32b8b-03f0-4fb9-b381-cff9167faae8", "value": "info.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "985781ab-c4ec-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679075596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679075596, "uuid": "195f4d42-3375-4bab-a3bf-d8168d805265", "comment": "Malware payload (AgentTesla)", "value": "0a937838141cf6acfb3d63ae2b4673b3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679075596, "uuid": "a67a9b4c-76be-4cf1-adea-a28211cd05c8", "comment": "Malware payload (AgentTesla)", "value": "b7d8fbbf428d72bcf7513bf41bfbf43db9f8f90a86f790b35e439dc1c1ac58e0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679075596, "uuid": "16aaf4dc-672d-4e83-a067-6bbfc3ca650d", "comment": "Malware payload (AgentTesla)", "value": "958c34671e00dad345d06738845db6c019e7be31", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679075596, "uuid": "9c56d240-780d-4364-8195-9efbb4da8d4f", "comment": "Malware payload (AgentTesla)", "value": "c425cca4386ae9ac18961363cf3d60c0813dbb005598499be019835474de203351bea4b186ff0cf6ac0c58dc5357032c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679075596, "uuid": "01c72628-18ff-4578-940a-985d1b0bb106", "value": "T129359D9C7610B5EEC817CD76C9B82C64EA6224BB830BD243905B15EDDA0EA97DF141F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679075596, "uuid": "4a001ff2-f507-4e97-85c2-ba136e434290", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679075596, "uuid": "1c55733b-d46e-406c-8a95-35ac63c94960", "value": "24576:n8Gcfl+LHXD5jkj+DM4G2hrLfAyZrA+np3zcIibp3:niQjk34GKr8iAKVi13", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679075596, "uuid": "32b25269-ad0d-492c-9bbe-5df20bba2ebd", "value": 1084928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679075596, "uuid": "a0913fb5-dded-46b4-bc00-713ae2818391", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679075596, "uuid": "0fa0c78a-4fc0-4a4d-ad41-434484e54bee", "value": "0a937838141cf6acfb3d63ae2b4673b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e78f0f7-c497-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1679038965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038965, "uuid": "4b0ddae7-8296-46ea-adff-c28a14abe7d7", "comment": "Malware payload (Heodo)", "value": "862cfd3b3523532ba0faad1bcc568c4d", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038965, "uuid": "6f95297c-86bd-434e-b199-e5ad68e0789c", "comment": "Malware payload (Heodo)", "value": "b7f06ac0c97b87147a07ea1471097d84445faff5d13aebc195abb3fbeaa4e526", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038965, "uuid": "7e030e43-ec49-41d8-851c-a6f238079f0d", "comment": "Malware payload (Heodo)", "value": "faa8437483dab403f6079be49758407a9d59b964", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038965, "uuid": "30879d48-84b9-4ffd-a129-039de1f7720d", "comment": "Malware payload (Heodo)", "value": "6fd3c8284d4acb4b85d16d26b206e76c97bb2dab3e0eae5d1184641545eb2f3380ab9457c824a4246649a4e9e2cdd019", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038965, "uuid": "1626448c-e4e9-4153-aa62-eab6a405a8a6", "value": "T176C33BF1A8025C0AE123C976B1FB661399D051ED42283B2BF87D507DD978A20D5DD8EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038965, "uuid": "d1e25632-34be-4201-ae15-bd4862e10c78", "value": "1536:RDBoTVdaeNtuXndCrJJmT4HVnteV4FrdMiYcx7bfCb6HPdnXS:1BoC+tCYvSMVnte8ZP1Y6JC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679038965, "uuid": "5570a4ac-da94-4cfb-9356-dc10107d3e94", "value": 120428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679038965, "uuid": "21bbf542-9984-4bf5-b49f-4021a191b48e", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038965, "uuid": "5ea82166-1ec5-459c-9543-066c533df9a3", "value": "iMedPub LTD_4.one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d5a2c6f-c497-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1679038936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038936, "uuid": "bfd0c491-a107-4dc8-9412-1feae11f6965", "comment": "Malware payload (Heodo)", "value": "b1b7155dd89db42ebac96191fa1cc219", "object_relation": "md5", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038936, "uuid": "265dee47-45d7-42a2-8873-ff6fe97d2b9f", "comment": "Malware payload (Heodo)", "value": "b8e62579ea147a7392e9d37d8b2aeb6b9d8d1883e6a6f9ff5ebcb42f5a395e29", "object_relation": "sha256", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038936, "uuid": "fecc8db7-a4a6-4364-bf40-d98d264ca4dd", "comment": "Malware payload (Heodo)", "value": "8f95ccca06a27414b30392d1962541fe451983a6", "object_relation": "sha1", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038936, "uuid": "b882b3ca-bfd3-4f06-a3a6-21410137c6a1", "comment": "Malware payload (Heodo)", "value": "6a4c806c4e054c2d56b38ff7a2845d46cff1e11cbadbef484a0b36b13b10e7b41e247785b5033685eb0317db5e7a5df3", "object_relation": "sha3-384", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038936, "uuid": "eee18d54-0c72-4c65-abad-38a8be7c0899", "value": "T15AF412FA74F875D1F0D99779E1A760BAC6293443C438A2DB92061B37D543FAB6B20702", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038936, "uuid": "aeb50964-0573-464b-9625-8f321576287d", "value": "6144:EwZnDlMy6O3qKmCRUe1B5uLqcHfVDNUV3nJGM+BTp:XtDlb6IqXCRUe1BTcH8VIM+Vp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679038936, "uuid": "8bffbdcc-fc42-4b3f-bf39-8f2553f3d450", "value": 745077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679038936, "uuid": "ae0d6dc9-680d-4336-b208-0611573741ee", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038936, "uuid": "1ed1257d-0007-46d8-99da-c71309209797", "value": "bg-6552479.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d20a71e4-c470-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1679022435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679022435, "uuid": "f1249bf1-8b91-43b1-95d9-e955672aa48d", "comment": "Malware payload (Rhadamanthys)", "value": "b26950acb31f531bd979cdc1b6235e01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679022435, "uuid": "4eff01c1-050c-4df1-b328-57401afefde1", "comment": "Malware payload (Rhadamanthys)", "value": "b93959567ece21f921fd4af81b1cd79ea51ba39fdba8ea2b8e17d1fb11e4a59e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679022435, "uuid": "5622d5a0-93b6-4673-8bfe-aea4130cab36", "comment": "Malware payload (Rhadamanthys)", "value": "bf165aa768a87dfcf2153d3d0af0d2847a73ecef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679022435, "uuid": "c757fb7e-a261-4691-9f77-feb6c4baaa98", "comment": "Malware payload (Rhadamanthys)", "value": "8c4a3c8e3efab0e82964b28311482ce6b2cf52d72107c1c37ff617e02a093770fdbf09a9f524e6fc71732a5399339f8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679022435, "uuid": "61c84b50-cee0-4501-b57f-0ba6b762f316", "value": "T1B9846D0383E2BC45F92A8A739E1FC6F8761EF5508E697F6962289F5F44B0076C263710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679022435, "uuid": "96cbbbcd-50b7-427b-818d-b7d40baf769a", "value": "02bcb533fc6eab16fabdf3b7ff49a9d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679022435, "uuid": "4e08a01f-ed8b-4173-b766-5e45df80a7e6", "value": "3072:tXDFkLGi1qSYnZr22ARZpGX+ZgBw3L11PeBVIeFzniTbsh6oFTONlf:dD2LPVYA2ARZzgY1ZWVBFeTgh6Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679022435, "uuid": "f6dbfb04-4125-48d4-94b6-93dea374f784", "value": 371712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679022435, "uuid": "3ac8046e-2743-4965-bd21-e01506a7d4c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679022435, "uuid": "9c17870c-f6c8-4f12-9277-ee413ff098ad", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dbc89c7-c4c6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679059284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679059284, "uuid": "7534f1b9-fae4-4545-877b-047cf1290bf6", "comment": "Malware payload (Mirai)", "value": "cf9449b87e248a5de2ceb1d132ba41ef", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679059284, "uuid": "36d77308-9b19-4acf-869f-0779d26ec32f", "comment": "Malware payload (Mirai)", "value": "b9b467605ccf746d4cc9858b30629b56d06b3b54b1a50948ce1d391676ed71bb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679059284, "uuid": "11ac68cf-2f75-436b-a0fc-987e35cbf99d", "comment": "Malware payload (Mirai)", "value": "ce39010f9294c4ade41da070bbaaa6bb113c4a3f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679059284, "uuid": "49c2efd4-b6d7-45b3-90f1-c8972694f492", "comment": "Malware payload (Mirai)", "value": "ee7027cecc78efe2b68da233db9a536984f4480193875944c42c4b09aebe65ef50d3e6494a1bb3567973ba6991599bc4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679059284, "uuid": "14639329-5b44-4a15-b35f-f41cb1b03fac", "value": "T18CC32905E5508727C2D3237AE79E865D37325BA493DB33215A34BFB82BC278D1E39921", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679059284, "uuid": "675a31c0-d101-4d49-ac2e-6d960512cef1", "value": "3072:2kYP/3VQQnQbkZba4/VPkfDHENHt+mTQOY5NX3cn:FYP/3VQQ4YbaMkfD8N+mTQOY5R3cn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679059284, "uuid": "0b2812a7-8002-4836-a170-e4f80d179f70", "value": 120988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679059284, "uuid": "0e450cfa-c20e-4dc8-be53-fbe3e20f1cc4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679059284, "uuid": "c8c19234-cbed-4128-b1a7-1a5afc9a35ad", "value": "cf9449b87e248a5de2ceb1d132ba41ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "427bad46-c4be-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679055695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679055695, "uuid": "508d58db-c4ae-48f3-a67e-a17afd713f8c", "comment": "Malware payload (RedLineStealer)", "value": "4e8005fb5407edd9ad49bece86f0e850", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679055695, "uuid": "26d679a6-67e6-4337-974c-e9b19ee09409", "comment": "Malware payload (RedLineStealer)", "value": "b9b5f5b7816caa9d22bb09030a2ae3a47bc3fbe529001a56d39c944257a9c7f9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679055695, "uuid": "c576cd10-1c0d-4b78-a1a5-8914c33e1a68", "comment": "Malware payload (RedLineStealer)", "value": "203388768e9020a4103260105fb7df2a6300a769", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679055695, "uuid": "a44d3369-9621-497e-a376-7713b017b95d", "comment": "Malware payload (RedLineStealer)", "value": "2481ac09838a065d6a7f4923642236218c6a2377316f81a10c48967133094cf6e8e45b64e38231492e13245b6317c82d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679055695, "uuid": "195e6562-0fee-45cd-92c6-06a463c8f369", "value": "T13B051252BBDC9136CAF107B058F603D30A3ABDA26A75D65A3782F55B4CB2BC46031727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679055695, "uuid": "150e5408-e05c-47a5-a81a-9ce84211fcd4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679055695, "uuid": "6fb5a229-1e9e-4447-b7d6-a522e3b72bf5", "value": "24576:/y3dwV+Q7FzD1TWdzeHJ/k1t/i93j703kqKw/k5:KtwVdRWdKHJcvG3jq/k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679055695, "uuid": "3240d374-edb1-464b-a116-f5bc9b52c6e0", "value": 865280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679055695, "uuid": "f19c76eb-fbe6-4d27-bd9c-4014305016fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679055695, "uuid": "8f57ede7-6f62-40b5-a5a4-b006fa777f79", "value": "4e8005fb5407edd9ad49bece86f0e850", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e5de1cd-c493-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stealc)", "timestamp": 1679037327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679037327, "uuid": "379a542f-2ed3-46a2-8eee-db25dd546ff6", "comment": "Malware payload (Stealc)", "value": "4768ee1305bea7890764bf47d3185335", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679037327, "uuid": "927aca68-e8fe-4e43-b969-0759fcdbb8f7", "comment": "Malware payload (Stealc)", "value": "ba22d964e19050f18e2616497d28864c3f3e7e4f6769b6b55020002af356fd52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679037327, "uuid": "7c4c7e46-6f6e-4890-80a7-f4adfa5d5c2d", "comment": "Malware payload (Stealc)", "value": "d373213fdaa3ecd26432d97f4ac66a52c5a0f4a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679037327, "uuid": "2931359a-08d7-45db-b8ca-2a562690aee9", "comment": "Malware payload (Stealc)", "value": "fd8f8c606c76467daa7a56bd3879d6f791e4540bd56f47ef0db37d492d1b27bfe626fc4c807c85c7b150e4cbe5c70e22", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679037327, "uuid": "324ac48f-4709-4250-97a7-08614d1941bd", "value": "T1FD048E0393E57C64F5264AB19E2EC1F8771EB4538E79AF6F23185E2F0872162C56E390", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679037327, "uuid": "ae56e379-3d65-4143-bc17-3f2497f31ae5", "value": "4b2faf5e2157c756cf2fd31d6cfd3d44", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679037327, "uuid": "4baf9ebc-8ab7-4d16-9ee3-f67fa371b8a5", "value": "3072:7OOq5+Vs6k4Y7RdE8ejh9b425/TuGM4bwKHs7m/hVbdJB:nq5Ww3EFhqy/qGwEs6/hXJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679037327, "uuid": "f756a95d-0ef9-4b6d-bb7e-786a40e05ec6", "value": 177664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679037327, "uuid": "dda8acf9-ca3c-4bc6-9433-825cec47d0d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679037327, "uuid": "add316d6-0223-4e37-8625-6be3f495f445", "value": "4768ee1305bea7890764bf47d3185335.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d265e06-c4b1-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1679050076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679050076, "uuid": "1c664bc5-092f-4594-b911-16735f25069d", "comment": "Malware payload (RemcosRAT)", "value": "ca8572b2750b75f7b137637093922152", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679050076, "uuid": "02dd077b-faf1-4126-b688-d0a22a9092a0", "comment": "Malware payload (RemcosRAT)", "value": "ba484a35c10e0de7b344da174c26560e29bd3fe895216f9d03c0ce1cfc3de706", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679050076, "uuid": "6018a023-63a0-4420-ba94-fd324e1b5cc5", "comment": "Malware payload (RemcosRAT)", "value": "d469ae7578653dea542a637475aa781da791c5c9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679050076, "uuid": "973e3c3b-f89e-4294-b58e-7aeadca6635f", "comment": "Malware payload (RemcosRAT)", "value": "cd119c90becd0f68ea317fceab35ddbfd15a715af43e6687efd098f7dfbcf3a631da2a27e1e47f722945c822a8c2d2fc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679050076, "uuid": "2c357002-cb90-475c-a124-dc1481286cc2", "value": "T1CEE5912DC82B0D2BD17ACA388EDD4733BD91681A321CDB7974F293FE9796482748245D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679050076, "uuid": "29c071ca-a7d4-4dec-8991-058c32bd111c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679050076, "uuid": "85ead20c-a08d-4cc7-ba4b-93bdd3fac385", "value": "12288:HimcoNM0Gg0OaJaX6eO5UKhbh3qpoGhiPCyW+SqFpA:aLhraO5UKyquiP8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679050076, "uuid": "0803fb0a-f326-4fdb-997c-a80655033f83", "value": 3107840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679050076, "uuid": "b32c5ab8-609c-4246-84d3-aa20c465fa98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679050076, "uuid": "8261aa1c-4d0a-413e-9fb8-106be29aaf6c", "value": "ca8572b2750b75f7b137637093922152", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d59b7455-c4aa-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679047352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679047352, "uuid": "b6e585a1-4a05-427a-83d3-7e2c56bd6803", "comment": "Malware payload (Mirai)", "value": "772c298695511310d99e202404885f6d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679047352, "uuid": "d2707faf-17ab-49c0-b960-124602dd2619", "comment": "Malware payload (Mirai)", "value": "ba62ad501f30859dbae0233eded1c8bfe6847bdfe4c4293d2fd892f3569999f3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679047352, "uuid": "76fd8329-4ead-40c3-abcd-36b52d81e671", "comment": "Malware payload (Mirai)", "value": "81b993eb7ac0e8611802344fdd4fb9e7679bb405", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679047352, "uuid": "88dc4b6f-86a1-46e6-b23b-dbb7fc2abb7f", "comment": "Malware payload (Mirai)", "value": "2c07e029111cce69e31462c9755e8a5ba204a4974472cabc405f8117cc5c7a501e16cab48ea5791d4c492ffc1e36bda7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679047352, "uuid": "b0bce6ba-9696-48d3-a4f4-a652e951fd97", "value": "T195B39DEBF2470160C8624AF007CB4BED3E2723815F27C5E76C6A257969791CF8906F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679047352, "uuid": "89d25314-aada-48b1-8152-1e79dbe17d90", "value": "1536:wu27gBY2SSpHP9pEFwiLShWnwg1//LWK:R9xSyv9HiLShWwg1/q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679047352, "uuid": "2f532258-0860-49f4-b1a5-259aae66acbd", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679047352, "uuid": "2338b2a0-7361-40fd-87f1-28aa9e5c2410", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679047352, "uuid": "ddd530f2-27d6-42d5-ade5-6fc759b82da1", "value": "772c298695511310d99e202404885f6d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c23189f5-c4aa-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679047319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679047319, "uuid": "b2b1eab0-c811-46a8-a94e-947f41cdd46c", "comment": "Malware payload (Mirai)", "value": "46fd110aad0ab45a05c44f59f827eb79", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679047319, "uuid": "c1f57b3a-e104-4d8b-a448-f0e93f37aef3", "comment": "Malware payload (Mirai)", "value": "ba80131b5d169cf5bfe16db4d6172a6dd00a895a2eadc1ff3e5ba8fc21b1ead7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679047319, "uuid": "895a4c48-8f83-4ca2-b2eb-34414c94aeaa", "comment": "Malware payload (Mirai)", "value": "7a17cb000d2b4ce11f984294448e23ee0d77379b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679047319, "uuid": "86eb63c0-bdf2-4b21-92ff-6a371c00d931", "comment": "Malware payload (Mirai)", "value": "368b598c97fe1d3c27cc7135cc788debc044551edeae04d950ad54bc799f2275b79a16b498f84037c94fad873f09dc54", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679047319, "uuid": "74431a99-5a89-469f-9097-4abc8bf3bcbf", "value": "T1ED337C67D82A4D98C5194278F4688D391B13F408A2973EF65E8EC762501BDBCF60E3F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679047319, "uuid": "afeba45b-4860-49a7-b3d5-9b34752afe7a", "value": "1536:uaok/dgBORYzVUsvbE04/EFDBiSurCei:uG1ftsvbE04/wDYSur", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679047319, "uuid": "3fac16d4-1a79-416c-b1f9-489b23dc20c0", "value": 51968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679047319, "uuid": "26292617-41c5-40d6-820b-aaabddcc6569", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679047319, "uuid": "903a6035-e938-4223-a4cc-67c9516de980", "value": "46fd110aad0ab45a05c44f59f827eb79", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ece663b-c4a6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1679045408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045408, "uuid": "bc7f5a68-e05f-474f-aad9-26b06738fd51", "comment": "Malware payload (Gafgyt)", "value": "0cd0f23ac0c2956b53b7ad6ccaf6b274", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045408, "uuid": "b8930595-4117-4992-8996-c012e3279c87", "comment": "Malware payload (Gafgyt)", "value": "bb6376e1fc96f0b5bc3ff0fd5228a0fd685f9ac369198392e6bdcd4f76f2716d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045408, "uuid": "b0cfff11-4772-40c1-a267-4ad3f28e021f", "comment": "Malware payload (Gafgyt)", "value": "6be890d4a38313bdf89870806e03fb54f2167830", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045408, "uuid": "8e0524fe-f679-43a2-b062-0a72ae5b41fd", "comment": "Malware payload (Gafgyt)", "value": "35f2fb37c481d5ca2d3e694495935e3eb488586e87d3281901807df63470c3db17507788c9f08544a21bbfd343204b93", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045408, "uuid": "28e8bf0d-6aef-48dc-90ca-a1909dafcc6b", "value": "T159633A426791CAB3C58316B90ADB8B250633F93F1E5A9F56F32C3CF49B19084B127769", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045408, "uuid": "6cbdf09f-4c66-4639-b964-8647792ef39d", "value": "1536:L/35eg70gpkPZHPQ2XH3di1JBBtvPCHL7bqvBw49mZ+LVO049unnuY:D34gFpkhHPB33wLtvKrfqq49mQLVO0iK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679045408, "uuid": "6a772eb4-c0f7-4ebc-916e-588a6d2e2a13", "value": 72807, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679045408, "uuid": "380b358d-288c-4ddd-b567-1b009df165a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045408, "uuid": "453c258d-0550-43e8-b776-b3dad8c523c3", "value": "0cd0f23ac0c2956b53b7ad6ccaf6b274", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "539d7d6e-c4c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1679057012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679057012, "uuid": "8d61dbe3-4468-4d4a-b434-7f727ca4095e", "comment": "Malware payload (Formbook)", "value": "da690707bf6b9eb7ac725ffaab138475", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679057012, "uuid": "e3ebf56c-9b2b-47cd-9d13-daa1297acc5e", "comment": "Malware payload (Formbook)", "value": "bbce59cd09b98759f1e8de287441906c11a8698581e9a84e302626e48abc7c38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679057012, "uuid": "58400169-9be0-47b2-8809-5b6870d32051", "comment": "Malware payload (Formbook)", "value": "1e5efb5684744cdad3710e2baea7a61c1874029b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679057012, "uuid": "e975d016-a163-4329-94bb-0fa0861e7194", "comment": "Malware payload (Formbook)", "value": "42d56113a7e7f50eddea9f4b6e4492179217dab2b38eb821e94afe28246c845a03bc0144de1ecbda2b18003030d322f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679057012, "uuid": "afeb4cb3-9c41-4d3e-997c-58225d0244e6", "value": "T18705024DAAE4982AC95D0BFAD4831C2052739433AF56DF0AACDA00E61F223FBD4559D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679057012, "uuid": "69ce5dc6-7405-4507-9999-e5991ffa5490", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679057012, "uuid": "feaea596-24bd-45cd-a80a-2a88889f22a7", "value": "24576:OJQwcozQuRMLoqEAjoIpDmLRSacJfSartfFC1OQ:JopMLoqEeoIpDmDcJfSa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679057012, "uuid": "2c464ee7-8406-4f67-9a92-11f5abd90b8c", "value": 847360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679057012, "uuid": "d91b960b-8c03-43c4-961c-bd43171e17bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679057012, "uuid": "aacb782d-e95e-45ae-8f79-5a0755e3bab2", "value": "BS Orden de Pago 20230315-1000_0000015444552000_001888.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fdb19d6-c45a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679012687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679012687, "uuid": "7fc12f32-442a-4e09-b2b0-eb87e78ab4b0", "comment": "Malware payload (Mirai)", "value": "ded37c427140ac1cbce09125a9d5d397", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679012687, "uuid": "d2a64d3c-06b9-407b-b37b-ab95970e02e8", "comment": "Malware payload (Mirai)", "value": "bc2c5519d9ed9969370ac287655bccd4429a6a5eba67483fc2511270424b3202", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679012687, "uuid": "04fb0bfc-e994-4d19-a9f8-60b77588448c", "comment": "Malware payload (Mirai)", "value": "464dc6ec63a7cc0903790e46a0074e829c3e62ed", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679012687, "uuid": "aca9cd5a-4e05-410a-86cb-9cb74135b499", "comment": "Malware payload (Mirai)", "value": "760b06b5dca29277e1558c40aa4a7218dc76b7a067c4c2d10085961ad99641e8db1c85a2a3751483722ebc460b7a39a1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679012687, "uuid": "be7c8fa5-e40b-4ef7-b04c-ccc0daba3df2", "value": "T157D2E1E0958C45A2DB7595B1DEB4DA8AF36D23B7C0E83226293006E4B7E2017D3F5365", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679012687, "uuid": "53c79b90-7917-4e6f-87cc-066bf382cffc", "value": "384:MAfJgj8DVFU92UorP0VG4I1qP5wttrZVACfM1m/7zWh5BbNi23ypBZhymdGUop5F:BJ6eDUorP0JdxuNfM0+Lbfyp3s3UozF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679012687, "uuid": "09a6e89f-b982-43f6-b2eb-e851441918cf", "value": 28912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679012687, "uuid": "d9c0aaca-5475-4473-81f3-9af98fc3682d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679012687, "uuid": "64a0f948-3fa4-421c-b390-03d9488f0075", "value": "bok.arm4-20230317-0024", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30a9d0c1-c4e3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679071557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679071557, "uuid": "1c829bb1-e53d-4b8c-bdd6-4522abc0d09a", "comment": "Malware payload", "value": "f6a130e5ddcb1f63b1d12fe19ec57c53", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679071557, "uuid": "43ceb07d-6656-4db2-b6ed-cfab7905bdf4", "comment": "Malware payload", "value": "bdeb94b7aa7a0809bf019c37b3b436bc6143f3c00144f17d411e047b39368477", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679071557, "uuid": "5ff43c5d-65fa-41a7-9b7c-767768c60cc6", "comment": "Malware payload", "value": "ae72bb4b9d1fd72829e1a113c108f61b52b51238", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679071557, "uuid": "b3cc9258-b499-45a2-ad7b-4ec7602ad6b5", "comment": "Malware payload", "value": "cb819c0f7f3295a0e14998e7964ff8777a038d9382e7e84202acc6b5f3b0ffdb233fd960c63c294b1b70cf5557a2fd12", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679071557, "uuid": "dd3aa689-a731-4d20-9604-37ad0cdcd2f3", "value": "T1C255337F94C13063E6EE15B4A224D486B2301033BC766A7F29C466F79A436854BBD3F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679071557, "uuid": "1b63bb91-cc29-4e53-ba90-06418bbcd98f", "value": "24576:SsUZsCYwwgsv5minLaTMy9Qmle8cAWixa0DIc7Yu2i0KZg0HSVtHqN9:pCkv5mhwtmcfexa0DlaWZnYKr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679071557, "uuid": "6c4f49cb-d296-445c-ae1b-9491b5e1c971", "value": 1340223, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679071557, "uuid": "5823166a-0994-413e-a47b-681b0b048312", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679071557, "uuid": "b0281e33-f5ad-465c-82d7-e9949960cd58", "value": "Shotdown of Chipmixer(DOJ Report).docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da68ebf6-c46f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679022020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679022020, "uuid": "611cc845-c4b0-4d11-8104-f7256732d1ec", "comment": "Malware payload (RedLineStealer)", "value": "9ae2499b72425187f7af73673c8566ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679022020, "uuid": "cc800aa6-c5f3-42b9-b39d-78cecb19efb3", "comment": "Malware payload (RedLineStealer)", "value": "be2b2059ed2a5443355036db58283a4fae5d7f86578ef322b3fbfcc128a473b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679022020, "uuid": "3147d854-b551-4286-9c46-2b7e5edc9363", "comment": "Malware payload (RedLineStealer)", "value": "2be5bb4ae0b1918e6cf2812ad3e8902e02595fa1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679022020, "uuid": "7321cdb0-8225-465f-b364-2ed3b473ea07", "comment": "Malware payload (RedLineStealer)", "value": "0504b7748578be444ab061e000a756f2e32fb81ab0496affe436d1768e2b17e4b8463b4c5aae22ede33961f91cf8492b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679022020, "uuid": "67a4250b-ffc7-4758-887a-e69a75d55cda", "value": "T10B45020393E1FC88EA2A8B72DE1EC6F8765EF5518F49376632285E1F4571176C1A3B80", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679022020, "uuid": "3790f00d-55ab-4be0-a2fe-8997273afc71", "value": "02bcb533fc6eab16fabdf3b7ff49a9d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679022020, "uuid": "e0757205-4528-4a67-8e25-655dd02ee3ce", "value": "24576:M8ohR8bPifxEqc0/cCB4NZxNBF4dkU3eQPXaI95:aRDEZUXB4PdF4RbPXaI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679022020, "uuid": "fe822041-9547-4ba3-8f25-6d3c1e3ffba2", "value": 1246720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679022020, "uuid": "208df378-9b90-4b19-b4d9-c6d57d9b69a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679022020, "uuid": "3550d389-9790-49ba-9cf1-224201ff4e84", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "715bf065-c4c4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679058351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679058351, "uuid": "4c2cea57-d640-402a-9512-50b713edd01e", "comment": "Malware payload (Mirai)", "value": "8650180848768184cde3a7534b7356b2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679058351, "uuid": "b77c2179-08ba-4ba4-bdf3-9313c5d1efa9", "comment": "Malware payload (Mirai)", "value": "bf6d2c8df772040acd6c642b91994f7f4352aab61b475019aaca989b7a084af5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679058351, "uuid": "c86bacf3-d649-48e2-a68b-5dc5909f85cc", "comment": "Malware payload (Mirai)", "value": "a460395d2cf2e9ae70f0bd150ce9c0c2fa4b41b0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679058351, "uuid": "141a700a-5108-4f95-9478-e36f0d2fc6aa", "comment": "Malware payload (Mirai)", "value": "8be210231908b6b9c2155fbfdd3127f7d495027ab56789efae67c65f29f5f25b936a06d187908983b046d8d519a6d167", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679058351, "uuid": "79ab63b5-f0f8-4035-9291-22eb76a2c628", "value": "T186933A07B71C0B53C59B5AF12DAB3BF08BA9B9E013D76185610AEFD04376EB12412FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679058351, "uuid": "a5d41ace-3f31-477a-89a6-cc0f924480b9", "value": "1536:tQKF3vzXtdfTZdapLMB1cXakCpv+wiV18fwkumXxVqDrstKfz9e:tNb7t91cXjk+Y/umXxVqDrIKfz9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679058351, "uuid": "0af26e11-2072-4814-9bae-60550fabfe84", "value": 93888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679058351, "uuid": "f0cc4b8b-ffe3-438c-b779-14330791b693", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679058351, "uuid": "4699a850-6eae-43c5-987e-e043e0b752c2", "value": "8650180848768184cde3a7534b7356b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f4651db-c4ac-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679048093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679048093, "uuid": "09333a1c-0174-44b3-a411-43ebb141d7b9", "comment": "Malware payload (Mirai)", "value": "0d4987663ae58d54ea8aa3e5b2ee9760", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679048093, "uuid": "7dabf824-a4b1-407a-952c-7b7d200a8751", "comment": "Malware payload (Mirai)", "value": "bffde171091ae9f91fa806105babb89c13f47909b35c609cfc75089a0f494dda", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679048093, "uuid": "a9c71f03-9316-414c-b85c-bb40327a7fa5", "comment": "Malware payload (Mirai)", "value": "e716136c10f4621207badd1ca49e34b4ddda8eb3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679048093, "uuid": "b5f6a2f0-dfb0-429c-a1db-d9e1ce7aa933", "comment": "Malware payload (Mirai)", "value": "a3687ded615480c3f9cbcf1967a5dd1cc84404814213f4e5164a65cea8b418bcdcba4356686111b15af484332edaf5b7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679048093, "uuid": "c39e1a0b-016b-4950-a48e-decb5806d2d2", "value": "T13EC3E730E8044B1BC2D223F6E75A869E3F351E9797A733155B3879B02FF27991E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679048093, "uuid": "759919ef-c50a-429b-8fe2-0c36bc5061ca", "value": "3072:4jDy/+mh1vtbPIKa8bpcUPium7/L7QsvmGfIiNb:mOJ1vxfa8bywm7/L7QsvmGfIiNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679048093, "uuid": "127c5030-e335-420b-9ff4-5f41908b8178", "value": 125008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679048093, "uuid": "e48b7ad7-13e1-49d5-81a6-a5b0a406915e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679048093, "uuid": "7aca283a-5247-451c-8ec8-a4b99c9760e2", "value": "0d4987663ae58d54ea8aa3e5b2ee9760", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd95e0da-c4ee-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679076625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679076625, "uuid": "86f20b02-d806-4571-a392-b87ef8ef7682", "comment": "Malware payload (Smoke Loader)", "value": "9c6e3d830653a68493c3755dec0f8425", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679076625, "uuid": "53203a03-01ef-495f-ac79-b3802fc6d966", "comment": "Malware payload (Smoke Loader)", "value": "c04020e5e9111141155e941bb9c6e22e63cb79f0f707d3261ca35b1d57c2c215", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679076625, "uuid": "ec4c6ff8-d36c-4ed3-a768-00c0d951ccbd", "comment": "Malware payload (Smoke Loader)", "value": "8caaf93f9f3279c65517f5133751ab37bbf77f58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679076625, "uuid": "684aeb76-8907-4932-ac05-0b78961fc19f", "comment": "Malware payload (Smoke Loader)", "value": "0f7e7995baf5eed7a886c5820923334effa3ac42b3fa007a36c790a10e7ddf41599deb4d8a88b986a1daf0c896162247", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679076625, "uuid": "dfa54fa9-794a-4b6d-b9d4-c33b6ce775ae", "value": "T11254084392E17C4DEA264B729E1FC6E8771DF6518F89776932189A1F04F21B2C163EE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679076625, "uuid": "2df95497-c73b-4f12-8afd-dc228a77fcce", "value": "6e76b494f1a9946f83b6b72033f310be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679076625, "uuid": "928593d9-7377-43f9-bfec-863834774393", "value": "3072:v00qLg1LgBGrSaG1pLqvnvUuSXLz1GUVvuG/YfQFaI4yhituCuM:cXg1LgwrSb1tUUuhUVGN4FDMu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679076625, "uuid": "52a51a99-4ebf-4e9a-a2db-39d8df65c4f6", "value": 303616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679076625, "uuid": "cf300b4c-9904-437a-9d1a-db83f2a4a206", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679076625, "uuid": "ea7ec7d9-db2e-45c2-bc1f-e07db5bf8143", "value": "9c6e3d830653a68493c3755dec0f8425.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6612c58d-c4a5-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679045017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045017, "uuid": "99c783c2-24c4-4335-aad8-7e21b14c2d32", "comment": "Malware payload (AgentTesla)", "value": "b3c2afef4f19dd4927dedc12d97876f3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045017, "uuid": "1ed30efd-7ae7-4872-b3ff-a7ffe33d7e39", "comment": "Malware payload (AgentTesla)", "value": "c20c406573105725a8bedbd6528b1cd762c0d28251c37764c711374524c266bd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045017, "uuid": "02fea102-c330-4e7f-9d84-2a7c8e636b95", "comment": "Malware payload (AgentTesla)", "value": "67d400a197e57299fce6f1017e166118cedbefd2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045017, "uuid": "0b14e78c-8d30-49cb-a1b6-9668261ed182", "comment": "Malware payload (AgentTesla)", "value": "d40158f8bfc1484afe872a442254ecc4d675ac25b93c047bbba0c2ce51a4e83b2485790e8a19ba606d6fbbcae92798e5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045017, "uuid": "76c09831-aca0-4422-b97e-4fc9c03e150c", "value": "T1D915124C66BE1731CA7D33FB90A2144453B4AA11AA56F36E1CCA60F70ED37CAD601D6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045017, "uuid": "dbe1e388-6a38-41a3-a348-67512505ac50", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045017, "uuid": "5f2ede8d-7b0d-4577-87d0-706991f70d3d", "value": "24576:8y2JTtNSVoI52B7Yfx6dfVCMsMhrdE2De1HSUs:83FtEVoI5s/0MdpE4elS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679045017, "uuid": "80786e6b-2f0e-4c41-b318-846ae6d53a3f", "value": 930304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679045017, "uuid": "971dc77c-df23-4141-98fa-a245090f1996", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045017, "uuid": "713d03b2-17c4-45e6-b878-7b8f7d70ed61", "value": "b3c2afef4f19dd4927dedc12d97876f3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0c6d6a1-c4a0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1679042995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679042995, "uuid": "57c800b7-44f1-4e9b-a3de-0b4a824fdf9c", "comment": "Malware payload (Rhadamanthys)", "value": "e17a58aef541d7e2c6e72502fc960112", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679042995, "uuid": "bd774c37-3b71-4ce9-8788-c396ecc2ebb4", "comment": "Malware payload (Rhadamanthys)", "value": "c25a91502defaeb2ddebf18571e737185f764c87de4b2d659bb1d3a087929129", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679042995, "uuid": "35aa646f-014e-4af6-91d7-613df1478bd4", "comment": "Malware payload (Rhadamanthys)", "value": "76714af3bef5d25c0c01186aeb79f81edba667fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679042995, "uuid": "d542a5db-8a20-48f0-8e59-7f513e56b07b", "comment": "Malware payload (Rhadamanthys)", "value": "23d522f3f3a270c10d194909b45e27de035bd1fcaa6c20057bda906f40711fd9e5c0ee8941bb267bcdc1f079ea726b94", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679042995, "uuid": "26ec4e5e-7906-43c3-912b-626e11ab0713", "value": "T143845B43CBE17D50EA268B77AE1FC6E8761DB660CF597BA62218DE1F04B0172C163712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679042995, "uuid": "06dddbc4-b2ad-432f-b42e-1c17a483080d", "value": "abe3ddf8623240e0db2d6ab65f42f1d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679042995, "uuid": "27c62fe3-78ca-4a20-b420-17402045460f", "value": "3072:r+XICBBGkLNEzTZPXV02u4RmknaFYMmGLHp0bIobJE3Kz5gjIlkO4adDpTl/I3XI:rkIIBbLWzTL0R8GLH6IMEKgUl1xGXN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679042995, "uuid": "9824deaf-5a70-433c-bf9b-16e0585aba5d", "value": 371200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679042995, "uuid": "6fc6b419-01ed-48eb-8c58-ede19ff9ff5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679042995, "uuid": "3180f69d-a615-453d-b7a8-d809833895cc", "value": "e17a58aef541d7e2c6e72502fc960112.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50e8f00d-c49a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1679040257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679040257, "uuid": "d1fde32d-32b2-44f8-9e82-f0289e5b1df5", "comment": "Malware payload (RemcosRAT)", "value": "0d6f619554c6de06992c444d8b3c9a74", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679040257, "uuid": "b89d9769-468c-4a34-94bf-ef31eb1e97f3", "comment": "Malware payload (RemcosRAT)", "value": "c29ac11a91f5f0d9af18e4c5845abb6e024fe682e1287e76ccd6efc218240269", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679040257, "uuid": "d091dbb1-cc7a-4df0-9036-6f6fb4af58e4", "comment": "Malware payload (RemcosRAT)", "value": "82a9f8709042a0b3eb9e7aae5b2342bbfbca3e28", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679040257, "uuid": "dcdb048a-5837-4d36-9a32-4dc0ad7d2821", "comment": "Malware payload (RemcosRAT)", "value": "b01589539f52fbf8fbbce12f93536b6c5e918a4ef79e9f505e7a6a90307376faf41f03a497ad013cca689338e8986da4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679040257, "uuid": "fede3276-dd0f-4bdf-8468-f6fa81f52f54", "value": "T18895F1473115B9FDC4B201B9E82AAF918DBE7AB0673583B37250EB5E6560EF7643C102", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679040257, "uuid": "801a0ba4-b5a8-4b35-8c68-ff62763913cd", "value": "5044024844498395d0e63ba22bbd9978", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679040257, "uuid": "5f93a449-bbb7-4cc9-8110-f2c0b30b79a0", "value": "49152:mzJAxzft/ePFG/o0b6AWXP/mfmeWQiN42uky4ZEzS9KXZ:mFAxDVePFG/o0bPWXPupPiPuky40QKJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679040257, "uuid": "5459f0db-eabb-4c06-a86f-7d7815133b6f", "value": 1949112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679040257, "uuid": "3c29cf41-7644-4e01-b0bd-c4c0f445eee1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679040257, "uuid": "2589d9ca-5e70-4cea-984b-48f6815f1011", "value": "0d6f619554c6de06992c444d8b3c9a74", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44acf9aa-c4f6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679079751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079751, "uuid": "7f444dbe-f214-42aa-b24b-4d6b278b93a6", "comment": "Malware payload", "value": "af95a66406c6e7083d903ba632cffadd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079751, "uuid": "558b9b42-3f7f-4089-9370-3a242d7b03ef", "comment": "Malware payload", "value": "c3633fce5a9fb0f2bd28bfef7dbc3a295f5d3fef106955ef8dfcc0d5748a3461", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079751, "uuid": "fd6e6870-9a07-477f-8cf4-51cd90ee6438", "comment": "Malware payload", "value": "373489a3087fc63bd2dc410da784bc96072c112c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079751, "uuid": "e1413501-d0ab-4033-a91b-a82bd5aab360", "comment": "Malware payload", "value": "0e60a43a8d1ec0f5ab1f9d8a63bfddb6a313aa95bbc98d3ae9ec84b998429d4e2cf8fcfc42ebf312fa95d8cc31f1c0b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079751, "uuid": "a99e2bcf-e433-4d5f-9d20-ca26f6e7afcf", "value": "T1C6D5239392A03D5CE5178B33AE1FC6D8370DF561DF59F76A32259A1F08B2172C063A91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079751, "uuid": "692dc6d4-72f5-4223-bfb1-8afe8bfeb823", "value": "6e76b494f1a9946f83b6b72033f310be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079751, "uuid": "eddc26ab-54df-4e5e-804c-e6d988f0eaed", "value": "49152:LeJvWdZ+TmdOQYFOWRv7K4UDrlMCBNDN/A746n6DgJLZMxs2fKpzWhF2:LQvW+TmMQsOWRv6rlZrNC6Dg/MhKpGF2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679079751, "uuid": "fc2a29b8-dc60-4e69-96b4-345e477ae312", "value": 2787840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679079751, "uuid": "caeea8d4-2ecf-4be3-9e90-ac2f2ae137cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079751, "uuid": "939e65ea-42d0-4f77-bac0-1d19add7952a", "value": "af95a66406c6e7083d903ba632cffadd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "495eff13-c4a5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679044969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044969, "uuid": "b1889d5e-58f7-4cc7-9f2e-25de4a1ff3b9", "comment": "Malware payload (Smoke Loader)", "value": "741c8c1b81e1517b4486a15391719627", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044969, "uuid": "02086659-cd8c-47a3-b937-09f9f797446f", "comment": "Malware payload (Smoke Loader)", "value": "c47dc2eaf404c8eba401e9ba87ec9afa6dc03f309b2475828b18a76bf212aca3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044969, "uuid": "65dc3100-5e17-4847-8f46-a8df11dc60af", "comment": "Malware payload (Smoke Loader)", "value": "aecb2eb2a4078817afd24fda32032acea90bbaba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044969, "uuid": "8371e549-d372-4391-bda3-f6c92682a4dc", "comment": "Malware payload (Smoke Loader)", "value": "34b11e982b2e551dcc1fcd267851c63ad99918662494ea912fcda73519ae09bef020df0852853fcd98c71d31a80be055", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044969, "uuid": "24667cfb-7812-4672-a9a9-491088c9bdca", "value": "T1BB047E0383E57C65F5254B718E2FC5F8B61EF4138E79AF6722189AAF08B01A2C56F750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044969, "uuid": "fb07eaca-7568-4fdf-8cda-1cf7e407be6c", "value": "4b2faf5e2157c756cf2fd31d6cfd3d44", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044969, "uuid": "c374e7a8-fd04-4424-9578-6ba3fe08bfd1", "value": "3072:Tor8++GZZ/YWitdHyX56k9Q1RiKhGKvjm/hVRdJB:a8JuX560QniKhW/hdJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679044969, "uuid": "f32786e3-cb75-431e-87fb-5c0eb2cb1e9e", "value": 177664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679044969, "uuid": "7d344237-5dfa-498b-953f-bf44d6710545", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044969, "uuid": "bbf04be0-2695-48f3-b921-8f69742b69d6", "value": "741c8c1b81e1517b4486a15391719627.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "849474c5-c4ba-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679054088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679054088, "uuid": "5bdc1b65-3b66-47cc-9aa6-a983579d3df2", "comment": "Malware payload (AgentTesla)", "value": "97f0073853faf6386c475cf2cbdfe757", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679054088, "uuid": "1d76dd77-f5d6-466d-be63-51e04be61986", "comment": "Malware payload (AgentTesla)", "value": "c548ee70242147de73e5bb0f457247679adb045a82930be9c3e90b8c383d74cb", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679054088, "uuid": "48f66449-db2b-4eb4-a8c7-e12ccce5e4f1", "comment": "Malware payload (AgentTesla)", "value": "68dbafb6541b54a9b6ee66fc22bbce1b3624d268", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679054088, "uuid": "efaa7d55-7b4b-46ef-8367-d74d12a0f3b7", "comment": "Malware payload (AgentTesla)", "value": "73495b6e14c2920d1a1e87d940c0bf8ed8563390fda99be603e54ff985f9bf99abad27c8758a17129b83652674ab25a3", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679054088, "uuid": "963b3ec0-78ed-4093-8b9a-7dc0ed4255a2", "value": "T1C5F433CC5744632877A2610F44E26F307ECCC285B56DF9EF8862B92D4DD2FAC0E911A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679054088, "uuid": "6471c9ec-c1f9-4cdd-990a-e407f7d947ed", "value": "12288:ju6EYCUZgGeTrS8IYGEJvoXhjxLdtUMaRBmmm2dJcr4/OAETArEa6kYiBe/UgpnL:i6EzUZVCS8imvox9xOMaRBZhckxQArNo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679054088, "uuid": "1f5cc9ea-b1a4-4e28-b7dc-d7cb55e0d2f7", "value": 749907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679054088, "uuid": "52df0a20-c9df-4946-91c7-4e414717b6c6", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679054088, "uuid": "a40ff2d1-9bae-46ba-8c5f-610a6476282e", "value": "DHL PO1001910 Sample Arrive.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aa09710-c4f4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679079009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079009, "uuid": "7e2625d0-b41f-411b-94ab-6478b397d279", "comment": "Malware payload (Smoke Loader)", "value": "9e92fb17e45709208eee7e37e2c25f34", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079009, "uuid": "0ac59c41-6cf3-457e-9ddf-2954a1e1cb48", "comment": "Malware payload (Smoke Loader)", "value": "c5d2fce98a46668a4c6313125c93ffa5d0978a491bfe07f16b13c054de1fc69f", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079009, "uuid": "6e1ef1c0-aa2a-4383-abb8-4d07942f12b3", "comment": "Malware payload (Smoke Loader)", "value": "ee1f6ae7052818f92f9b858070bbde180f9f2a13", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079009, "uuid": "a4e093b1-171d-4bcf-894c-2ab45eecf27d", "comment": "Malware payload (Smoke Loader)", "value": "f03e9149cc2540373a2caf5f75808b1f35ea465facdb355b2610b03cc882f556cf2bb6fabe7a7d697245ce8fc5a6161d", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079009, "uuid": "5065c4f4-2116-49b6-b15c-3e9e0fabc9d8", "value": "T114543A0392E17C4AE9268B729E1FC2E8771DF6518F8D776972189A5F04F21B2C163F90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079009, "uuid": "c673af1d-3f5d-444e-a5ea-43fd8b261d59", "value": "6e76b494f1a9946f83b6b72033f310be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079009, "uuid": "ee62cd0a-ea16-43d5-9e35-4dcc4d4ad769", "value": "3072:qUQqkrwDLVNWt+PYXeXWo00ss4clKJJqa95I4y9ftLU7MauM:r1qwDLVct+P2pJ0seQJka9A4wau", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679079009, "uuid": "9a419c61-8644-4f14-a18a-8fad33b8e4b8", "value": 303104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679079009, "uuid": "ece1f4ec-9e26-46b2-9914-7ca8c4f05db4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079009, "uuid": "a8345063-ae93-402d-abb1-02e68d523da0", "value": "9e92fb17e45709208eee7e37e2c25f34.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e949c97-c4c5-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1679058615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679058615, "uuid": "1cc772ce-822f-43eb-ada4-152d60b2d6ac", "comment": "Malware payload (GuLoader)", "value": "f111934675c34cca18d9d76fc34a2e40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679058615, "uuid": "b37a9474-0c28-432c-9828-b515be04d98e", "comment": "Malware payload (GuLoader)", "value": "c627b8bb6c4ea0cf03aa2d209d0ecc53ff9784283328dabd44c1675aef0939c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679058615, "uuid": "40438d48-6b4f-45b9-bcfe-8f4e80074453", "comment": "Malware payload (GuLoader)", "value": "6c54e0fbae03df56fee84195f3deb4d2ebd8d8c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679058615, "uuid": "d949d74d-7c57-4f3d-876c-86b97d3d7e60", "comment": "Malware payload (GuLoader)", "value": "5fba5c4c322f2f718b02c125774dab3d211e205273516037a86229cda309146cbe3cb948c6531c04c05e4d26b0bf02f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679058615, "uuid": "564467e6-61a9-4a0f-8bf5-77e7fcbab84d", "value": "T1090523919D24D01ACFCB1A32C6E0AAF51FA93D1DF546350FAB103DDE7AB3016992E1D8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679058615, "uuid": "c2d6365e-3e26-4972-bc9c-e572ad8b6a6c", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679058615, "uuid": "7ef22599-c947-4fff-97bd-07ee6dca9230", "value": "12288:cJAEzBf4FZZmubGJ6vVZgj9Zp4RVkdXALai8ZpP7MxhGmeLJfRriFm4gCb5vr:cJBf4guba6voj9mOdXALN8bP7MxhVP5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679058615, "uuid": "4890a7b3-0966-46a8-8520-4f7b08ae8772", "value": 861416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679058615, "uuid": "4c7f5472-b88a-4808-a8f0-c6cd70136a1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679058615, "uuid": "ecfc85f0-ebaa-4e2c-9abd-0966f1f9dce0", "value": "invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfd28cc4-c4a6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679045624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045624, "uuid": "16b9f3f8-7c4e-4bc8-8255-7e898d75f0da", "comment": "Malware payload (Mirai)", "value": "f3e77700778fc15dd844c4e6f2db2d3e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045624, "uuid": "da28fb96-0395-4dfc-92e5-fef6202675cc", "comment": "Malware payload (Mirai)", "value": "c62c7aaa3ad4531cf64904ac9eac4e40b0946fd24bbe08513f3bba814796af85", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045624, "uuid": "36976eba-cd8b-4f00-bf45-dc913df5fde5", "comment": "Malware payload (Mirai)", "value": "e8c036c604fe2a6d6f7e7db6c78b84273fe29a09", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045624, "uuid": "f7d3ee29-0e11-4a6d-90f3-7b8a941f8042", "comment": "Malware payload (Mirai)", "value": "3280e9d989584ae2558aea8575ef644f8fb88e142fb354ee80bc9ce0650becfb001b14285a93e1a4f32d07f269f33923", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045624, "uuid": "8335afce-c458-49ca-b55d-92766a3f8363", "value": "T1AB83D606BB510FF7DC6FCD370AE91702348C594A22A97B367634D828F65B24B59E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045624, "uuid": "432918bf-71e9-4b6f-8170-9bb71cd17ff4", "value": "1536:iVLyu95KZJkj752dCexuV/8UZlDwfkJ4MYfWt:iVLyMgOFezxu5VD1eI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679045624, "uuid": "da31fb38-e15d-481d-8151-12683b5193fa", "value": 84780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679045624, "uuid": "6b5d56cf-4b05-429a-a72c-5a7b121bbe84", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045624, "uuid": "46c7e8cf-977a-47e4-9f70-247f32799d7d", "value": "f3e77700778fc15dd844c4e6f2db2d3e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "312a2cd9-c472-11ed-88f6-42010a9c006e", "comment": "Malware payload (LaplasClipper)", "timestamp": 1679023024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679023024, "uuid": "b0e03107-95ad-40c1-936f-24b079fd5505", "comment": "Malware payload (LaplasClipper)", "value": "ddd3ef96054200d60d04934492a3d672", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679023024, "uuid": "5cb4297c-49e6-4e14-bc96-cdd093036332", "comment": "Malware payload (LaplasClipper)", "value": "c66e87a025b4ccb8f93a1540b999fabf9beb16c455cbbfd189e133ab642e83e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679023024, "uuid": "d00ecdae-afd4-474e-bff0-31d07e6920c7", "comment": "Malware payload (LaplasClipper)", "value": "8ac32d858e32f27cccec6a8896b234affa1873ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679023024, "uuid": "977d0a39-6161-4aca-a7dd-1112b0edef86", "comment": "Malware payload (LaplasClipper)", "value": "8eec7a588b9e5aa89e28b23d961afabcc28cea513bf88166003bf5d37abaa196e8c3113972fe9d0db4f03976d5272a54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679023024, "uuid": "4bf445fe-bcc0-47b9-82a5-c0ff25df1b04", "value": "T1A534B003A3E57C54F52687359E6EC2F8761EB863CE79AF6B23145E2F08701A2C56E350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679023024, "uuid": "e426d129-9105-4711-bee9-c62b79c9406b", "value": "4b2faf5e2157c756cf2fd31d6cfd3d44", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679023024, "uuid": "acefcada-3688-40a2-a109-fa1f8535f41b", "value": "6144:abfmvxMcnAkScaBd5COlRbsQOGdAtqhdCJ:abfmvCcPSc8dsaNssBf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679023024, "uuid": "d4b89ba8-543b-463e-bf24-2e7b23605f4a", "value": 250880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679023024, "uuid": "74520cdc-8792-4d65-a965-c1f3332085cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679023024, "uuid": "cfe87e82-e0df-4bb3-80ce-319e2792bfb1", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a22a1ba3-c49e-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1679042112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679042112, "uuid": "179a4aea-9859-4692-a0ff-bbf2326c735c", "comment": "Malware payload (RemcosRAT)", "value": "218ddf74d466267211be24dac160e93a", "object_relation": "md5", "Tag": [ { "name": "doc_sony274", "colour": "#344B82", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679042112, "uuid": "7080c0fc-99ab-4686-a77d-2773ed5a31fb", "comment": "Malware payload (RemcosRAT)", "value": "c6cbe381d581107b6531067e9108febd3016c9335c1d773e1b1e0ee435525111", "object_relation": "sha256", "Tag": [ { "name": "doc_sony274", "colour": "#344B82", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679042112, "uuid": "5d54d702-98c6-4208-bde7-150d56555d1c", "comment": "Malware payload (RemcosRAT)", "value": "248a34511930902ee72ac60ecb2d78b1cd9a05dd", "object_relation": "sha1", "Tag": [ { "name": "doc_sony274", "colour": "#344B82", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679042112, "uuid": "468a94cc-57e4-4f3b-86c3-e6993aaffd19", "comment": "Malware payload (RemcosRAT)", "value": "cf3b7918df64692db7463bd0530c022f1cd22fc4d6b72e8334230e37b3b220110de497266198839665a6a19b3abde908", "object_relation": "sha3-384", "Tag": [ { "name": "doc_sony274", "colour": "#344B82", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679042112, "uuid": "c6e2f80c-2650-469b-ac42-0e62fb810b89", "value": "T1FA94D078CD73031489AB5FDAAC420D17C6F9951B47120829ADAA338FD566238CFFE719", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679042112, "uuid": "cb3bb9c9-3e74-4797-bbbf-cd3688a2f757", "value": "12288:sCQhlU2PRVPDaZUMIdXKn7sgYu74+FujC:sTU2p1aZ+e7sd04+cjC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679042112, "uuid": "9e7b7f5e-2f8a-471c-a5d0-c6c7bd452d73", "value": 412014, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679042112, "uuid": "60bad8f0-cefc-4463-bc0e-660c0945f3cb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679042112, "uuid": "987ba39f-dd4e-424f-a7a9-168d4af3415b", "value": "D0C93848394-Spodogenic.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23d9d5cc-c4a9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679046624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679046624, "uuid": "0a9a508e-c877-4719-a113-35330bc72ac8", "comment": "Malware payload (Mirai)", "value": "296eb91f3a8b509a8c8ea587ca7e3627", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679046624, "uuid": "55c10fcc-6c10-47a0-ae43-91f243e709d6", "comment": "Malware payload (Mirai)", "value": "c77aa7b133e362429384ecdd14455e8d4925a2e8fde8d52c8d4d612a837c7f37", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679046624, "uuid": "614b662f-d271-40d4-b277-150c2986b642", "comment": "Malware payload (Mirai)", "value": "78cb3a8e6d5537f7401737addb428aa853558ae9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679046624, "uuid": "2124a3f5-d78c-49b7-9fd8-432bf7b060d0", "comment": "Malware payload (Mirai)", "value": "9f0e52ff8454ad8a9589917b1f197bf3e44fe9f6ac239520bdec7a7f61909b23f2c576b8365131db81dcd11975ba3744", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679046624, "uuid": "3543e4fc-0765-4356-ad40-8a6ac5cf625f", "value": "T1DED3F841BC82AA2AC6D123BAF9BF518E335177E9D2CAB257CC200B557BC551F0C63B45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679046624, "uuid": "088fe630-15f8-4a9b-bee9-62c545bef6a8", "value": "3072:cnHmgy5+pEkrhIbofpxK50x3fMwOf7NU:cnHmgy5+pGipY50xPMDTNU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679046624, "uuid": "f115536d-b82d-4cc8-be76-caf775501a58", "value": 137808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679046624, "uuid": "842a5f5b-64f8-4b02-a5e3-3f801649acab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679046624, "uuid": "f14e233a-aced-4144-9850-88f2304794d7", "value": "296eb91f3a8b509a8c8ea587ca7e3627", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da484be4-c4c2-11ed-88f6-42010a9c006e", "comment": "Malware payload (PureCrypter)", "timestamp": 1679057668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679057668, "uuid": "53d2a5c5-91e7-4c6b-8f63-43743bc677a1", "comment": "Malware payload (PureCrypter)", "value": "4fc2df99dcdbf2886d139b0f4dfad85c", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679057668, "uuid": "30dfdd60-f755-44b1-90fe-84d26865822f", "comment": "Malware payload (PureCrypter)", "value": "c7cbb1b4915f9cbce71dbe9df6027e73166fef1fce95976685640845e5f79685", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679057668, "uuid": "5a4caeda-1111-4f59-8fcc-696db8a3ff3a", "comment": "Malware payload (PureCrypter)", "value": "5c02c737e12540a6b5c56615b9b972ee171d2aa1", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679057668, "uuid": "c2ba6d94-5947-4a47-a31f-81dd50967f02", "comment": "Malware payload (PureCrypter)", "value": "48762fed193b47448a68a64c264a57b8fe809449b23a81a09331a721c66d19a0de57ec94ba61cc1ec841ac55fe802f29", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679057668, "uuid": "1937f80b-17b1-4733-ab6c-c72903230233", "value": "T154D1F704E3DC8376DE678B75BC7393810379E7515C1BAFAE69C4916B9C033884A62AB0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679057668, "uuid": "a8f876b2-c5e3-4c2e-b6a5-94416c78bcee", "value": "96:DgdesBVLuiDTgIlNtuL/A3/I63yPRZjXMRWV6xjtLEk9sl8jzNt:EYsd/jtuLIg6YT4Rd5t9y8l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679057668, "uuid": "d37218b8-1a29-47e0-89d3-2b05481ae0ab", "value": 6656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679057668, "uuid": "da6af36e-9e6c-4fe1-984d-42e3ea1f150f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679057668, "uuid": "1e5190f8-b51a-4106-a951-a27690e67b3b", "value": "Qhxujqkxtf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23bf0121-c4c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679056932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679056932, "uuid": "bdf91430-e4c6-4aa1-99a7-d7563ccfce42", "comment": "Malware payload (RedLineStealer)", "value": "4eb04fb4bd9222cf5d8bf2f20f86f76d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679056932, "uuid": "6d3dc671-a529-46b2-9c65-970e65749e12", "comment": "Malware payload (RedLineStealer)", "value": "c7f0fa38597897f4189ada17388885d6647ea70e2dfc7a1640f12ffcbde4296c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679056932, "uuid": "e55be222-4027-4a6c-97c8-c6686012200c", "comment": "Malware payload (RedLineStealer)", "value": "83ebf58695828ecb7383328ad0011c630e974705", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679056932, "uuid": "239cbeaa-4232-4d19-922a-07ddbd09d494", "comment": "Malware payload (RedLineStealer)", "value": "c6bb4923f7fdc666bb94faeceabf14157a012f8182eb1c5a14f63b26840144df495ead629aebbe92d485f0ab663e851c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679056932, "uuid": "b1f98ca8-167b-48bc-8239-2a0d7ca2656d", "value": "T16845F1539AA17C50EA168B33EE1FD2E8761EF561CF4A7BA53218DE1F05B01B2D163702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679056932, "uuid": "f1b94982-d1df-43f1-ab6b-da3c3a023892", "value": "800c211657980cdb5c72386d0a0450fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679056932, "uuid": "17980664-673f-435c-b041-eef5ee88be22", "value": "24576:eBAQnUjC25pKw8ZWQl9D3c6jenpDQz3EmFXTi5+YzYcY:er8pKw8ZnTRaWzQzN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679056932, "uuid": "30473f9a-2fb1-4656-add1-b82dd20efa71", "value": 1238528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679056932, "uuid": "92b1de95-2105-4675-b98e-2510ecdd3127", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679056932, "uuid": "bc9adde6-d894-473b-876b-f424119e6902", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af99867d-c4c6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679059314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679059314, "uuid": "1d52c77f-9278-48f2-939e-9b565b1083e5", "comment": "Malware payload (Mirai)", "value": "6a8557599a13b54e2d935b537eeee079", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679059314, "uuid": "2388b99d-6fd8-452f-be8f-1b1bc4a63d69", "comment": "Malware payload (Mirai)", "value": "c8650407f54f0719d70374aa2774331379f4dad9abded332c7906cdc5435a2b6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679059314, "uuid": "e06afec0-e725-4f35-922a-b0cb2bb7fb2a", "comment": "Malware payload (Mirai)", "value": "3aea423203258cff42ce13370d777cb94b0d5c19", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679059314, "uuid": "7def0733-3861-4ced-b1cd-b6ee8d044965", "comment": "Malware payload (Mirai)", "value": "0b2577d5933e68f0118d22fc12f96aff8efedf4560d98f039c0c5c0604d2f893468832d72bfa69d4a99357e634cef4b9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679059314, "uuid": "c5ebd482-4153-470f-b1ba-1082e4bca01d", "value": "T117F33905E6408B57C1E2277AE6CF824D33338B94A3DB33159938ABF43FC27995E26915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679059314, "uuid": "a29ef026-1ce0-45d1-8e88-b0a59d39cd0f", "value": "3072:A1g2SIDdVTj6Q4VK5iaAE/xgBnyLRM/9iRmFwfBxKQodn:Wg2FDdVTOQ4s5iaX6BnydM/9ymFwfBxE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679059314, "uuid": "f3eeeb25-6b59-4e26-937c-5c1f1cab97c1", "value": 159877, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679059314, "uuid": "cccd006e-55b4-4f66-8d89-5e3ea8f4216d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679059314, "uuid": "0daa3af7-30c5-438d-8133-5c8110933fe3", "value": "6a8557599a13b54e2d935b537eeee079", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9999fc9-c4aa-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679047412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679047412, "uuid": "5237c469-a56c-43ce-a9b4-dda6803755b2", "comment": "Malware payload (Mirai)", "value": "00088f908946d161a5634431ae5ed550", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679047412, "uuid": "cf736f50-674b-4df8-805c-9f444c06ea94", "comment": "Malware payload (Mirai)", "value": "c9056b786efb3104dd2a59e6f9448b248bff45408a3fc53f49fc51c4a8f710be", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679047412, "uuid": "780f0ccb-e012-417e-bbae-ecf48bca5e52", "comment": "Malware payload (Mirai)", "value": "5afae0a8c380c2e6388d22522c6475e8297018d6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679047412, "uuid": "043378e9-915f-4ffc-9bab-e1a87a50ea7f", "comment": "Malware payload (Mirai)", "value": "f9649b32877530e070bc0becf69658c4525c0cdbd168bb4b5aec2bc83f8eeb75c33cff7d2218502dc30b1a85f15190ec", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679047412, "uuid": "69f8aa24-a5c1-4cde-be59-0fa571490fa7", "value": "T1302301B64202A1718B60603EE5644B5EA94B37EBC9F635235DB5AFFC18DBD40C1C96C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679047412, "uuid": "88e96aa9-8316-4e6e-8919-4864d6832a08", "value": "768:uf+Mc+xJFWXxWZJY47t5TZY3lI6oTo+N1a5ShXF9q3UELPcLJUYErThuMr9:ufW+BwWLV7tLY3co+na5gXYL0VfEr1uq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679047412, "uuid": "3a2d5086-5d86-4ed9-8424-87a58320b214", "value": 46648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679047412, "uuid": "e7c582b5-7c5c-4a84-bb96-1eec4c6c8ee0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679047412, "uuid": "bedf49cb-82d7-4d99-8534-92148982444d", "value": "00088f908946d161a5634431ae5ed550", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6967dfd-c4df-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1679070171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679070171, "uuid": "8ae44408-b3af-42f0-99ad-fb15a8acf90f", "comment": "Malware payload (Quakbot)", "value": "8cbfc63ffc12cb37ebd6b3404868bb6e", "object_relation": "md5", "Tag": [ { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679070171, "uuid": "5453fa09-24d4-431b-845c-d47d7a092c82", "comment": "Malware payload (Quakbot)", "value": "c9060663b2c4577bcdc00eac057148f9ff087c8732a9b479a44a74062ae6dcf7", "object_relation": "sha256", "Tag": [ { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679070171, "uuid": "5472eeb6-1683-4dba-ae19-63cee8f94cb5", "comment": "Malware payload (Quakbot)", "value": "bba42352061c9483c3bdeb05f3a735b1f2d79f32", "object_relation": "sha1", "Tag": [ { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679070171, "uuid": "b01c3077-9b0b-400f-9467-eb9a73abddcf", "comment": "Malware payload (Quakbot)", "value": "8d5bae1d88f4e54ad603c82efab32500244686f3eedfc84dd663a7daf52b70e77f19ebe66f22ffab6c6bd469c61dfc42", "object_relation": "sha3-384", "Tag": [ { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679070171, "uuid": "7411cfb9-d80a-410c-9a6d-cfcc53f302bb", "value": "T186B2E169F244B210CC8E097E4B801527EF62774F479CCF2A3A93A77E415964BB2032ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679070171, "uuid": "f8711aaf-18cb-4f40-ab0f-f3731d9a9e9a", "value": "384:gZh+f2oKFxozEK8422RaWUgDnkRP5RYSwq5Z1RSpkVU1C+EC0gSMaW6GpIlv8ts8:IQ2TFxYEx2LDkRF1/1RSpkq5EC0gTL6G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679070171, "uuid": "15e142c3-ed58-42a3-a0bb-bfaaaf6c5714", "value": 24329, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679070171, "uuid": "b9c8ccbc-6578-4d65-9f66-45e1915f9913", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679070171, "uuid": "2980a236-b313-45fa-9f15-78ec92b65e69", "value": "wmBo.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "643584d0-c4f6-11ed-88f6-42010a9c006e", "comment": "Malware payload (PureCrypter)", "timestamp": 1679079804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079804, "uuid": "f883dc06-7307-413b-91cd-6bf552af1baf", "comment": "Malware payload (PureCrypter)", "value": "cca80c674d37f3bc72e75bbfd5c70287", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079804, "uuid": "2e9602f2-bdfe-4258-ab69-ab89e40b7dfd", "comment": "Malware payload (PureCrypter)", "value": "c9899e4bf65075068ade39d27aad905033d4ab6208b990b9960cc0fe8cad2488", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079804, "uuid": "6f2000c3-44eb-4c92-9a32-7f951e37b773", "comment": "Malware payload (PureCrypter)", "value": "6948730b7f28baec1212b0ba398bd9845a0a1a20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079804, "uuid": "0f0c3817-0f48-4b78-93ca-90862e0eaeea", "comment": "Malware payload (PureCrypter)", "value": "11bfa582f74e3a39180d7bdfb616cff99f9bc5037081712882c59601e7714b0cf0f577505c8d3e38a532717654cad191", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079804, "uuid": "ffe66b97-f4c8-45b9-b459-3a856d31fdfe", "value": "T117761225239C91C9D17A9039CA864AABE7B57C429374C7CB05A0BDA93F336F55E3E310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079804, "uuid": "df1b62d4-a297-4fd6-b619-617c185f4923", "value": "73f4f6b0816ebeb37e57311ea1622caa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079804, "uuid": "12220a2f-b9eb-4c3a-980e-519d78ec5e91", "value": "98304:teO4I/xy3Ks6JD+oule6tLnMK/ZUGrMXDzG5c0HXN3SKhbC:tV44xgrwo5tLMKRUGrMTC5H3SK5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679079804, "uuid": "eaca40c3-4cd6-44ea-a970-51aaed34baee", "value": 7241194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679079804, "uuid": "cf997aef-7acb-40d5-91b0-a5d400dcf3a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079804, "uuid": "c99f57e4-4280-4a04-8960-ba702fed28c7", "value": "cca80c674d37f3bc72e75bbfd5c70287.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab9ba4dc-c4c6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1679059308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679059308, "uuid": "d16660d4-3fd9-4430-8a20-696276e997fe", "comment": "Malware payload (Gafgyt)", "value": "bdea5aa10961109e68eea84628f30595", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679059308, "uuid": "ad9b84f8-f623-4bfd-a5fc-bb579c4cca7e", "comment": "Malware payload (Gafgyt)", "value": "c98c1e12c49b4dba22366efecb82d507b0498f173365435e9f48f1a8f0bd4e65", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679059308, "uuid": "d66df320-64e5-4059-bfed-d31073a333d0", "comment": "Malware payload (Gafgyt)", "value": "8e9cd2899ba69c6487a988689cc86e1b18f02d19", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679059308, "uuid": "947dcf02-3699-4c07-b9e8-53fd4afaa3bd", "comment": "Malware payload (Gafgyt)", "value": "0356942b301a94a2c99c5c11ea22171205f34110890f6b7432e7bcd6559c3e304a451b9054d422f5058aab67525946c7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679059308, "uuid": "931c113d-710b-4c5a-93cc-db3272da84d1", "value": "T1E683A23737670EA3C0C6587101EB2331A7ADDE8538BA4BD7A9817DA83F35E4434592DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679059308, "uuid": "4de14156-1b7c-4b64-a20f-2385d58802fc", "value": "768:XJRWChCyOCzRaOnwmLT4Jxc8DblAY+lwSwsViK2q0tSO+NkzjVWtH4clBsOOFKYu:Zt7jqHBCpNqMtY2sO+6MitYU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679059308, "uuid": "f04dbc41-de62-4e5e-839b-142eb598c41a", "value": 86211, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679059308, "uuid": "6293605e-b0b1-4571-beb2-ea645cfa64df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679059308, "uuid": "f0b8cf73-cbe7-40f7-a0de-dfc8ab2089e7", "value": "bdea5aa10961109e68eea84628f30595", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ec8e147-c4a5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679045059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045059, "uuid": "f9ab50b8-9394-486e-ad85-ac606eb1070d", "comment": "Malware payload", "value": "e84392c10a530715729670e145ff5eb8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045059, "uuid": "f07d99ea-653b-41d8-8d3c-3a9dbbb86c97", "comment": "Malware payload", "value": "c9ef077593915fae66c52522af28d1df84d089be55896989947a38711ecef299", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045059, "uuid": "c5e5fa10-293a-4760-bb3d-b38255bad46a", "comment": "Malware payload", "value": "dcabcd6afef49d7c8ee9682b8479181aad8f8d78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045059, "uuid": "514bb835-d5cc-4e72-8572-96ca2e241c83", "comment": "Malware payload", "value": "e27c9a850b24e190c9530e05c60b8d9479dbbd69436ef82954794cb0d8be7c4db813fde6ef459f1117f71b69764972a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045059, "uuid": "2ee08d87-7bfb-4394-9047-51509f4da131", "value": "T1C45623B266B5055AE0D0DC398527BEF531F9030B9B46BC78A9DE2DC634231E4AB13D93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045059, "uuid": "a0482267-37a5-44ce-965a-80f9f487a712", "value": "895e5e6e037e9108574fb94ed614d804", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045059, "uuid": "9c3a0664-200a-4c17-b37e-54f3ed3bc082", "value": "196608:fZQZByzglN0aJW+z1A1NfDqKJxT2Cyh2Z:NzW0aMcSfDddym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679045059, "uuid": "17eadb95-3e19-43bf-b467-1335e6e7affd", "value": 6345216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679045059, "uuid": "db15834b-3d5c-46a2-a993-ad947dd24d44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045059, "uuid": "c7a2ab28-3f35-49ef-83eb-da535f535ca8", "value": "e84392c10a530715729670e145ff5eb8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c8a846d-c4a5-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1679045082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045082, "uuid": "14141f74-6dd2-40dc-918b-da1e80b1d8a8", "comment": "Malware payload (AsyncRAT)", "value": "d953ad5e538ade271c362c18b153a210", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045082, "uuid": "58d5686b-5bb8-42c2-96df-ca905b13b94f", "comment": "Malware payload (AsyncRAT)", "value": "c9f66b18443cd4fd5343d53905a7b96506e19543fc0521727e58d80c604baee2", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045082, "uuid": "cb1b6a9f-7b2c-4962-ac0d-b2f6f4b3ba10", "comment": "Malware payload (AsyncRAT)", "value": "d2c44253bd9ee29a4368ee594eb17a66e3777fef", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045082, "uuid": "9ebf7b3a-4ebc-491e-80f9-2c7a7673fa3b", "comment": "Malware payload (AsyncRAT)", "value": "764735565bca477365c76fa934df0aa85626247f18755ebd7c126b9c877aac51d95e178838489238e0ea3ccd714df9cd", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045082, "uuid": "a79bda0e-6ec2-488b-99e1-f9ba13103e50", "value": "T13B83F60B96D87CEEE02B5B731D5B9F4DE668B953780ACB492220474F54660CEF207DA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045082, "uuid": "1f29013f-8acf-4f9c-90fb-0c98ec296714", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045082, "uuid": "20c19184-a09e-4653-8ec0-f585766001bf", "value": "1536:Lv7gYULiNbHXIeLLfGvXQVW6calXzvAkSZf0bgcz2W2n:LDgWMeLLfGQc61lskcMbgcza", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679045082, "uuid": "163b6453-8e17-4dbf-98ef-4124e88efab4", "value": 88576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679045082, "uuid": "505d6b64-45f7-473c-b310-23e17b5ff666", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045082, "uuid": "533bc36e-e9df-44f0-b5d3-abd9dbcd8f0b", "value": "d953ad5e538ade271c362c18b153a210.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cab2142f-c4aa-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679047334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679047334, "uuid": "c15a42d6-62dd-47f9-b1cf-47fc8e6cec05", "comment": "Malware payload (Mirai)", "value": "e7f3395984c1cdabafe0121f7f110a82", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679047334, "uuid": "406bf1e3-48be-4e3e-8146-cd8467475655", "comment": "Malware payload (Mirai)", "value": "ca45fc640f326bd9b5c2ea73848e7d1265ac9e5b72a6e02f6ce80a0396935125", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679047334, "uuid": "776153d3-5f5b-4b25-ae6e-5e2dbc32f122", "comment": "Malware payload (Mirai)", "value": "3f91ffe01e4dc1fdf5021c2a2c9002f97000c8be", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679047334, "uuid": "675132b6-aacc-45bf-9f9e-9182adceccf0", "comment": "Malware payload (Mirai)", "value": "28cee74a73e30aaa7324389ab300c9a6d02a3357cd7ad098ff27edba7605518554e9e3124ed00907fd829bf765445fd2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679047334, "uuid": "1c254caa-8306-4de7-8ede-228a4b2f4ba9", "value": "T1B363E646BD828E16C4D512BAF92E018E331317B8E2DFB2239D146F2077CB92F0E67556", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679047334, "uuid": "81a1b039-8d83-4fa8-9bcd-42839498feae", "value": "1536:TZn3xRZOk3U1V6V8glRZ4WBP/0GX+VQnPPI0iVITdGsGC:VZ9BqGGIdGsG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679047334, "uuid": "9b045a32-762e-453d-b02a-8317ba4df467", "value": 70788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679047334, "uuid": "45f6ade6-72e6-4af2-9239-bcbbdea1c995", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679047334, "uuid": "684f05e8-034f-4558-b259-8252ea1a31a3", "value": "e7f3395984c1cdabafe0121f7f110a82", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73cdc99b-c4a5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1679045040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045040, "uuid": "17281f40-a442-4ee8-a2d8-abc78d557069", "comment": "Malware payload (Rhadamanthys)", "value": "e57410c8c7e7cc4b6b0b0b375fa8229d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045040, "uuid": "37c4c32b-a271-4e26-a8a4-a64a764f4d72", "comment": "Malware payload (Rhadamanthys)", "value": "cafa6b585d76865275220c7d8da33338beccd6902be50fa3ffbbc24ddda9a130", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045040, "uuid": "48d4a19e-6086-4ed4-8c9b-8df768b6b6f1", "comment": "Malware payload (Rhadamanthys)", "value": "a99136dbde5830b339b5eb44882554ec28c5cc3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045040, "uuid": "999099cd-f634-4f4f-871e-8dcb09065543", "comment": "Malware payload (Rhadamanthys)", "value": "8e966059179ee14dfa5220f7e00e5ba7e2ba92bb5b159b10d54792a02752923b4f6e59d553340d4c2232df8420ab1d5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045040, "uuid": "623b0d89-6c0b-4511-8ed5-2dd93bb30315", "value": "T1E734CF0393A4BC54F5264B325E2FC1F8771EB852CE78AF6B23586A6F08711A2C16F751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045040, "uuid": "1561fb60-c4af-45df-949d-af2edfc347dc", "value": "3391dcebdf72207e22a1ac369ab55c39", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045040, "uuid": "03f317de-d646-42aa-a1f7-a5d759b20549", "value": "6144:7rbz+svgvwvRIEN0dOGuy2yarvd0Yow2hhMhFJ:7rbasuwvRIENsHxn810pw2U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679045040, "uuid": "b37f5c7a-3604-46a3-ac34-e10de10975a0", "value": 251904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679045040, "uuid": "2f770aca-89ac-4ab4-a188-3ee6f9024620", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045040, "uuid": "b6ede038-53d0-4bc2-a48e-1521eff67c14", "value": "e57410c8c7e7cc4b6b0b0b375fa8229d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83a1e0fd-c49e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1679042061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679042061, "uuid": "749f165d-21b8-446e-929a-f9377ca2ea74", "comment": "Malware payload (Gafgyt)", "value": "40d5f4909107a81c868357e8d952935a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679042061, "uuid": "c6300f2e-c5bc-4c42-9ce2-14c80cd7b951", "comment": "Malware payload (Gafgyt)", "value": "cbc1dbe6395a8a57c995aef6f7222c96f7602cb33ca40b8546bafdf9ed09cb01", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679042061, "uuid": "0a9094b3-8c7b-4cf0-92f3-e62bf3e5f59c", "comment": "Malware payload (Gafgyt)", "value": "bce1a66d93f7c58d7b0d929ac4255cd3c0db75cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679042061, "uuid": "ce897e47-1b1e-49b1-80f3-f2d66a3807b6", "comment": "Malware payload (Gafgyt)", "value": "8af83d38548826bf2a4fe4d89ccf094979d5888f79946e2ef8821aaae86421751da4a7409b18d322ef44f57d415e37aa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679042061, "uuid": "d7f86387-bab6-464e-b332-be7d5e81ec01", "value": "T157934A17B653C6BAC0874BF41BDB9A314923B8BD0B227206B3D4BCE67F165A61D19F40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679042061, "uuid": "81aa561f-eae1-4830-b055-32dd651df1fa", "value": "1536:p7rHXokXsWFVSzkfLEkZAT5ipG5v3LphauH/VPNlDDUg6I9um2Xj5YZb0e:pcCPOkfQfNipGdLphaE/XVog99um2XFY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679042061, "uuid": "1ce78dd4-67c8-44b5-85bd-18614d6c67c9", "value": 94012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679042061, "uuid": "a28a4706-a45f-47f5-8bdf-963b1d4fc1ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679042061, "uuid": "0c44775a-16a6-4d24-8be2-b0fc69bfefcd", "value": "x-8.6-.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51ca81ab-c4d4-11ed-88f6-42010a9c006e", "comment": "Malware payload (LaplasClipper)", "timestamp": 1679065170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679065170, "uuid": "bd7a1906-91d5-4718-a38d-475eb638c326", "comment": "Malware payload (LaplasClipper)", "value": "a13a518eeb299eb35ef4dab64ca36dfc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679065170, "uuid": "f3f3c0e6-80f0-4b41-b886-a44552bcca77", "comment": "Malware payload (LaplasClipper)", "value": "cbd52e865efdcce13184bb8594a5016cc973b2f30e880fc620c60dc0b5986e1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679065170, "uuid": "ae6e8edd-2a6e-4ff8-9028-516d4caf24e6", "comment": "Malware payload (LaplasClipper)", "value": "f70ed33a0ae431538d248186c102588d0a655544", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679065170, "uuid": "5bc10ca8-bd4a-46ab-a2a1-4e8427417909", "comment": "Malware payload (LaplasClipper)", "value": "3f8adb40407318a5e45734ba2513d6af571093ede9ed7f2927c6bceb513c60ad54529524c5b31746151fe7303baa8f49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679065170, "uuid": "987a2bfa-a77b-42af-86f7-17f7ed3a5ff3", "value": "T1C495125397A17E20EA168F73AE1EC2EC660EB561CF5D7BB52219DE2F04B0172C163712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679065170, "uuid": "166f3fda-57e9-449e-bfde-575c6bee864a", "value": "800c211657980cdb5c72386d0a0450fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679065170, "uuid": "1ca0d634-6ee7-437b-b542-c7618ef6dbb5", "value": "49152:+1iXbsGhvUq/AaqDQfM5jx9H2VatXYUq:+AXbfABsU5lrXYU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679065170, "uuid": "502c5916-16bf-4393-acc9-a53b9e764a48", "value": 1959936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679065170, "uuid": "cb9086f4-bc4a-45f9-838d-e2070e3cde49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679065170, "uuid": "b96f249e-5ba7-4ceb-908c-764659bff0a6", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d8d0ed8-c4be-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1679055767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679055767, "uuid": "f443c02e-5efa-46a6-bacc-83f26edbef22", "comment": "Malware payload (Gafgyt)", "value": "af3593473fa063696fbafda826f231a1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679055767, "uuid": "4467a412-8c36-4083-aa0e-acacc03cd679", "comment": "Malware payload (Gafgyt)", "value": "cc23e64e1f25a1abe6bb8a74b3ee8f24935d112570d174691d9d9c6de0885b43", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679055767, "uuid": "81cfd547-b5fd-41b2-939b-009cf6340155", "comment": "Malware payload (Gafgyt)", "value": "6f3264a11e2095471425d6e636d39f24d5217b9d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679055767, "uuid": "52765b13-11ef-485b-aeac-148ea10bd8ef", "comment": "Malware payload (Gafgyt)", "value": "54f23fbb9df6a17faa4da4da8e942339a8003a698d751f2d121c827375a59c3999e98f0865d038cdd62fcb9b36dfa949", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679055767, "uuid": "951f4581-959b-4fea-abd6-df3b34971629", "value": "T181B33B4795A89EB3C086BEB525EB59300722ED120F2F1A9621387BF4437F5CD741EBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679055767, "uuid": "c5a73282-47dd-4334-9734-40806b32ed4f", "value": "1536:Aq/W65rWXAiP5dfK4EBbkb25lyDQnAjCgB5+TjgkHmmycgYVLu1IPYC:R/vp+9C4xb2Mjr0j/HmDcgYVy1IPYC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679055767, "uuid": "b1bb65c5-dee8-4a83-bb63-0239032180f4", "value": 108486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679055767, "uuid": "b8eadd8e-29b9-4a3e-bbcd-26b7421f1cd0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679055767, "uuid": "3a42e496-4ce3-4e43-bb67-f58034a4bf6c", "value": "af3593473fa063696fbafda826f231a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5472f994-c4a6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1679045417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045417, "uuid": "2d78814c-dd4c-4ba6-a94a-6966cec1d552", "comment": "Malware payload (Gafgyt)", "value": "beb2ce4b20dfcf7d291a83488e6a2a5d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045417, "uuid": "fb81b5ea-e157-4ef3-a383-ce28e64dd1f0", "comment": "Malware payload (Gafgyt)", "value": "cc37c32ebf2a7d7361d3f61e6d29ba4fc0464dd846da056c8ea31d0a7039aeac", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045417, "uuid": "7b68733b-c862-45a7-a006-137b50ea6759", "comment": "Malware payload (Gafgyt)", "value": "69a4d50efa368905240da2c043669aaa326fde9c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045417, "uuid": "5e25425d-5ae7-45c6-8665-fe70a21832b5", "comment": "Malware payload (Gafgyt)", "value": "9db92205f172a664d23329bdd1e6e21c5dee448ccaecfc7017bd6d7ed51b699a35d5d7e6aafdd2bb16d13333fe593e0d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045417, "uuid": "1d287366-f9c1-46bf-a549-4998944da29e", "value": "T114D31905F460875BC2D217BAB68A425D37231F7893CB33256A34BEB42FE1B981E79531", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045417, "uuid": "1be26d6d-d4a0-4470-b336-c6fff5d90907", "value": "3072:Sdf+fvEqa9FazYA7IboRh0e391CErktmCQA9FX9aH:ifWEqa9FaNh0e3DrktmCQA9Z9aH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679045417, "uuid": "a5f9efbb-b481-4681-803a-915e4e592ff0", "value": 139585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679045417, "uuid": "14af760f-41cd-4ede-86e5-07205a951fca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045417, "uuid": "4dd1d517-7cc9-4285-a5cd-4cb5c56b7659", "value": "beb2ce4b20dfcf7d291a83488e6a2a5d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d5cf776-c4ea-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stealc)", "timestamp": 1679074638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679074638, "uuid": "4f229f28-f69e-41bf-9f14-8fe80a0a0c72", "comment": "Malware payload (Stealc)", "value": "8ee319a68644628af5df86add9dc87cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679074638, "uuid": "ff3d877f-be67-4476-94ae-c31913b42d46", "comment": "Malware payload (Stealc)", "value": "ccd1cde08e07f3be31008ea2b7ace4190317f179c3a75e0b9e88670aa70626cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679074638, "uuid": "d41ed224-ae36-4176-95f5-6eb4783c2ffb", "comment": "Malware payload (Stealc)", "value": "e04fd5d186041e8423c0407ca3d2b844f2123c32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679074638, "uuid": "29a22c3b-94f3-47b3-9bfe-0a8df95d85e2", "comment": "Malware payload (Stealc)", "value": "2b8abb279c032946fd51ec19e5683d7e5d962ce9da3188f1212fe1bf6cb8c404966d1ba46cb67f26022e1234ee9403f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679074638, "uuid": "deff7e0e-24b7-435d-96ce-c9350578d4b4", "value": "T13354184392B17D48E93A8B729E1EC6E8771DF6518E89B7763218DA1F04F2172C163F90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679074638, "uuid": "66fff425-ed46-4ac7-abd5-43837171e8fc", "value": "6e76b494f1a9946f83b6b72033f310be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679074638, "uuid": "58afd0fc-309d-4fe1-9fb5-25220a81d01a", "value": "3072:Z0kKKgML7DG7uJAj7VDpo18Ur4+f6trQ2KmknjpBv8sVHI4yjitchauM:imgML7C7uJo7/+f6G2K7jpBv8Gupcu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679074638, "uuid": "6c247282-bb07-496d-87ca-f423438b4010", "value": 303616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679074638, "uuid": "910d2d53-d312-47ee-9bb5-f7c39e3bcbca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679074638, "uuid": "8f233878-4ad6-4b6f-81c1-2629cfb8e45a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "541c32cc-c4a5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679044987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044987, "uuid": "d1318435-9723-4c40-8f1f-b0e12969fbf8", "comment": "Malware payload (Smoke Loader)", "value": "90bb9361d179d99c57620e4c9b43c68a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044987, "uuid": "1be9127c-0a70-4272-8807-82dcbd29a975", "comment": "Malware payload (Smoke Loader)", "value": "cd3e1831de588644e2706fa76f1b8bdd13e575cd648b6db24ddc4c9016ab978b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044987, "uuid": "7f5025d7-b384-40de-baa3-833684af5c49", "comment": "Malware payload (Smoke Loader)", "value": "c6cefe5f43a66008d8add311f68a9b35b90d436d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044987, "uuid": "f7ed5bc1-2e54-462c-9bbe-db5422a30e73", "comment": "Malware payload (Smoke Loader)", "value": "cf9baf0e03c24664c4aba35065173a7d70689ed4ded18e38cf5b3d906ca7ccc67c93ccf77ee96018e11e921d3a907233", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044987, "uuid": "260a1f96-18ed-459b-b779-e570cd9289c5", "value": "T11D048D0393F5BC64F5164B719E2EC6F47A5EF4138E69AF6B22185E2F08702B2C56E311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044987, "uuid": "a401a888-84c4-483c-8e3e-646a2a82a539", "value": "4b2faf5e2157c756cf2fd31d6cfd3d44", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044987, "uuid": "d66ab108-ce1b-49d8-be77-33f8e27c251a", "value": "3072:gXkXJHykwmY6FRW77HrL5qYuiJaSe0QyICfOtuvm/hVgdJB:rXJSQc7LL5qYuiJEZCfq/hwJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679044987, "uuid": "316bbfba-bc53-48eb-a0ae-7f3c93fe93f6", "value": 177664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679044987, "uuid": "f28df6f7-6015-485d-b413-caacd1e9d90d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044987, "uuid": "19329d7c-3982-4a9c-9c5a-f9dc5b8a9e46", "value": "90bb9361d179d99c57620e4c9b43c68a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56cbb22f-c498-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679039408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679039408, "uuid": "12984c97-3f3f-4464-b816-1b745717ce39", "comment": "Malware payload (Mirai)", "value": "ba42d346c38a5c2298d450fd62af692d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679039408, "uuid": "2d649ae3-219b-413a-b166-17fc5ba30220", "comment": "Malware payload (Mirai)", "value": "cd47c9db5e3ec59221361ca7459bb12a5a84014c1f8aa2e2bdad07ccb37a4e29", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679039408, "uuid": "143059be-9200-452a-88b1-d9f0587c0ead", "comment": "Malware payload (Mirai)", "value": "d1bbaa4e0a794244b3e4f9e83a44e6ee20bcb3c2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679039408, "uuid": "97e98386-be64-4b58-ae4b-0cded8bda08f", "comment": "Malware payload (Mirai)", "value": "f20462adca17fb50229c8117cbe0ab909303de7282dc3b3b016292fe54499e107ef90e7fe1d2bc28865d8576fa6908d2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679039408, "uuid": "b629a26f-f120-4dd9-818b-b3477674476e", "value": "T159532891F8819613C6D2127AFA6E02CD3B2613E8E2DF72179D225F2037C686B0D77E55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679039408, "uuid": "bc3fcb15-1854-4cd4-8616-1c19bfe115dd", "value": "1536:vYToeNtVVO8Vt8Ni0V9u3zb1lepGvMvD5s:vYTc0Q9u3zbjWXD5s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679039408, "uuid": "269dcc21-b12b-4566-bcea-a8d45719d99f", "value": 62780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679039408, "uuid": "932d8398-eec4-4b85-846c-a8b9a6b57ab7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679039408, "uuid": "e87496d9-1dad-4acd-b2c0-265467a15a01", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72c4670b-c4e2-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1679071238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679071238, "uuid": "2b648052-1e11-4bd8-96ea-80787ea79142", "comment": "Malware payload (RemcosRAT)", "value": "95dc52aaa3d6a2564e72b9d9409f1687", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679071238, "uuid": "9caf629e-ef88-4190-a110-62e862bb6ade", "comment": "Malware payload (RemcosRAT)", "value": "cddd0500054387a85a03f00fa5accf21b55261fa98bc828c02ec3e7c7bd96d74", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679071238, "uuid": "32fc0011-1210-434d-b97b-bbe878b3ec11", "comment": "Malware payload (RemcosRAT)", "value": "0ee12ae044c49f8831998bc913447f8684bbb0b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679071238, "uuid": "a9a453c4-fb27-4fb5-a152-5920cc64cf5a", "comment": "Malware payload (RemcosRAT)", "value": "c4dbbae54e8ecc0837a10dfe54a765d5ac383b43049c8b3937ee572a7efe78c12e09ee0dcfaf64c8d971387729439ff7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679071238, "uuid": "00c5b07c-cd5b-4400-80be-a683d38b040f", "value": "T1833517015FE98A17E9FD5BBAB8264BDC96F6E04ADD53EB0B400528D80D997CC1D823D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679071238, "uuid": "50fb62af-d1b5-43eb-82f0-8ce45e6f9702", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679071238, "uuid": "8ee09eec-3524-4123-98d5-716ca8e89c97", "value": "24576:qOVyxxSn0cxlwkQYuRkswDZD2SAR0ivqlCnHTYRepB1Osv4:qg94YuRkswDZD2SAR0ivqlCn3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679071238, "uuid": "4bd43d3c-576b-45e2-86c2-f4dc9153d2cf", "value": 1133568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679071238, "uuid": "a33f92a8-20f2-48cd-8a37-0c15272bf390", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679071238, "uuid": "6a958d99-05c0-4a01-aaea-12e9d0e850c9", "value": "transfer kan\u0131t\u0131.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ed2b889-c46e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679021410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679021410, "uuid": "b2d5ac60-0c97-462e-8e96-9cd065596bb7", "comment": "Malware payload (Mirai)", "value": "35464051303118e914751181e4f398cc", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679021410, "uuid": "b9ffc775-b81e-4db1-b877-52b8a6ea1a5c", "comment": "Malware payload (Mirai)", "value": "cdf1c2610bde8ae870bc083d06fb00ba1c3441c075fc6c26e9cc9f93c9a3703f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679021410, "uuid": "6535b4e0-12da-4c31-9d4f-531394c6464f", "comment": "Malware payload (Mirai)", "value": "dbb1b86d1cd8f6df7fe7b31fd62596f798c6f108", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679021410, "uuid": "88897757-1de5-4d08-a602-d9d881840b18", "comment": "Malware payload (Mirai)", "value": "6e2675a2d0729f14813aab8999bd23df8a329a84bbb238af891cdbc58919630b0d112e156768ca48796bb3b6447d5725", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679021410, "uuid": "db54fadb-8233-4446-80b4-e956230ff8b5", "value": "T1FD3339C9FA53DCF5DC570170207AEF369E32F1E51218D653DB759A32AC52A01EA06A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679021410, "uuid": "96010b86-62d7-4f0d-970e-af54ab36be24", "value": "1536:v/+4zLw36I+rSHPfxUGaddox1WxcKnLpYHhrIx:v/+4zLw3mmvfxU3OrOTLCH2x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679021410, "uuid": "30c75e21-87f9-45dd-9168-49b0506892c9", "value": 51504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679021410, "uuid": "107fe5e9-26ff-41df-b333-7a928476d007", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679021410, "uuid": "b0e75cab-4598-4cac-8895-4fd281879c98", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b997b025-c49a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679040433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679040433, "uuid": "571135de-8b76-4404-b20a-04515b0d1c35", "comment": "Malware payload", "value": "fd4b00c77e04be20d2cf2ade0921797f", "object_relation": "md5", "Tag": [ { "name": "daa", "colour": "#0ED13E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679040433, "uuid": "856f5394-78a7-4f9b-bd6f-0337691b3976", "comment": "Malware payload", "value": "ce549b23664282970b694193eef335fba1d71a64d06b81a1f3a3efe5cdafb9a3", "object_relation": "sha256", "Tag": [ { "name": "daa", "colour": "#0ED13E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679040433, "uuid": "8b527bb7-50d6-46a8-b9ac-97144e424429", "comment": "Malware payload", "value": "4a92a30daeaf6b88effba8858522b10fcb477b6c", "object_relation": "sha1", "Tag": [ { "name": "daa", "colour": "#0ED13E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679040433, "uuid": "0b9d4be4-5901-4aea-bb39-85598e3e848d", "comment": "Malware payload", "value": "357e4f4f4b0b1b3a57d3031778fb3449a571515024d7e174fb1084152e4d8eef9d40a60e77ec455d8aa65a9c1fd9b122", "object_relation": "sha3-384", "Tag": [ { "name": "daa", "colour": "#0ED13E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679040433, "uuid": "ae10a1cb-1795-47f2-b0fe-de8f90014d83", "value": "T147E4338FC29B1BB6E4B1F0F46E4F68A22795048D94866534CB724D8CF12E92DCF79784", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679040433, "uuid": "a2a0dc4d-8aae-4a32-81c7-5b5220049752", "value": "12288:lEF+bTV23+qb84khOBJQIXHIJrZ08kdGzfjOnXu4m7pDYpB/sTepj6KgdEWv9:jnY3+54u+b2r+dUCeFlUVpj6ZN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679040433, "uuid": "2c8ccb4c-cc7a-49ff-a49f-dd32f2bb1806", "value": 704129, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679040433, "uuid": "f839d05d-fb04-4013-80ff-7ef58e09a72d", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679040433, "uuid": "a5010b9d-e35d-49bd-8bce-c074b2f1fbe5", "value": "PURCHASE ORDER.daa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54a8c3e3-c4a0-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679042841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679042841, "uuid": "d14b368d-a522-44e1-aea9-815f57434fb1", "comment": "Malware payload (AgentTesla)", "value": "b6d75dfd6578b744ee58de3483800c08", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679042841, "uuid": "8388e3bc-2e4e-47b5-bdd9-15a5f31dbab3", "comment": "Malware payload (AgentTesla)", "value": "ce6394d03ce1233b23adef6884c2d67283186675c4353aa20c6a2a03b04526d1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679042841, "uuid": "11bc0598-ede9-434a-923f-afb3b497bc4a", "comment": "Malware payload (AgentTesla)", "value": "29ed53534a6bbcbd11823d7dd376f6de62fb6a41", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679042841, "uuid": "b7a643da-c980-45ea-88c5-790dd9b36028", "comment": "Malware payload (AgentTesla)", "value": "75725d83cfa2d01e39e17b3e6d59a25b3542855b8ad968107f66b2ee2f2daadb6772614e96022784681273d4696d6413", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679042841, "uuid": "8a561493-96c2-4891-98dd-70a8d5e90d5e", "value": "T18715ACCB7618FBE2C93BC6BA74303419D3EF975A9367E2784D8918D52521B400DB3A4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679042841, "uuid": "5c49026b-b4d3-4a8b-991f-4243ebfaafe9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679042841, "uuid": "ccf18a9f-f560-4acd-bf78-f138071bf703", "value": "24576:V2jkj+roEceU2vpoPeurVghm+LSffP/FMN:V2jkZLTGurSLSP/qN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679042841, "uuid": "4405b8e1-0754-4c07-8b9c-50fd7a16905e", "value": 952320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679042841, "uuid": "c2eeb83a-e39b-4578-8d2c-018a24203e6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679042841, "uuid": "abe6995c-60fb-4e1a-a432-6872577c154c", "value": "Purchase Order-0823636.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fce9a56-c4db-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stop)", "timestamp": 1679068173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679068173, "uuid": "13bbc6de-3ae6-4c66-9ae7-3fe02f5647a0", "comment": "Malware payload (Stop)", "value": "0990b8c50c4cee64652ea92525ad06d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679068173, "uuid": "eb2ff4b3-884c-4ac8-bf0f-093ad013bc15", "comment": "Malware payload (Stop)", "value": "ce902721fe5439bc49d1bf849d1111de33b55dbed252f1546315788e0edaf388", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679068173, "uuid": "8df3791e-a9b3-4013-b281-e8cacc544dd3", "comment": "Malware payload (Stop)", "value": "d97008c250cb4858a7bc0c6fc5a760fca8296037", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679068173, "uuid": "363175ba-fb29-4555-8a68-8717aab2da30", "comment": "Malware payload (Stop)", "value": "9694a2ebd28a5acab92e10ba83df5145cd48b4b6dfc71ebad2bdee46a644427aea1cec42084229ab3ad8a5aa3371a754", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679068173, "uuid": "f593850e-bc53-4a6f-bb89-6f0cea06d9f2", "value": "T1C605E043D6A03D54EA668B73AE1EC6E8761DB6618F0D7BB5122CEE2F04B1172C173712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679068173, "uuid": "1ed7fd99-6166-4706-9dab-f30fe58c80bd", "value": "abe3ddf8623240e0db2d6ab65f42f1d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679068173, "uuid": "e24557db-c6cb-4021-8575-861dc2426e67", "value": "12288:UL9MBB816XxgUvzLgImq8wL6+HVbO+6bYzsygM29ChcMwgsY4:nBXxVHgI38C6+Y+xzszY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679068173, "uuid": "b8200caf-9f98-4b83-84f0-39162a2dddf7", "value": 818176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679068173, "uuid": "3f42c1e5-0bc1-4c89-8698-ac2a9bc4ce00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679068173, "uuid": "e7604a64-4528-48b0-aec9-853877dd2e64", "value": "cracksetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "959314ff-c4c6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1679059271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679059271, "uuid": "eafa9e8b-87be-457a-ac5b-73efc1d5a181", "comment": "Malware payload (Gafgyt)", "value": "5640306aa753a37fb3227f2361a0a5d7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679059271, "uuid": "19670a6f-a15a-4c84-ab7e-9291517fd53b", "comment": "Malware payload (Gafgyt)", "value": "ce91be1dd927954a042ce3626c3d71b3a71e0b8e910bfe6de424f22360883009", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679059271, "uuid": "2ff50c38-9fb9-430a-b158-9f002e47f77b", "comment": "Malware payload (Gafgyt)", "value": "c1d8147bf54af7b17969bb26ed2e2b6e2cfb6060", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679059271, "uuid": "685dda7d-1fda-43f9-b47d-e1d436fe60a9", "comment": "Malware payload (Gafgyt)", "value": "b43d1435f9bf328cb53e3a31e82bade3ad89698f9ba9673cffc9a7c62bd3aad17edf5c7aa3b9ae243d22588864649b63", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679059271, "uuid": "55eaf075-63c8-43df-94a4-069effce18cb", "value": "T14D63C68BB72D076FC59B5BB11CB727F18B69ED2102A651C4E20EFB840BB25745422F39", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679059271, "uuid": "8498c5df-37c1-4898-9fc5-25e70c40d237", "value": "1536:liWGgkK3CH1O/OYyOGte8A28CXqBqEW0JCluw:onBLYyOGte8A28LNG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679059271, "uuid": "bf4325b2-82ba-483b-a1c0-a6f3641066d0", "value": 72870, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679059271, "uuid": "1585fc07-fcfc-42e4-aa99-3e8aa0a235e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679059271, "uuid": "d04e0cb2-3532-4879-bd90-9234f3471429", "value": "5640306aa753a37fb3227f2361a0a5d7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91a54418-c4f7-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1679080309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679080309, "uuid": "6bdec434-8eb4-42fa-8c51-1209a1d12145", "comment": "Malware payload (GuLoader)", "value": "049ecad4587538c292e3ebeee5947eb5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679080309, "uuid": "9e279be4-4505-430c-80a3-896640a8e879", "comment": "Malware payload (GuLoader)", "value": "cf9a08d65a0b472b1ed84638a09d39d741f34e9cd2641092141a9bf1a5f796a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679080309, "uuid": "b2f5a648-a6ad-4238-84a3-d33fa323452d", "comment": "Malware payload (GuLoader)", "value": "12aabeb19083dd114b7b94c836b031de3945d2c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679080309, "uuid": "4b1ce4e7-a6e6-44e0-ad96-1fbdbfe840c5", "comment": "Malware payload (GuLoader)", "value": "3af3a349e7084ebb238207c1d85fd97130814f515f713a453fa8f0053b3619aaed0382300c983f3b9df6b265cc4ed6e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679080309, "uuid": "86960ec4-b95f-4c90-a582-201fce889344", "value": "T17D6401913AE0D467FC5A4630CAA5E5F3D2A1FE04C916C18373647F6F7D322419922EBA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679080309, "uuid": "3959e065-26fd-4047-895d-92654d17288f", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679080309, "uuid": "fd5bd3e8-8709-4a42-97d2-2d9e61eedcfb", "value": "6144:DDk9dhfzelxllPuHBXZOEz5hN4EAnKQo4N7kqZ7t+roIbvS:U9u3lWHBXZTENnKza7kqZ5+rh6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679080309, "uuid": "48f12e17-d1f0-4796-b592-25494af814fa", "value": 335976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679080309, "uuid": "88020dd5-f39e-4795-aa29-e98ab0163b82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679080309, "uuid": "4f350abb-0a38-40d3-b716-078574fcb7fd", "value": "cf9a08d65a0b472b1ed84638a09d39d741f34e9cd2641092141a9bf1a5f796a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecb3928c-c4c9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1679060705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679060705, "uuid": "c927e685-eb30-4faa-8d33-a69f58aca615", "comment": "Malware payload (Rhadamanthys)", "value": "c4342716e152bb67e6319a6fb4773bbb", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679060705, "uuid": "e5d90543-8e70-4db0-bc4d-2d147a7d01d9", "comment": "Malware payload (Rhadamanthys)", "value": "cfb6e2cc273660a6f3b104976a898f96a3e900fc00eb000be59e6e0b86e9e376", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679060705, "uuid": "bcd19f62-26e4-4c23-bc9f-cffb812879fc", "comment": "Malware payload (Rhadamanthys)", "value": "875ae4c949b4bc790378abbea40f694577105e5b", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679060705, "uuid": "85a0221c-55c1-4fb8-9825-f00e23fb1ccc", "comment": "Malware payload (Rhadamanthys)", "value": "f10f332f43f044b87acedb6616d12e4c8c99854382be431159461821b48b1ab68524310b148f9b78c29f0e29912297d0", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679060705, "uuid": "4dae493a-10b1-4aeb-b0e9-89e2b26ffd29", "value": "T187E57CB10B97EE81E7AF2E74909419C0CC7058179AAEA348FCC539964FD475CEEC86B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679060705, "uuid": "57e597f8-179a-4cc9-83f4-65824da43d36", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679060705, "uuid": "fc2eb156-d63d-4b15-a22b-20c2a5125a30", "value": "24576:13vUkNGCR94SaCilFzS080hiZeN8ezAJKtu1Dze6HDpLWADoGkmjWP+Q51vU2MGq:PilFzS0YZm2Ddaf4xkS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679060705, "uuid": "c516364e-3251-46ed-ac89-e4187834a2f0", "value": 3064832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679060705, "uuid": "6e48f48b-106d-4a07-a29b-d240816bb8b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679060705, "uuid": "1ed8cafa-d8b5-413d-a017-e2e6f6905594", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0ea630e-c4e0-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679070483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679070483, "uuid": "329c5369-fe32-4703-8204-ab32748e4b4e", "comment": "Malware payload (AgentTesla)", "value": "029093ddb07252a67105e7f9e1298e74", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679070483, "uuid": "873bdf58-9777-40fa-aedc-fb0050b1ff47", "comment": "Malware payload (AgentTesla)", "value": "d0cc1ecb03997d41886914f7c78052b52d48c571067e016c8133afa158885350", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679070483, "uuid": "9b8835fb-3df2-4b5d-b9b3-1396124cad9f", "comment": "Malware payload (AgentTesla)", "value": "33fd48b9dda45baaa1c5ec27d1ff82809ffad4ec", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679070483, "uuid": "701ffeb7-701e-4ed6-aa14-8128154f2ed4", "comment": "Malware payload (AgentTesla)", "value": "f3ad167d4a729dbdf09b2b097b59790134070da0c5eeea3aa692f5828fb530ef13c3baa6fd527c4c7ea7342d2f9730b1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679070483, "uuid": "fae0274e-8fe0-4de0-81e7-f651ab71f470", "value": "T10E146F15F395D12BFA194B35AA92C2971266BCB3AD16C94721C3730F1B33FA19D32E12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679070483, "uuid": "d21c07f4-e87b-4d19-bcf9-7fa338c6ed87", "value": "3072:ykZ+RwPONXoRjDhIcp0fDlaGGx+cL26nAltqkKSACAFBN2Mw9:PZ+RwPONXoRjDhIcp0fDlavx+W26nANR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679070483, "uuid": "a5b3ff7b-2a79-4a50-99bd-200b3b3c6519", "value": 193536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679070483, "uuid": "d85e65b2-2a37-4b74-92d4-444cc7370a25", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679070483, "uuid": "0b67d307-19e5-489a-ac51-9fee882eb59c", "value": "SecuriteInfo.com.Exploit.MathType-Obfs.Gen.12640.22160", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d22bd58b-c4a2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679043910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679043910, "uuid": "7ccc5d69-c591-4e67-979c-1df0e6e97f1f", "comment": "Malware payload (Mirai)", "value": "526fc7839eacdd1dc4696e589b20ebde", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679043910, "uuid": "b3735b49-156f-4b08-83af-55b4676a8eee", "comment": "Malware payload (Mirai)", "value": "d12b23f4e5e7c85fe5ecea44a23e5b476039649c635227d6b64b6bc1ef1cc226", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679043910, "uuid": "5d5ffb50-cf34-4323-b96e-4686a6e48569", "comment": "Malware payload (Mirai)", "value": "d4ff7204bc3813286803f9442949f33caf00468a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679043910, "uuid": "4966ec3b-b8ca-489a-954c-e3fd66d8bf76", "comment": "Malware payload (Mirai)", "value": "5a91d5d584a412ae3e6d83ff6f7184a80fee6f28f04deda51a9ef959a3c866ab45b50763552b0196b0d14b3e4ef2ceb4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679043910, "uuid": "051506c9-8e40-41e0-b326-21ae3bc1bbf2", "value": "T100B33B376251C97AC08356F426EBC5729D13BCBB0B32219A33D47D60AF368DA1E99B05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679043910, "uuid": "e8d814a6-06d5-41a4-a951-efd34485c294", "value": "3072:kiry859a2ADJf9wHYqbgFFo8+HeAo+TRCm7FnVqfJXFWbNb:T9a2aLqkrMnsm7FnVqfJXFWbNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679043910, "uuid": "f8a55893-9880-4920-86fb-501f9ccb2b0c", "value": 116503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679043910, "uuid": "5f4952e0-2841-46da-9b7c-ce76a2987ac4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679043910, "uuid": "55a89b6b-7f95-42b9-bc1e-a49d497e1fb5", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4ff32bc-c470-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1679022440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679022440, "uuid": "cd5afb21-d13c-48b7-b967-c1f0d206494e", "comment": "Malware payload (njrat)", "value": "888dcdd4e1306865e2ef687ae5bd4a04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679022440, "uuid": "d9d987bf-1014-4a82-942f-7a76d4b7b1bc", "comment": "Malware payload (njrat)", "value": "d27949f622083d799ba2f49e3a7039be4e57094ba7fcba635d028f269522007d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679022440, "uuid": "e86ee55e-1ded-4baa-8c43-e68881b31c71", "comment": "Malware payload (njrat)", "value": "f2fa50dbb9727b7c28ad588098cd398d09fb507b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679022440, "uuid": "8dbbe397-ee34-41c4-945a-19b74900cafd", "comment": "Malware payload (njrat)", "value": "0dbe1cc1c774712f9cc011e4bce0d85afd97bd8cf7c6803a0beb86817c1ae59f9dacf5fae97418abe38fba3850dc1e44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679022440, "uuid": "77aac3db-4264-4188-8902-9745ce11987e", "value": "T164B21A4E3FA9C856C4BC177486A6965003B0E1470423EE2FCDC560DBAFA3AD91D4CAF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679022440, "uuid": "c58cdbc4-151b-4106-85bb-8aba4c29c027", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679022440, "uuid": "c39c2abc-180b-4223-89fa-0003c8cecd43", "value": "384:QoWtkEwn65rgjAsGipk55D16xgXakhbZD0mRvR6JZlbw8hqIusZzZMdJ:f7O89p2rRpcnu/J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679022440, "uuid": "92ae19a4-8deb-41c2-ac71-09dace169e48", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679022440, "uuid": "e2cf45cd-dac0-41be-ab93-563fd3333692", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679022440, "uuid": "fa418fec-4097-4b03-8a02-b312335850e3", "value": "bK7E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ce84a83-c4a5-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1679045109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045109, "uuid": "bd0a7c4d-4e2b-4ed2-8c89-648f8c137d2a", "comment": "Malware payload (AsyncRAT)", "value": "43fb0bb43cd8878e170066a86c57b8ca", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045109, "uuid": "5fdfccdf-2a0b-4239-8a54-645eac1d3aa2", "comment": "Malware payload (AsyncRAT)", "value": "d2c87e457155fbd7fccc0848ebf439c02526e0f17ad8f9e3fbda6d6ac11e09f5", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045109, "uuid": "98dd6e85-c11b-4d31-9e62-1435a2131064", "comment": "Malware payload (AsyncRAT)", "value": "2735b35b37b7a844ffa9cef1cfed4e648c9e256d", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045109, "uuid": "cb8d613f-ae5c-4a4c-8fd5-f12738510991", "comment": "Malware payload (AsyncRAT)", "value": "4d00e9f2abd160a7c6b77fb73128a39d2183954983dc3f2f3f35f16b4d723947399587bd2e135f8ffde218b28dea36a8", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045109, "uuid": "18690e02-b74d-4736-a475-cdd2abe85fd8", "value": "T191C1EB415EEE40DBF22707306BEAB37716A5F9B1552E62F870444A589B30AD0C862EB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045109, "uuid": "aad2d56d-db46-440e-880b-2ad412188d3f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045109, "uuid": "9bc09407-9cfd-489b-b325-4fb2a514f137", "value": "96:pDyA79yeCFQGONFvsd0DZ8bc/m+31vvqd3ojNrl:sG9yNF0NFvq0F8bc/m+31qdw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679045109, "uuid": "3e6075ac-c334-453d-9d0f-861ae822532a", "value": 5632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679045109, "uuid": "58ef16c0-b940-44a9-9560-ba894eb1e59a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045109, "uuid": "ef63569a-8d3e-4c44-b17e-da0d423df848", "value": "43fb0bb43cd8878e170066a86c57b8ca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "493c60a1-c497-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679038956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038956, "uuid": "0de85ca6-9b4d-4ab0-9385-74e11b5cc14b", "comment": "Malware payload (AgentTesla)", "value": "b39e3336180b7f345770ff5b4725ff39", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038956, "uuid": "79ceb2da-de17-4477-adb0-49cf2b435e8d", "comment": "Malware payload (AgentTesla)", "value": "d32bba142663cd6203437f8295f7825cd552326b4b0fdb026167cb4d19ba9cd7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038956, "uuid": "d7fa8476-79d6-4d35-8cb4-b7d08576b198", "comment": "Malware payload (AgentTesla)", "value": "3f731651b6c0e2dee3fc9c006ac262f6d2cb068d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038956, "uuid": "c7206cce-867e-4784-9818-b1803969d614", "comment": "Malware payload (AgentTesla)", "value": "8e5764c9b480fb79cbe3400615a3de9f6b4e3bfa1f8c7f5739f39b1eebe28e584c09fd25143523b59021ffc6e4c1c805", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038956, "uuid": "c450c054-7b13-40fd-921b-2307a9cad250", "value": "T10F351202BEC194B2D5A318721A357610AA7EB9302FB1CADF73DC491DDB715D0CA357A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038956, "uuid": "38f5e62c-532a-4eab-82f4-6368d6498354", "value": "24576:PTbBv5rULmVeLmvdWULotH9NwCLmtmH6opxUPYhLKX5yaU:5BVVgeoULGHjVStmHXxUPYc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679038956, "uuid": "24ce7f25-5489-4df0-9c6f-674d28cdce80", "value": 1148928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679038956, "uuid": "cb8a09be-b960-4c46-8dae-cffcb3a90115", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038956, "uuid": "3e1ab601-3be5-4269-93b5-cb18fceeb484", "value": "doc10010679052382012143717.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66aba57a-c4db-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679068211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679068211, "uuid": "57f6ad41-d907-4e58-8f5a-b4aaf3fbe40e", "comment": "Malware payload (Mirai)", "value": "db8db6dfb6075854f0a8662faa05ec0c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679068211, "uuid": "c966c16b-c4c0-43a5-8e2e-1f0545766113", "comment": "Malware payload (Mirai)", "value": "d382536486587a4acaa1a397653a03d8e766188c231f865f1321c321dc88a952", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679068211, "uuid": "5f856044-b4cf-482f-ae67-ff8d2114efb4", "comment": "Malware payload (Mirai)", "value": "646be8a77fe132f0771f53b22c2b1a5a8599de87", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679068211, "uuid": "a519ad48-6ec4-4004-b166-368d9be9c696", "comment": "Malware payload (Mirai)", "value": "83c2a4ea32e26912a7a2a3145a99a987e4dc3afddcb4f00e4c5516d42f6db6d0c226e5d4bbbf00ab985fb11b6af60620", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679068211, "uuid": "dc6f9897-1694-4ec1-b47d-fda8f4b8fb5d", "value": "T1F6C2F110B1CE2D3AF4190138215D19DA9645D9C2478AAB20A56DF78F5FED08CAB3C8DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679068211, "uuid": "7fefc814-968d-4bfd-83b3-12e8e239ecee", "value": "384:M61qoJ/CYrg/8Cqt2F7ZIsEBcDjZD65KRleWHtH3xeSzNRI+woYcDsNx/EuEu+vV:Jqsxrq8QF7VjZD6MRleSzY+wooMHd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679068211, "uuid": "1bbb7400-fd58-4acb-9c7a-345152443502", "value": 27060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679068211, "uuid": "77535ee7-7a86-4d17-ae16-9ef6c60a5dac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679068211, "uuid": "ef349d2c-62a9-4a84-9da7-e5972fd75a5f", "value": "x86-20230317-1550", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3da47d3c-c4a4-11ed-88f6-42010a9c006e", "comment": "Malware payload (ManusCrypt)", "timestamp": 1679044520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044520, "uuid": "e99cf9e0-69dc-453d-8989-956f7b587eaf", "comment": "Malware payload (ManusCrypt)", "value": "9b8786c9e74cfd314d7fe9fab571d451", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044520, "uuid": "b5b42e0a-9d7d-436b-bb9c-a52042135329", "comment": "Malware payload (ManusCrypt)", "value": "d3e1e0659ff9d7843f91e722d6e94cff0cbf891ab115b7dc23bde7c52a9ead09", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044520, "uuid": "1527a103-7931-48fa-b630-1f26bf46cc94", "comment": "Malware payload (ManusCrypt)", "value": "e5725184c2da0103046f44c211cc943582c1b2b2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044520, "uuid": "8a7aa98d-60cf-4a69-b3d4-0503e7e65ef7", "comment": "Malware payload (ManusCrypt)", "value": "b91a021da999d5ca56fa067f6de8426630a28e3612e4bbf32b2bc54c4bf86c0319e1e9c80f5ff95d67ab25b737f45a9b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044520, "uuid": "e0bad1ec-2a0e-4da0-bf8e-bf6d3010392d", "value": "T168753F07D3E069127277A2298FC53667AEFA306BC5F2CA02D519132E6971CD47F0AF49", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044520, "uuid": "7cc88bcf-6927-4c88-82b3-b1cf16f576f1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044520, "uuid": "49fd1bce-9c10-4e09-abbc-9e9328e5b126", "value": "12288:0uKd2SU1qQFhpGf1U1gYZMt4TwIwwNjCBCTIXFgpWW5Gm41jKmejWYzHWsd+1Ys2:NKdKUYLm7dsTccLa1mmerbED", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679044520, "uuid": "ac042dbc-7301-49ca-9d53-9d02d649e786", "value": 1570304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679044520, "uuid": "e1ed2c37-ea00-4c55-bfac-e4cafa770b07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044520, "uuid": "4488e4b8-9147-4b03-bbcf-b609477bd6e5", "value": "9b8786c9e74cfd314d7fe9fab571d451", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67176435-c472-11ed-88f6-42010a9c006e", "comment": "Malware payload (LaplasClipper)", "timestamp": 1679023115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679023115, "uuid": "9996c987-560b-4a65-8d19-c0096906cab8", "comment": "Malware payload (LaplasClipper)", "value": "8f5f61c192960b47701d367d4c0112a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679023115, "uuid": "7a99b712-2d4d-44ec-8b99-73969d6015b1", "comment": "Malware payload (LaplasClipper)", "value": "d4607fe27527413aa9685e2ecbce8df78b2c2538ccc5703442f7757a100c1362", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679023115, "uuid": "45fd8301-b2ff-471b-9cc6-c434ee088f1d", "comment": "Malware payload (LaplasClipper)", "value": "e084cb5d4457be7cfba1c79adcc1ae59a500a66f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679023115, "uuid": "4f9f5dfa-4288-4e51-8d49-47fcb04d96b8", "comment": "Malware payload (LaplasClipper)", "value": "ee24f8effd08aa20d40acadfcc8367c459ca6388db3d0532bc2b061d5070602e5b1f167ef7e36bb2ac2843fd7e8243bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679023115, "uuid": "32d1ad1a-b9cb-405d-9815-cf729e7280f9", "value": "T1F534B013C3E97C68F52646715F2EC6F4BA2DB4239E799F5B23185A2F08711A2C5AF310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679023115, "uuid": "b6b3d450-5f54-4242-89f7-8344f4482d20", "value": "4b2faf5e2157c756cf2fd31d6cfd3d44", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679023115, "uuid": "405fdb06-135a-4f7f-a8f2-0434bdd5bf55", "value": "6144:jbOxXV0HcczeTv85qfnl2Hrti0ChhQhGJ:jbOxWHLzGrnUHZi0Chu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679023115, "uuid": "98af907d-cadb-467f-a1c2-a15eee4fd148", "value": 250880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679023115, "uuid": "03dc80b4-623d-4872-9bf7-5403b2830a74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679023115, "uuid": "70d325b0-06ab-4213-9036-3bcd412ca7b2", "value": "installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3e86c06-c4bc-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1679055080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679055080, "uuid": "4416e0f3-e624-407b-ae4c-5c0781f8b118", "comment": "Malware payload (Gafgyt)", "value": "d62671b82e1777759f85985d47793531", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679055080, "uuid": "ebebfc4e-e372-4a61-a132-e8e32585fc2f", "comment": "Malware payload (Gafgyt)", "value": "d4cc592c7d7a1078278bceb1b4cc04213b0c50268df89d303134ce84c3342921", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679055080, "uuid": "9f6e38cf-8f93-463d-bd3a-7618275d2472", "comment": "Malware payload (Gafgyt)", "value": "dd87fd33d6c3aac964b3d9e70fe3eed2e1ab5bf1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679055080, "uuid": "56bf375a-5bef-4e55-a9b8-9864a882191d", "comment": "Malware payload (Gafgyt)", "value": "e3ad935dd615272265bd3cc75f2ca7b5701c11577866b869205c2ee0dfd2640b858f0a2fd77448f7eed9928c0b074bd5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679055080, "uuid": "d970ccf6-8cf7-4e66-b184-80fdc2b5914f", "value": "T1E3D31905F460875BC2D217BAB68A425D37231F7893CB33256A34BEB42FE1B981E79531", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679055080, "uuid": "f844f0a4-980d-48ee-b797-38c0f3bc1cac", "value": "3072:Sdf+fvEqa9FazYA7IboRhFe391CErktmCQA9FX9aH:ifWEqa9FaNhFe3DrktmCQA9Z9aH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679055080, "uuid": "186f069f-be31-40bf-89df-17724435c4b7", "value": 139585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679055080, "uuid": "ece89a93-003e-4b25-8b79-6c57bc8154bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679055080, "uuid": "8ba12126-11a8-4e44-b8da-09130ae88565", "value": "d62671b82e1777759f85985d47793531", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8894efe-c4a3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1679044377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044377, "uuid": "0468b74f-086c-4ddc-810b-6451bfe14bac", "comment": "Malware payload (Rhadamanthys)", "value": "e02d474a259c77f011ec147233f13532", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044377, "uuid": "18f4b4a3-8bd0-4606-a58a-59b98775862e", "comment": "Malware payload (Rhadamanthys)", "value": "d4e3bac17382919e61bb4a51549a0af15e3df9aa032120e0d7a7e7cae316e263", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044377, "uuid": "62a662d2-d6a9-4fb5-937c-280ea695d079", "comment": "Malware payload (Rhadamanthys)", "value": "44f1e384920639a4a10182b760030b6611b2e0f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044377, "uuid": "971ff4cb-f6b8-4cfb-863f-0cc2138c5658", "comment": "Malware payload (Rhadamanthys)", "value": "7196edbdd96977fea2a958335ec78f433bc9911f4d8ffc15b850fa31e84ad243ad7ead3a4c912822a241469ab29b1220", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044377, "uuid": "1e77701e-3411-4fa2-abd0-260e0b3b8489", "value": "T1E1845A0386E13D54EA268F73AE1EC6E8761DB520CF6E77A6121CDE1F04B61B2D163712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044377, "uuid": "1af5e58c-2a21-4645-98a6-9d18518286fa", "value": "abe3ddf8623240e0db2d6ab65f42f1d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044377, "uuid": "0db899e7-600e-4700-aa58-b6613d84a586", "value": "6144:v9tJ2B5LkgT9h4k2i8TQWTJWHBcB77TBPFdnZmj:1n2B54A/2/TQEJWHkjBHc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679044377, "uuid": "71dec18b-e994-4908-8d28-5d65847dc533", "value": 371712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679044377, "uuid": "b4a04ef7-e65e-4a25-9287-969fa429a19d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044377, "uuid": "cf1ebec4-cb0d-4a67-86f2-1bb9b0502f33", "value": "e02d474a259c77f011ec147233f13532.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f914c9e4-c4f4-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679079194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079194, "uuid": "8bc0a3b6-eadf-4858-8ed8-652db36a3f2f", "comment": "Malware payload", "value": "2451e8d758673a8d0cbdd6b735dcdf4f", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079194, "uuid": "28bb1bbc-bca9-4815-821b-f5eafc59fd15", "comment": "Malware payload", "value": "d5914791aafdc3abc7b1fceb4be01c84197aad56996eed0e21b453c313178bd1", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079194, "uuid": "f70edf5c-6d49-4b7f-a07e-3f04cbc0a115", "comment": "Malware payload", "value": "991443f0f9967a2c6ee3512f440b027f71fd0a15", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079194, "uuid": "2751737d-ac45-4247-9911-28e78ab2719c", "comment": "Malware payload", "value": "dba76e1df9922445cd226a5a3fe6c6972b4b8cbefff36cc0e8e8685e03e0186c30a4edb29adde9fecced235135098350", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079194, "uuid": "9ca178d7-2bc5-4ba3-8070-a3372a7dfed2", "value": "T1C424CF137644CF83E484DBF47FD79E9A1B0ABF54A89271DB60853BAF6F30111088A65E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079194, "uuid": "1a5d072a-95cd-4061-beb8-448b1318f3ac", "value": "6144:4aFJkKXiDU7w50e6FTkAjRyauig8+M6bkl:4aFiKXKWb6s4gty", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679079194, "uuid": "1d2ed542-0729-429e-ad77-4a9d49624e8e", "value": 216064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679079194, "uuid": "077413c3-230e-4270-903a-8900176ef8f4", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079194, "uuid": "aab2f841-9cba-4afe-8b75-0eeda0e638e2", "value": "PO100982-0192.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e1e49d5-c473-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679023583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679023583, "uuid": "c1b2d2e5-891f-44c1-878c-caaf065e9a48", "comment": "Malware payload (AgentTesla)", "value": "984eb11b3f5de9345be40b9fdf432400", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679023583, "uuid": "3efb6781-0fd2-491b-a45e-b4acae1c2510", "comment": "Malware payload (AgentTesla)", "value": "d613285ecc373bd6fcc8453ef8e877adba090dbe1a2a585bee5d15865c7ecd62", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679023583, "uuid": "30b4e20a-297b-4d6f-9b6a-c8e780772ce3", "comment": "Malware payload (AgentTesla)", "value": "dcdb7a00279a40aec32c7cb48d83b110155ceb22", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679023583, "uuid": "a02159a9-ab15-490a-8294-4a2d92ccc9ed", "comment": "Malware payload (AgentTesla)", "value": "95355c337ee004bd517d46d01de91e598d673792ccc098be489f827566e3c382fe6da615a4825083c277f96601fc2426", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679023583, "uuid": "f15e40b9-019f-4194-a5ab-5d8ffdc15269", "value": "T19252D5421B8D99F2D328E1338264540A48BEE537308716E9B88CE5913BFD60D4AF92F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679023583, "uuid": "9daa1d25-9a08-4927-9a69-b26d211d4eb5", "value": "384:8p72r5s4pRAefFUUCpT/qxfRrVvSBx1/j3JQeKr:8p6r5suAeP4T/kTSBb/rM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679023583, "uuid": "786b062a-17f0-4a2b-a627-d3ca78a54805", "value": 13811, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679023583, "uuid": "f195380e-923f-4be3-bc4d-2e486a0716b0", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679023583, "uuid": "97143459-c6d0-4436-b1ac-8d05e7d52d6f", "value": "984eb11b3f5de9345be40b9fdf432400", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "035ac4ee-c514-11ed-88f6-42010a9c006e", "comment": "Malware payload (LaplasClipper)", "timestamp": 1679092526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679092526, "uuid": "1aa9771d-21c3-483e-b436-6fd04fec7e78", "comment": "Malware payload (LaplasClipper)", "value": "9ba850717865741b4d4f76530b4dc13d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679092526, "uuid": "0ad7a4c1-47c9-4c37-8753-e8cd04be2703", "comment": "Malware payload (LaplasClipper)", "value": "d620a6f1697df8a7511b01b0240c75cb68fda996a60cb35119c8069d84614c06", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679092526, "uuid": "9879020f-7270-4163-bb7c-2959be8742bc", "comment": "Malware payload (LaplasClipper)", "value": "991ca9d2fb03b5ac9fed64c6815a4d428aa99df5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679092526, "uuid": "e7eec55a-187c-460c-8767-f323eef3c948", "comment": "Malware payload (LaplasClipper)", "value": "f36bc91462ebfb3639e602cf98749ca761a5f05e9ef92025110652523c16f06a9ce488016b42b4175345d5b6479c60db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679092526, "uuid": "ec869e1f-0888-4528-ba65-505e6f450ef9", "value": "T18D541A0392E1BC48E9264B729E1FC6EC772DF6918F89776932189E1F04F2172D163E91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679092526, "uuid": "45f51811-9d58-4ef2-a8fa-772131d7d2d4", "value": "9fce6c081ab87c2bbedff5f8a5ba7a52", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679092526, "uuid": "3ec9e426-15b7-43da-8ed6-ad46be7bb117", "value": "3072:706S7gXLWpGplwmE4c08MHYYFdpL7ojpdVCpwyEitsC3uM:wdgXLWIplwmE4d8LgpL7kKgCu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679092526, "uuid": "747565e3-4933-460b-9e8f-7c0b0aa5d5e2", "value": 304128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679092526, "uuid": "9c639919-3c4a-463c-9484-e1fb90ce3297", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679092526, "uuid": "b29402c8-ca52-430a-87f4-1195ef118c46", "value": "9ba850717865741b4d4f76530b4dc13d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc7da9b9-c4f5-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1679079522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079522, "uuid": "bcaae891-1417-42e3-8e6f-5b2d8a96e657", "comment": "Malware payload (GuLoader)", "value": "10995c9f16ad846b40d8ec226845b700", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079522, "uuid": "c8ea9e4f-547d-4411-8cba-567a05f3ce41", "comment": "Malware payload (GuLoader)", "value": "d6ce982702c255f807f0a6b1b897609e754a987d0efb0ddf8ba72620fcc7f581", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079522, "uuid": "6c24bea3-16a5-464d-98ff-020cb1ebc754", "comment": "Malware payload (GuLoader)", "value": "4c322cb74843fdd30275608b02c4fad568d06ca8", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079522, "uuid": "6cd8048d-33f1-40fe-aa2d-8194895447e3", "comment": "Malware payload (GuLoader)", "value": "36971bb5c99604d592ec922e4c379842166ea1580d73dab483a98b4a1316564852e0c05c31eac609f15368e6299ca776", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079522, "uuid": "f0acab75-5fcd-4093-a58f-bbaed8ae8be9", "value": "T17D6507929A1E1F19490F17DB9D730847F7ADCDF90E22012FADBA134E1102E58926F79B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079522, "uuid": "346bc19b-307f-4427-abfb-0b53f58410bf", "value": "24576:g1xr2cqkH+A6WF5xbbJ1SU9tGNwJZw50mqKO:yEcqSN/J1tiO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679079522, "uuid": "3380a4a0-7b7c-4956-baab-e2f969a0844c", "value": 1504930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679079522, "uuid": "64585ff6-3b2d-492c-a0d8-d7d9319e2f1e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079522, "uuid": "6930d5e0-6e11-4e7b-aac7-328dcda76b70", "value": "211894646-041711-sanlccjavap0003-2847pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dd23dd6-c49b-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679040789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679040789, "uuid": "23460484-9857-4df0-aea8-9e7771a54f1b", "comment": "Malware payload (AgentTesla)", "value": "52566f0ff46e8a99d07c8d4cb46b3ee8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679040789, "uuid": "aa5bcc80-3cbb-4881-a0b7-127b34feb3b7", "comment": "Malware payload (AgentTesla)", "value": "d6e9b82599fcecb2866035aeea05ad9e614a42dd7649aea6985a22534bfa6768", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679040789, "uuid": "4b9fe99f-c2be-4d90-bdac-9610f883439b", "comment": "Malware payload (AgentTesla)", "value": "460eefd5f85943be96281f95a477eb27bc0a62bc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679040789, "uuid": "bc12a380-8b17-4e04-b269-b47845d5b914", "comment": "Malware payload (AgentTesla)", "value": "6a4a03a8af82e223cfbc867c458c99e5be26b37fc043851adf752987b03a8497bfab98891e0f300822dac65834d8b873", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679040789, "uuid": "b6d464a4-0ab2-492d-9d23-47931eace9cd", "value": "T1A005F14DEAD9942ACD1E0BF6E4832450A3715863BE92EF1B9DC810E61F737EBD410993", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679040789, "uuid": "01b4500f-5341-475a-b677-0a27a912e88a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679040789, "uuid": "51bbe0b2-a074-47e0-aeed-24aea7717784", "value": "24576:cFQwcWyz1r3N3A6IJgfU8Scxm5BQSG04zPQ:zW01rdlIJncxWG04", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679040789, "uuid": "1bcaf4ac-6b22-495e-9cf8-46e7929959b2", "value": 822272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679040789, "uuid": "8606eb1b-da14-42ff-ad74-5e68d10d3fab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679040789, "uuid": "b0f27bb2-0eb1-4f53-a6c4-5f187a5df218", "value": "52566f0ff46e8a99d07c8d4cb46b3ee8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57c95432-c497-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1679038981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038981, "uuid": "a06bf4a2-3051-4cbe-9ca1-cb815d654c0f", "comment": "Malware payload (Heodo)", "value": "cee0905efea3357f3dc9902754e5d47a", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038981, "uuid": "51dac800-f065-49a2-a849-603f44a70cc8", "comment": "Malware payload (Heodo)", "value": "d72079bdae7c59361f934bf92ec1a53875008113541db11124d167cc2eb69b32", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038981, "uuid": "f22386e1-96cd-4c0b-afb9-83371a0572be", "comment": "Malware payload (Heodo)", "value": "693fdea99a495b339d8dd372b759f370cf7f1b7a", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038981, "uuid": "4f7863cb-d2c4-45c6-b518-86ffe1f32bb0", "comment": "Malware payload (Heodo)", "value": "b11951fbdd39757136ce8b781c36a00f7881f85e9ededa5bdf81d1bfe2378738ca430b0ddc1a34f720edd5e42fe8738a", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038981, "uuid": "8c646256-2e72-4caa-aa6f-58c6703735cf", "value": "T1B6C33BF1A8025C0AE123C976B1FB661399D052ED42283B2BF87D507DD978A20D5DD8EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038981, "uuid": "d72e94f0-468e-4a3a-86a7-3146ef216ad6", "value": "1536:RDBoTVdaeNtuXndCrJJmT4HVnteV4FrdMiYcx7bfCb6HPdnX9:1BoC+tCYvSMVnte8ZP1Y6Jt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679038981, "uuid": "50892d53-8534-45bb-8e4a-fa2bd36f7117", "value": 120428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679038981, "uuid": "69bd5f52-ef9f-4c3d-b6d8-e2e02cb896d9", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038981, "uuid": "7d388abd-f065-4918-ae02-c7f6236ce9c0", "value": "OMICS.one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2537cfc-c49b-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1679040850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679040850, "uuid": "c92d9456-3df4-4f24-911c-edd81fc90a79", "comment": "Malware payload (SnakeKeylogger)", "value": "a53eaa647b09b3347e13c1da372f4125", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679040850, "uuid": "d7da3f57-d30b-4465-81a7-ac4a2ab4719f", "comment": "Malware payload (SnakeKeylogger)", "value": "d881da9db40f9e11ada612b949960e934f3c782ef2a18324d96b6ad7f74cfbac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679040850, "uuid": "03bfb8ac-803a-4e23-ae5c-5ceb6b0e029b", "comment": "Malware payload (SnakeKeylogger)", "value": "a2c401dfc67accd69a664ef234146365c78d9953", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679040850, "uuid": "265d2a69-7792-44b9-9969-ce1dda276618", "comment": "Malware payload (SnakeKeylogger)", "value": "d048f391f45b94b3f79c3f1df1712cbf90ad00ef03bb81f771f0d38db7fe81717db64b7773d24a35db230e88aa4c17cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679040850, "uuid": "299b802d-72c9-4ede-a7ed-5de54c40fcc1", "value": "T12905024DF31ADB62C63E97FEB076201193F3984F5226E3489DCE64EEB622F554900A47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679040850, "uuid": "1ab334ff-1992-4a4a-a945-e141fdc9066e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679040850, "uuid": "8adf2e73-af55-4ded-9c03-e16e3f49c82c", "value": "12288:LzCQ0pjkjXyuaqmaCJ5lCbj7khnBJQYXEIJrZx8fdGDfjO2Xu4m7kD2py/sTHMFO:Nkjkj+iCxk7u3J/rAdOxeFALeMk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679040850, "uuid": "53b3a4ec-89e8-4a67-909f-126b4d99b4a1", "value": 824320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679040850, "uuid": "14d1289a-6403-45ac-ac83-34a3025aa205", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679040850, "uuid": "e9c9b736-9119-49e0-bb59-01c4323ca524", "value": "Remittance slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0de6d7f4-c4a2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679043581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679043581, "uuid": "99bf4a35-1840-4186-80b8-93be20472278", "comment": "Malware payload (Mirai)", "value": "355abe4d80671862210071611d0063a6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679043581, "uuid": "02eb00a5-2fd9-4e7e-981e-029090f69e6e", "comment": "Malware payload (Mirai)", "value": "d88c82cabd704195945f629de80d90b25e99a420532c9815cd3344055be252f3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679043581, "uuid": "10e347b2-d4bf-4dc9-bf27-1530c7334279", "comment": "Malware payload (Mirai)", "value": "9abc4067a60bcdfb7f614a0390097027b1207c92", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679043581, "uuid": "4ece7a02-d612-4a1b-8144-ce10e4608aa8", "comment": "Malware payload (Mirai)", "value": "dff72c92caba3b4ad952fe4bfdbf0687e0b320db7080f74accb42159cb18d811366f916ce693612f8dd0d915f103ebdf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679043581, "uuid": "d9ae888b-9743-485d-9003-e38564a330ee", "value": "T1F0633BDAF801DD7DF81BD77A4853090ABA30F3D512831B376397B9A7BC721A81912E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679043581, "uuid": "5ba6c325-cc49-420a-9abd-f6a81383213d", "value": "1536:nIgNf/No0n0zDYnPq8VpHw1ox16P9dJWLa1ngChQ72:nIAf/GJEnPTw1y1y9/SChW2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679043581, "uuid": "23e8d698-f692-4e5c-80ed-6e6499e51579", "value": 69632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679043581, "uuid": "d2a72df7-ad82-4fbf-8766-ba95d22dc72e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679043581, "uuid": "045ce98e-177a-453e-b91f-2c2bb2d73a04", "value": "355abe4d80671862210071611d0063a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5231c188-c497-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1679038971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038971, "uuid": "863315da-d0de-4975-8b48-1482c2bf2cac", "comment": "Malware payload (Heodo)", "value": "f44cb44a2dec6fce42d41a947ca5c120", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038971, "uuid": "dad1b5d2-e762-4ea2-9003-05b9ad493a57", "comment": "Malware payload (Heodo)", "value": "d894d541d5d911265a4e60a04c413939a14105072a67f5a3d50de2d0002d0003", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038971, "uuid": "23be4911-203b-40d9-a967-d643a7fa2640", "comment": "Malware payload (Heodo)", "value": "44672a849c91752c91fbbfeb91e300a3656352ea", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038971, "uuid": "c85c663f-4dbc-42ee-8448-24ad7cf8bd8b", "comment": "Malware payload (Heodo)", "value": "fe241184972797aa905eeef0132186db567f2703713d90764ccbb4d48bf68a8eba89372264dcfdc7073a8354f29d9819", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038971, "uuid": "8a7fe637-46c1-4418-aa3d-64ae799ded80", "value": "T145C32BF1A8025C0AE123C976B1FB661399D051ED42283B2BF87D507DD978A20D6DD8EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038971, "uuid": "de5db099-8e2f-4f16-8b57-3aa3f77adb23", "value": "1536:RDBoTVdaeNtuXndCrJJmT4HVnteV4FrdMiYcx7bfCb6HPdnXs:1BoC+tCYvSMVnte8ZP1Y6Jc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679038971, "uuid": "84b295c0-1599-4568-94f0-0f13f138683d", "value": 120428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679038971, "uuid": "e86ad1b2-2861-4fc1-ad78-c28b25908c8a", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038971, "uuid": "351aff12-a120-4e88-a3cc-e62a14bf402b", "value": "Insight Medical Publishing_1.one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74c0c1f5-c51b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679095723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679095723, "uuid": "288b6c80-c6b9-4740-ad31-807d71af5d95", "comment": "Malware payload (Mirai)", "value": "05c072fa945d27b1e70a957110df4633", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679095723, "uuid": "86b91b48-e9e0-4a8f-a020-b0b372edfe3e", "comment": "Malware payload (Mirai)", "value": "d8f884115c39aaf411a442a30332a33c6a828fd67c87657a2b9926e0dd2247ef", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679095723, "uuid": "1e19d48d-116d-4d7a-bcb4-c3244b1e118b", "comment": "Malware payload (Mirai)", "value": "e4a2ecd9413d6ca0dd7df3885a8b2a66d14e6720", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679095723, "uuid": "021c4042-6ca7-45f1-b1e1-5341ea8be3f8", "comment": "Malware payload (Mirai)", "value": "788d665d62cb6631e7b111dc68c8cb2523402b80e8a0b9dbd79cf012f5ad77319d6f45a044eb76e8ec1edd56f64145d4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679095723, "uuid": "823d25ed-22b0-41a7-9f3e-bc44dd3a4a96", "value": "T1B613954D2E328FEDF7AC863447B38A256758379637E1D684E25CE6011E7024E245FBB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679095723, "uuid": "9a197b03-adac-4951-8609-e4198b33f0d9", "value": "768:sEbYY2OkzplWTiaE38maOtqbuMKmt3PEWWYLjigeOMP2xZyOUJy1O:hYRODkStfEp4jy32FUJN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679095723, "uuid": "e22ae787-4653-4699-8782-2cae8d3d4535", "value": 43776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679095723, "uuid": "bb759717-4751-4b4f-9333-322d7e888c4a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679095723, "uuid": "e4405e02-cc2f-4894-896b-3caaa3856bf8", "value": "05c072fa945d27b1e70a957110df4633", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44fd262f-c4b8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Cobalt Strike)", "timestamp": 1679053122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679053122, "uuid": "61fb9ef8-fec4-42b7-994a-2213820c893d", "comment": "Malware payload (Cobalt Strike)", "value": "2d14fc0abc9432b32d79353b89b9c294", "object_relation": "md5", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "firewall-gateway-net", "colour": "#3FF98C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679053122, "uuid": "cfb67fc6-9a39-436e-91aa-282f39f44914", "comment": "Malware payload (Cobalt Strike)", "value": "da69111d0ba32fa46dfcf6dbb30d672d39bf5794951f5c4d69fb378eda4bd1ff", "object_relation": "sha256", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "firewall-gateway-net", "colour": "#3FF98C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679053122, "uuid": "133eb68e-f9d1-4d0b-a246-40a85e8dec5a", "comment": "Malware payload (Cobalt Strike)", "value": "726b03c1667004bebd77f20d7090fa7b3954721a", "object_relation": "sha1", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "firewall-gateway-net", "colour": "#3FF98C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679053122, "uuid": "65327806-48bb-48b8-96ab-3ec899b8a8e7", "comment": "Malware payload (Cobalt Strike)", "value": "4da119d22aceddac062ff78ea21e284566fc8688561eb787ca4fa7fc8c3e1279a7a35c15dcb35826505a5a604383a34f", "object_relation": "sha3-384", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "firewall-gateway-net", "colour": "#3FF98C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679053122, "uuid": "d7d78f66-aed6-4b2c-98a7-a4479166659f", "value": "T140D12A351A812FD80CC72190B9883A9BB7305FEF6504F7F0B3E2CE4297E2096995256F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679053122, "uuid": "d3238a1b-0f94-4ef6-8ec1-7baa9c7ee809", "value": "192:+9iMvwGTCLLmuq3WoR8XycmA4gMrxYjxs+wA9zzL:+YMvNCLeWuUycmA4gMrxYVs+wA9zzL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679053122, "uuid": "6e27198e-1981-45cd-a162-4421f861ff35", "value": 6301, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679053122, "uuid": "896e6062-5f09-4b20-b6ad-9d6ad2d6ca11", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679053122, "uuid": "f382f333-5e11-42e1-aec5-1acca8a9e828", "value": "cs.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ca5d551-c4e4-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1679072114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679072114, "uuid": "aba492ca-fe37-4402-9ccb-3ec25b7c1034", "comment": "Malware payload (GCleaner)", "value": "5666e0a35876d1636a60ec19fbfdce68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679072114, "uuid": "8ac39e4b-33b9-421d-9b63-6ec4832b02e3", "comment": "Malware payload (GCleaner)", "value": "db1800a95c8908bb39c03543f8ee553b838df5065c1195447f82c8305e1754c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679072114, "uuid": "a7e6db3a-8a76-4c3c-9726-5aed4c309851", "comment": "Malware payload (GCleaner)", "value": "7378581b82a0449dec8bc8256ae8316c770c3e54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679072114, "uuid": "b67d5c12-ee1f-49b4-a892-b64844a3f10d", "comment": "Malware payload (GCleaner)", "value": "12b0ddfc93216b55f3744a711794d065b90eff944a827003a36c72ba81469ad19245cc8110aa9e97f320acda847f300e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679072114, "uuid": "4fa09f6b-e848-4caf-bccd-5d7539ccb95b", "value": "T1F4C5331712414FBAE0F297756D46E22DD732DC110D298499B71C8EAFEF19602DAFCAC2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679072114, "uuid": "79d0bd38-a515-481a-b705-bd52e83ebaa7", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679072114, "uuid": "153b6549-ec8d-464f-b409-67f3b1358631", "value": "49152:EGlJfsrexbxNBZzi91qpzg4lPI30PO63pN3UC5DNTbk1EBQ3yq6ThRdrlSnNPd8l:5ldxNPe91WhFPz5dbk1MQiFThRdrUPdW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679072114, "uuid": "39f9abea-d5e3-450d-9174-9ec62b2148da", "value": 2665448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679072114, "uuid": "2f53a8f0-1e48-4ac1-9c9d-aecdd54c13c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679072114, "uuid": "17575abf-d665-4268-bdca-79fdc660e818", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7096cb9-c486-11ed-88f6-42010a9c006e", "comment": "Malware payload (LaplasClipper)", "timestamp": 1679031919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679031919, "uuid": "ff6f16aa-6380-4d6e-a46e-c4a1ec2ee273", "comment": "Malware payload (LaplasClipper)", "value": "604ec3ada1c97402bdae2928d77560e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679031919, "uuid": "ad18cca9-006e-4313-86b0-03b7baf39443", "comment": "Malware payload (LaplasClipper)", "value": "dbaac16e0456fbff1426acd74bddb3ac9f436524822041f755a5804b08b1d97f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679031919, "uuid": "1062d8e5-48a8-4aa8-bebe-1f631535120a", "comment": "Malware payload (LaplasClipper)", "value": "d0c8007cdfba8932b62e58e07ede782aec46d88e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679031919, "uuid": "64462751-cad1-432e-8bd7-edc9ab948fa2", "comment": "Malware payload (LaplasClipper)", "value": "fca3568473692d450af20577a2ba0394528712315a877aaeb73bbef0504bc828f980baa39882f7ecafeb51a485c59d26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679031919, "uuid": "98e101b5-3005-4785-a2b8-cc116214dbb2", "value": "T17A643B4393F17D8AEB268B728E5FD6E8761EF6508E897B6932189E1F04B0072C177714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679031919, "uuid": "bd7e4879-697e-435c-a747-fa977de45f34", "value": "f108f495a11fc155ca9660d14ca727b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679031919, "uuid": "dca329ba-4342-433d-ad16-17f2691546e8", "value": "3072:XsO/DpCLO8CnYnwn8kYOrfgl/hpwlyg2lcq6NeoRVf8VnCBMXXElSDyhRq3Tz:cOYLaYrkrIlclygIfgVf4Qk0ADyhS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679031919, "uuid": "77357569-5a29-4883-a030-f20f557414dc", "value": 334848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679031919, "uuid": "5b5ae127-b01d-4d37-a371-308b0bfd9feb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679031919, "uuid": "2eacd8d0-6afd-40df-9ac3-5e191099b81f", "value": "604ec3ada1c97402bdae2928d77560e1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12a3e884-c4e3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679071506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679071506, "uuid": "4803a78d-8ed6-477e-aec4-d335dd911666", "comment": "Malware payload", "value": "9e0c7bc064dcb53a222f5eed4e2eadeb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679071506, "uuid": "7e4f2f4d-ff29-4a25-8ba2-0655da48cdd9", "comment": "Malware payload", "value": "dbf287872ae50281d3136c7f0b890bc534439d36c9b6f594d29b6453f7656e9b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679071506, "uuid": "23d93840-1271-4dc4-b449-05d73e072deb", "comment": "Malware payload", "value": "473e0ba14f98a45f7b8c95c5e7404f0b452b3fa9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679071506, "uuid": "22dbbcb6-041c-49fb-bb28-68ea4ad4013c", "comment": "Malware payload", "value": "5169a0db45c2d2c8b89e378ce63b50842e6548f783ce90b3526e7537f8f24741ea2da8843379f058904cf853457b96d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679071506, "uuid": "6af92e07-1c5b-40c0-8622-e354326f1ee8", "value": "T167E64A07F89191E5C4ADD230CA269262BA313C495F3163D73B20F7B92F36BD46A79358", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679071506, "uuid": "afa4cef8-a7b0-41e4-839e-a919bb239687", "value": "57c9b357ae0cb2f414b0a5873e2f216d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679071506, "uuid": "c1949126-031f-4a7d-b433-a9e3e3b181dc", "value": "98304:F1Xry3PAhuoO1voVrJEDpXj5OyEc/4zgnqVjiQ:/bYPAQoOZoVrapz5ydzg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679071506, "uuid": "718c9af4-d581-4844-a581-7b5c3921422e", "value": 14546944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679071506, "uuid": "bc0ba463-0285-4a8a-99d3-27dfb32c05dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679071506, "uuid": "6b326dd3-72d9-4b6c-80df-264744b776ce", "value": "9e0c7bc064dcb53a222f5eed4e2eadeb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dd14a48-c4ac-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679048037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679048037, "uuid": "b56d076f-cf3a-464c-a5ba-d1b974889221", "comment": "Malware payload (Mirai)", "value": "df732555a0cb81ea823d4fe7ff2aa252", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679048037, "uuid": "9fe4a972-1f9e-4dd5-ac9e-48e958d9f1a6", "comment": "Malware payload (Mirai)", "value": "dc387244173bb28216c9cb63d88ae1ac2b5b37d7da202a53450749bcd9b15537", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679048037, "uuid": "342589d3-9e74-42a6-9ea6-8c4afc0500c1", "comment": "Malware payload (Mirai)", "value": "14aec93630d19f437ff184dd3285311b28f44484", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679048037, "uuid": "0627bfb6-f350-4f1b-9a86-ce25323cdf63", "comment": "Malware payload (Mirai)", "value": "9cf5901430ca9ef364f3cb71dc68438415d01047afe6646bfeb7c405ca4f7c3557b486ec19ad5c5e63d35a0b5b321572", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679048037, "uuid": "3a9381a4-3911-42cf-8414-280749d00e70", "value": "T1B5C2E1E63EB7395BDA250139289CCE3756B0E022D3AFA753A240824820071BCB7369DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679048037, "uuid": "7fef317f-517f-4e81-abda-8c6bdcde8086", "value": "384:Mn1DMwk8JPyGYhDZREXVZVBy6sIye1iWLRYh4Sw4cGJYeRzOFGBzd8QAZhtCsjN3:CMwKDZOFbBy6sSHRYfeAxdd87htB40NX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679048037, "uuid": "0a70508c-54f2-45cc-ab49-6bbcd2b1cd46", "value": 28056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679048037, "uuid": "28a8597b-e6cd-44cc-8ea4-2c255525f4af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679048037, "uuid": "1521ca41-616b-4406-befa-7d0e3f33ffb0", "value": "df732555a0cb81ea823d4fe7ff2aa252", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "168ab505-c510-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1679090840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679090840, "uuid": "4d1eaca6-ecf2-4270-b512-664d07bf99b9", "comment": "Malware payload (njrat)", "value": "1360cf05d2414a46b4644795d2c5f95e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679090840, "uuid": "ae7a0b12-a443-44f8-aacc-9ae1cfb5c965", "comment": "Malware payload (njrat)", "value": "dc698f6b2cfb8a2a1927b722b14e05997e7c1537885e20fc80052709bd612b9f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679090840, "uuid": "237e9bb1-4cd7-435c-93d5-cd4e35200f12", "comment": "Malware payload (njrat)", "value": "1a99092afa58814cf5c380a90c708adeeddcac71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679090840, "uuid": "7ed3f108-45b6-4ab8-915f-f72c7c19b798", "comment": "Malware payload (njrat)", "value": "e2205423b08296597d23a72905dc98521d2a80243c1ce894f3befc6b0b25ef4850283479fbd76599a4f7bb2194c11510", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679090840, "uuid": "932b7221-52d1-4a02-abdc-4b9b7fdde63b", "value": "T1EEE207067BE94215D6BC5AFC8CB313214772E3838532EB6F5CDC88CA4B676D00655EE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679090840, "uuid": "e7048026-796c-46a8-967f-69f53e7ab969", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679090840, "uuid": "9c5b3534-4746-4536-aa34-a7678b771118", "value": "384:Z0bUe5XB4e0XtOd/w0Q0mS03AWTxtTUFQqzF3ObbZ:iT9BuUi55dBbZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679090840, "uuid": "aaf40783-af9c-408c-83ed-9671430427f7", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679090840, "uuid": "81e19695-2106-4b5d-84de-3cc4400725a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679090840, "uuid": "a72277a3-0465-4ef6-b2b6-e7bb90b6ac7a", "value": "bK9t.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2124fbfe-c51d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679096441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679096441, "uuid": "2af86a74-a660-42a0-8fbc-511596592b65", "comment": "Malware payload (Mirai)", "value": "2ad80313cb1fa87dd9ee4ae18610f8ba", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679096441, "uuid": "109768ea-84aa-4e84-9b64-a45eb9e4e2bf", "comment": "Malware payload (Mirai)", "value": "dd2e377c9be625ab8efbaca19b0517f1ef01ac84df874461b5cb907168701874", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679096441, "uuid": "54067696-91f4-4e33-9937-a199f9b8c7dd", "comment": "Malware payload (Mirai)", "value": "f2639b8f3f8a649411af0be60e30ce3219bf83b0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679096441, "uuid": "6a910048-3f93-4a96-989c-6bfd16c47120", "comment": "Malware payload (Mirai)", "value": "0e1741441d8c55755d1688e0018c089a738b7e5f22e892f3cce03ba0afce4d429ed35b6af9c644faf048b704423a8028", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679096441, "uuid": "5518fe83-2680-41eb-8b5e-920b3ca26d13", "value": "T129537D36DA165E54C14A82B030BC8E747B23A2C442E73EBA19F68676D457E9DF408FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679096441, "uuid": "e124a444-1539-429e-8c5e-eb2cb34bc359", "value": "1536:satwfAY2SnXpQ7q78JkBwdgKIkUy8zA+C9SDcl8wbZnN:sVfAbqQW8s8nIRzA+NcewbZnN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679096441, "uuid": "85214a4a-cd02-46ec-9ad3-dc95d1a93552", "value": 63008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679096441, "uuid": "e584245a-7110-4262-bffa-61bdeaf0e956", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679096441, "uuid": "11bbf3ee-e435-4882-959e-a6903222c149", "value": "2ad80313cb1fa87dd9ee4ae18610f8ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd7140fc-c4f4-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1679079202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079202, "uuid": "d4b23963-33d8-4258-8a68-f82e50bc4e2e", "comment": "Malware payload (GuLoader)", "value": "d6e064a27226da7ca5ae641311ed98f9", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079202, "uuid": "149c9617-ccf6-4622-9eba-3ad5d6015294", "comment": "Malware payload (GuLoader)", "value": "dd34e911d92a68ee7ca6eda60f0028c85ec851d38ca474945d4d6bdaed323110", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079202, "uuid": "665caeac-e360-4dc2-9111-ed6428b11391", "comment": "Malware payload (GuLoader)", "value": "c2ebff65db80aa0a4e6e8f9c0be0106d64adf568", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079202, "uuid": "4615b148-2dc9-4991-af60-432740cd735b", "comment": "Malware payload (GuLoader)", "value": "bebe6a37a82603e1df35e0ddefccf3e12c5324669448ab1e8cb24eda56f9f13449a0301810f09f07836c112659d46d48", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079202, "uuid": "3e942bff-37bf-490b-8289-1dca2b2555e4", "value": "T11565C350DA1917DB0BCE165BBB710846C568CCD90E26CD2DADBED34E3D02298926FB1F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079202, "uuid": "6fb5d3a9-a784-4445-90d9-03a873a08db3", "value": "24576:yizkYHX3rUHhachC2og4DQFDVhgMBvrB9laeqH:hzhX3zeCA4DQFDV5EH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679079202, "uuid": "299f1881-bae8-4b1e-a3e1-17b1c41d06b7", "value": 1501820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679079202, "uuid": "09dfd660-71eb-4156-8e1f-5d810691298c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079202, "uuid": "4eb7e774-1b6f-4648-92f9-9dabd5c4d51a", "value": "211498792-115056-Gsantander-sanlccjavap0004-145pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "864a8c69-c49e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679042065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679042065, "uuid": "2e0dc5c0-98de-4a78-8750-82cb538aec0e", "comment": "Malware payload", "value": "364dc6c0e8a18b796aa535516d04cb53", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679042065, "uuid": "babc8cca-665d-4adc-afa7-0378db4447ed", "comment": "Malware payload", "value": "dd6f2ad2370d52c77db8f3659c116f15c1897e2528694fe9f046be45928a2608", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679042065, "uuid": "e74e9175-2a65-4ae1-b96f-7d3ff233a026", "comment": "Malware payload", "value": "da1e74c37691d9fd57eb2e73ef89b3aacbaa23d2", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679042065, "uuid": "62feeaf0-be2d-4af6-b1ee-5bb865b75b85", "comment": "Malware payload", "value": "b9e2a16e4fe4c7ad2df1caa10882360d456613d627e2b2f9f8548719710a8a74c0c2c111abc35e685f76801c474b9338", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679042065, "uuid": "b8b505a8-c333-4a89-8813-43fd48c7c40e", "value": "T1C7342EA4654F4872E208AC5DA4D47141AEB6FED330C598B123AFF031DF55AF2AEC019B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679042065, "uuid": "4cec5762-8b0f-4f2b-8c4c-4d2171ed998f", "value": "1536:i1iO8Lcs5Kpn0Ws/zhiordTpM6DiJW3BPLN4rZVzFz76mAg5eeVhMDw5wfL8:i+5xdXGVzFtr5RDAw5wfY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679042065, "uuid": "8e3edc49-8547-4df5-b570-8892b3d44ac7", "value": 248144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679042065, "uuid": "b0f3bd36-584f-4e60-94d2-f86734631957", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679042065, "uuid": "225844ed-24ff-44c6-b493-f6cfc4fbb6a6", "value": "TEPO0015922.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68aeff9e-c497-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1679039009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679039009, "uuid": "7f34aa29-4e69-4fc5-a7f9-10e5b887f77f", "comment": "Malware payload (Formbook)", "value": "7ca4248f00a77cb593f96df486195cc9", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679039009, "uuid": "ad840904-9648-4202-be02-85495e0be7b2", "comment": "Malware payload (Formbook)", "value": "ddb0973e3d088a61091289071a64617d2d7751a53dbcbb3fb3d65d88625fd295", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679039009, "uuid": "17d8f560-c2c9-4727-b5f1-5812ebc65fbc", "comment": "Malware payload (Formbook)", "value": "c2bc476339f8c35a5b49d5ee07db03f5ab12917f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679039009, "uuid": "1aea0786-c8d7-4e4d-af21-f4ea9fa3c716", "comment": "Malware payload (Formbook)", "value": "ccdc8de271d0cf1bd82111a8f526ea102fc992c7803ed2aed9f5aaf0f16cbfe185a8558210b4e433a313289a8dc15e36", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679039009, "uuid": "32cc9aad-4634-4e3c-a4da-468ba82caf74", "value": "T169F43361F05045F8B7119F76A82B3C5B5AD7FD00AAB145D9D1B80AFCCE6B6826AD330C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679039009, "uuid": "287bb8bd-6524-4881-9176-e598652dbabc", "value": "12288:I05IsretL4RniQ31L4ZKdnmuxxTBkuQTHSNBG0XKa9DtePlvibt5KJP:I05ITxqniQlL4ZKdnxxd2uYHSNBG0XJk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679039009, "uuid": "96d9178e-27a0-4186-a514-e9445fdf01e7", "value": 740123, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679039009, "uuid": "1a54d8f3-401d-4c9e-b9b0-0ea66878c5de", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679039009, "uuid": "e89e3ed1-da30-4626-a108-576c952907c5", "value": "Purchase Order.pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce81c6eb-c49c-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1679041327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679041327, "uuid": "48fe5e26-e93d-4fbd-b069-4cbac84d9f06", "comment": "Malware payload (SnakeKeylogger)", "value": "9344ffbb03925e7b8fad49b5c2309696", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679041327, "uuid": "a697d195-d962-4eea-8f43-52c76bbd4996", "comment": "Malware payload (SnakeKeylogger)", "value": "ddf534695055117a966d111e1102446be62148e55eadfcc5a01dd2b444ffc0e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679041327, "uuid": "3ee6c0b7-6306-4afc-961a-4a741874d310", "comment": "Malware payload (SnakeKeylogger)", "value": "8632c6e449db7671409389a47dae6e431d9d0962", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679041327, "uuid": "faf4a5c9-13d4-44dd-a0fd-7236b12abb68", "comment": "Malware payload (SnakeKeylogger)", "value": "729bc4295dc82c1159834f1879e29f33e9cfb0971be11deddced009ee343ac6c0e71a6e58b1379f2038af78d1c299825", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679041327, "uuid": "db69a781-1c59-4a72-a14f-e32aac31a4f9", "value": "T11C05025DB716EF21C67E97FEB031246193F3981EA325F3985DDE64EA3A62F81040094B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679041327, "uuid": "1fa6ff9a-883f-4a84-adca-6f7ba3129693", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679041327, "uuid": "70b46f4a-eeb5-4968-bc07-971035b4dea7", "value": "24576:wjjkj+rM/Mn1d9HPSYrtXs94hF2AkBVm8K:wjjkX/etPS+OAkBEP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679041327, "uuid": "fda75020-37bd-4fe7-af3b-e4f7781e03dd", "value": 823808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679041327, "uuid": "fa0cc061-2516-433f-9af8-128eae0344f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679041327, "uuid": "81790f0d-eeec-4750-8847-a9849629a704", "value": "Vessel Description.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e421f53e-c4aa-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679047376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679047376, "uuid": "3bf69a38-7bac-4850-b30a-386fe4099557", "comment": "Malware payload (Mirai)", "value": "ea30db681403f6277c73f99678d1360d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679047376, "uuid": "cfdcf47a-3639-42cf-928d-30678c4d86d3", "comment": "Malware payload (Mirai)", "value": "de5e650e9a7ad4c462d772c4e658c04ebcceb7907438d83379a3edea25578bf6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679047376, "uuid": "ccd95832-5d82-4a6d-bcbc-74bd3328697a", "comment": "Malware payload (Mirai)", "value": "38f1cd8b5c330cd942e18ee7294f0baf09853b01", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679047376, "uuid": "5ad0bf9b-0c0b-453b-bf7c-7196d1c7b703", "comment": "Malware payload (Mirai)", "value": "2e31a0df735fe3cb50466e75f8bab0a2d166f63736f10aceb79767bfea153e9f231737feff6bba96fe7a47bd801adb8a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679047376, "uuid": "198aa251-ff09-409c-bdc9-ee39a3848e6e", "value": "T1B3330A9AB8029D3CF90FE6BE54164E0DB93177C152830B2767BBFD936C721A45E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679047376, "uuid": "23d46be2-7b8a-4a36-a3f0-000a302318fa", "value": "768:oBCP9hTzoEWRcqOCLu9UW6xe+Tm806Msq3zkHQXOZrupiQGg:TX5qC9wxeqm806M9kHQX0ruig", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679047376, "uuid": "97b5fa2e-6ab0-4b3e-9969-4efa564acc93", "value": 54928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679047376, "uuid": "a5a73bae-cbd6-4382-9687-90997cbb1356", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679047376, "uuid": "4a56886d-6189-4eb2-8d25-845afb78e2b8", "value": "ea30db681403f6277c73f99678d1360d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d1e3d93-c4a6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1679045459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045459, "uuid": "cbea4bb7-abd6-47fa-83df-46c0504c6d3d", "comment": "Malware payload (Gafgyt)", "value": "9b50da1e7e8c9b7b86d0bac72e89fe96", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045459, "uuid": "440151bb-085b-4d05-bf28-999fd638ea29", "comment": "Malware payload (Gafgyt)", "value": "dea2aa7070da8ec6338d28e8ff0543fe4ff02dd57e1a7b07cf42573c8ac5fd9c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045459, "uuid": "4ee00264-4dca-4611-a896-704781ae9380", "comment": "Malware payload (Gafgyt)", "value": "e8b04e9f55e550ff5e350962127c3250eb14c1f8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045459, "uuid": "d13d7272-b9c7-4c58-8584-9c5e2aa48764", "comment": "Malware payload (Gafgyt)", "value": "4baf228c4011915c447002a91d390dbd043d598220d3878fdc28db8ed8903a23a36ebc563cc52a6a402f2235126458c2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045459, "uuid": "5df892cd-b12d-4834-96da-373941e2b81e", "value": "T150B328436B1C0B87C49B9AB01DA737F18B69BD7112A351C9A90BFEC04733AB81527F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045459, "uuid": "65cc660d-78fd-431c-9818-24f375a051ec", "value": "3072:WD3l+XQzPeV91310pWudUKakpNDtm2pgYMidIP1W:WD3l+XQzPe713CpWCUypxtm2pgYMidIQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679045459, "uuid": "5aebf214-0080-477e-8c99-2577f90bf5de", "value": 113194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679045459, "uuid": "d27e2e51-1ea7-4fe3-b630-9cd96ec7635d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045459, "uuid": "cac48424-9ed1-4c4b-82d9-c4614b36a4c8", "value": "9b50da1e7e8c9b7b86d0bac72e89fe96", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57290173-c497-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1679038979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038979, "uuid": "b253ab43-4457-4822-ba84-f9f70d1b4bc3", "comment": "Malware payload (RemcosRAT)", "value": "19bb6546c825bf116ac5713b8a52c546", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038979, "uuid": "67e78197-550b-4efc-80d4-0f20f26257b9", "comment": "Malware payload (RemcosRAT)", "value": "df98e5b50efcf7aedf479030e51ca5b9990fad9f0d20d729bb106198ddee923e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038979, "uuid": "5293ad28-e21a-42b6-a0df-d7f634f27d6c", "comment": "Malware payload (RemcosRAT)", "value": "ea156592bb02777f8873e089acea166364c5ea65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038979, "uuid": "9803c597-8ac4-40df-85a7-65166061a253", "comment": "Malware payload (RemcosRAT)", "value": "b49ce4fa5f30a266e3eb2938d022e09c161e2a1a9c714bb34b2a94623e2a85af427119d10db4618483e77013971de6b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038979, "uuid": "10211a54-17b6-4fff-9387-88d6ba060da4", "value": "T1EB3518025FE88E17E5FD17B9F86608D8A6F6D44B5D1BFF0B410128A90D987DE0C9239B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038979, "uuid": "85665da9-bdc1-4bc9-8a0f-4a8c7907224c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038979, "uuid": "165310d2-392c-48d5-97ca-b8449a2c1f26", "value": "12288:h5fFA0nE4hnR6aQdLOxd17b9r6hGBGhcS0+YL5mmklrbwh2n3wX6bnf9uB/GjAls:hfxF5QyxdV9g0ljerUggKTHRvF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679038979, "uuid": "7d6c7123-6e44-4960-9c4f-702dd930ab5a", "value": 1137664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679038979, "uuid": "bb4d2d76-1749-4b41-b87a-83bf82b070b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038979, "uuid": "304a21e0-3343-4de8-8bdc-9c0181333572", "value": "TELEX RELEASE BL +COO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "379978cf-c471-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1679022606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679022606, "uuid": "183530ab-254c-4702-831a-fc6350c3647c", "comment": "Malware payload (Rhadamanthys)", "value": "0fa551d62828473aaff743ecdc500a9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679022606, "uuid": "9aa16f69-b022-475f-bdca-fc0be421fecb", "comment": "Malware payload (Rhadamanthys)", "value": "dfb1707c43b702b1e42ce3ded92929aba1ba5a4e58541da459497a3b35a27490", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679022606, "uuid": "5ea00714-4902-4192-8f66-ef15be455fe5", "comment": "Malware payload (Rhadamanthys)", "value": "3f89cb13c3a70e65ee631182f5826dfca806616d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679022606, "uuid": "1c1364c6-8073-449f-9f15-3e5682daf8ff", "comment": "Malware payload (Rhadamanthys)", "value": "4413d1a5fced7cc84934dfd8da7e47ee32b9350d405afa9b650f8929299708dbf43430fe09c0b23917bf257252860d40", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679022606, "uuid": "dce65e9e-3e66-4180-a21c-fe54cd2e4c5f", "value": "T16D34CF4383A57C60F52687729E2EC2F87B1EF8138E79AF5723146A6F08B11A1C56F351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679022606, "uuid": "8a57b3f3-b0d3-4c6a-9d1c-ea4853f75205", "value": "4b2faf5e2157c756cf2fd31d6cfd3d44", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679022606, "uuid": "f9990b22-3da7-4f30-8822-df92898d5c23", "value": "6144:JrqrZzeOqSGgud1gtSPQO20K463ccpwhhvJ:JrqrpLGgS1TYO203S/pu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679022606, "uuid": "6a60f051-c9cc-4c5c-83b7-9409cd7a8e26", "value": 251904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679022606, "uuid": "28895379-a264-41e3-b4ad-2944bca33835", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679022606, "uuid": "afc83b0d-4302-4101-a22b-73836c15cc86", "value": "sample.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6132fb10-c49a-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679040285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679040285, "uuid": "63b5be26-6921-4573-b6bc-b3f83806da0e", "comment": "Malware payload (AgentTesla)", "value": "88517f571f00bf1fe37519a258243d04", "object_relation": "md5", "Tag": [ { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679040285, "uuid": "15757d74-3adf-44d9-b504-695c354214a6", "comment": "Malware payload (AgentTesla)", "value": "dfb670e4148832b572b17ca5f5de373158e47c05c76d0fb62483aaabc9e3db57", "object_relation": "sha256", "Tag": [ { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679040285, "uuid": "ee40bd13-5be0-4b89-bb1d-c9c990ed1867", "comment": "Malware payload (AgentTesla)", "value": "6d8ea51dae0c3d30f697d42c149f517901f530e2", "object_relation": "sha1", "Tag": [ { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679040285, "uuid": "faaffe3a-c041-40ac-aabf-afa09e1efcb4", "comment": "Malware payload (AgentTesla)", "value": "0bbe50dab8e210143ed41a6f814f5aebe1c978d401a9b9a91ae479cc48250e84f47a1fde24d629d8e099d5660ffb556d", "object_relation": "sha3-384", "Tag": [ { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679040285, "uuid": "fb60d286-4463-4e67-b0be-7c123fa2623e", "value": "T1DD942333E8893F2C19A1503A1875C66F8F92EADCD82E9514ABB170400A7D6219FFF25D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679040285, "uuid": "57c1bdd2-ef07-45f9-bb3d-2dda6e8ceaa9", "value": "12288:+jlpMl6Sx4yR3b4ZFXiobnRqv4D86RV35H4CJ4XrQgK:+r8x4y98fBTgvMRV3/J4cgK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679040285, "uuid": "8f2196f8-7607-43ed-bf12-582c287e8316", "value": 446968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679040285, "uuid": "c5870caa-8549-4ed7-98e2-574a7cea8c64", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679040285, "uuid": "86a1d479-27d0-4cd1-b51a-66a3b29cb3e0", "value": "NOTICE.r09", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "314f1686-c4a4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1679044499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044499, "uuid": "ee50f9a6-82af-4ad7-8815-aceef0c8d4b1", "comment": "Malware payload (Gafgyt)", "value": "dd2564f045f88bc798e0cb3d17b55285", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044499, "uuid": "bfbe48bc-80e5-4994-bfc5-f704e96c3e62", "comment": "Malware payload (Gafgyt)", "value": "dfbc5ea6b020b75ded2b8440175f45f62576ab15c590d203e89530a5890c7814", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044499, "uuid": "3b64e700-4014-47a7-9052-ca18bfc5c9fc", "comment": "Malware payload (Gafgyt)", "value": "1e4009174898b28f1b97b914c71a754deb2fca6f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044499, "uuid": "8ef2d1b0-2281-4849-97db-b01d6811426f", "comment": "Malware payload (Gafgyt)", "value": "233951f083d50ba1706ba353044143c0f3ec9f024ee644013c79f50cc5d237b41137d3c34bb205767ddf059a688a7212", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044499, "uuid": "b50ec207-4570-4626-8864-905937a5c32e", "value": "T1A7A31941E9409B17C2D327BBE7DF439D37366A5897D733016A257EB42BC2BD82E29120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044499, "uuid": "9f4dffdf-9327-4e76-8ff2-4d88e36ed67c", "value": "1536:K30hsLhHgaU8SJK7NiO6SZiC84nkvPs7c7TKFkffYsAXAcyUm80rQANFlAfi5S:2hAA71Zu5Ps7HkosAwXUm80rQANHAfi0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679044499, "uuid": "dc8c4b6b-9fae-4d4f-98da-63f792fca973", "value": 97794, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679044499, "uuid": "e6b271e6-66b3-4924-97ad-368464cabf15", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044499, "uuid": "5f9c6b58-3c73-4134-ab09-8829f65df31b", "value": "dd2564f045f88bc798e0cb3d17b55285", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8b74dcc-c4c9-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679060699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679060699, "uuid": "88ffa431-e3fb-4b9c-ad71-486466a24ec0", "comment": "Malware payload (RedLineStealer)", "value": "e249855052738c5484a946ad314ad1f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679060699, "uuid": "85dc403a-fac3-4b29-852c-4bf223ea6798", "comment": "Malware payload (RedLineStealer)", "value": "e00decf086c5846079185453b0a458754fdf4fadcaf8f5adf44bfa525e16fb0b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679060699, "uuid": "cf356782-fe27-452d-af14-b2f7d8ec60e8", "comment": "Malware payload (RedLineStealer)", "value": "dc2aed0a1d81741890730135e2cfa499caf22d7a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679060699, "uuid": "f3e623c0-d2b1-4092-94aa-6a304190ee3d", "comment": "Malware payload (RedLineStealer)", "value": "348d7688ff9b3fa66ea02807ebd25b06f1ef2b89a426dbf6027895abcedfff52c75a58793508c26960e6b95f97538636", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679060699, "uuid": "45ef886c-555e-41ac-8fe9-4d8b8a07a790", "value": "T14844D538261442E4E4BAD83C2D90B4D070BA7533EB87B8FF5E1D3726963519F74A067A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679060699, "uuid": "6b023813-fa63-4810-ab76-da898bc6e303", "value": "0c901bafc3dc9a701eb7d97dcf772d0c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679060699, "uuid": "19a74823-d5b8-4927-951f-e419bc7af607", "value": "3072:3O0epf+oylvqIAhDYXFBJVOFzlWl6+KD8GslmTxIv+0/ECJB2DG/UhjN:3KtkAh0VBCFzlZ+JGsW+N/7o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679060699, "uuid": "124c6bf4-3ad6-4439-ad6b-a30114e8ef0e", "value": 263576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679060699, "uuid": "8440952d-16ab-4d66-b379-cf674d819bf8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679060699, "uuid": "a628896d-85ed-4b85-850c-6b4ac79fd82f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c9d605a-c4f5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679079227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079227, "uuid": "7be87385-ca00-4910-ad43-7a37af2bda14", "comment": "Malware payload", "value": "66fdf2df4fc8601124df76c284f797e1", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079227, "uuid": "bd5d4df7-4ff7-4d49-91a2-d659b83972bc", "comment": "Malware payload", "value": "e07a149d14fc37367e7331342d07dc45aec9ef7bbce780ea636c5d04f6c26f3f", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079227, "uuid": "2c2c6f6b-cae4-4c01-bf0e-2aa0c098b156", "comment": "Malware payload", "value": "88031f2f9bfbf3eb0b069c68fd4ed4ee288daf9f", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079227, "uuid": "1019fd0d-77b5-4448-b95e-85907d9f2c19", "comment": "Malware payload", "value": "2cfe334a8e39f711c3045f07d711f882038f2dfd0634c9a614921256ec5786ae810b863793dd9d0cb989fabb312d7fac", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079227, "uuid": "4632e0db-4fd2-410a-911d-29ae0aaaa98f", "value": "T14715CFD7B845528CE9B99EB3712B1C2213701FBA662C104D76CC329D09FD1627EDE86E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079227, "uuid": "21fa8b48-0e57-4fc5-b65e-8fe03f14697e", "value": "e9c0657252137ac61c1eeeba4c021000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079227, "uuid": "3c181102-0765-4ab2-bc96-40a075161c37", "value": "12288:AwFjJnKlHcG+glWs89TbTjb8E5UcKcZnY4UKwp7hVOZCbgjvwhaD:A6jklHcGtlF89TbfccUNEZCbgjV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679079227, "uuid": "8ac87eec-0e2f-416e-958a-6e067cc9ead3", "value": 888192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679079227, "uuid": "1e2b1ed1-64cc-4adb-898b-9de0fb45e151", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079227, "uuid": "dc543d37-3b7a-41a0-927a-f70e0057e3d5", "value": "DHLIN00178.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cb06171-c45a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679012682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679012682, "uuid": "eb6d55c3-b81e-4eb6-8d97-2a418dc10685", "comment": "Malware payload (Mirai)", "value": "c76cf9006da4f0864f89c92f1d9cb146", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679012682, "uuid": "11662634-6107-4049-a8e0-87092dac6f4e", "comment": "Malware payload (Mirai)", "value": "e0cf13faac4dd7580800885cf59acbeeb6a3e488d6ac0d16f4cdf1515b4c8b53", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679012682, "uuid": "101ee617-0f30-47c6-8970-7fe9e6c3c49b", "comment": "Malware payload (Mirai)", "value": "047eff1e35a3ab15aacd9e2d652e7d67b36ecc9a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679012682, "uuid": "819ead69-bc44-4654-8568-baf9fde81688", "comment": "Malware payload (Mirai)", "value": "958e5eadd7370c99902c78fbbf0e7ffa5f39e0a86e1b4a4dd92061aa2d4c1b2a75d2bfd6ba0c513f6ae2fb8294a570ac", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679012682, "uuid": "18c6e2a2-6228-474d-b011-7e8f24ec44e8", "value": "T15EF2F12C390350F8DEA1C53D0AF4CBC82A601F1A7613FC4BABAAD59FC8844BAD1576C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679012682, "uuid": "f675469d-9e93-45dc-be11-ce515527f34c", "value": "768:eho+OxiYB2AdxA5Z1341eLmamH34ZCwzYatOT8JgNJgGlzDpbuR1Jy:eux5d25UcmX4Z1M8pIVJuk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679012682, "uuid": "3453ee9b-0541-4d6d-9563-10ac12cd1cf0", "value": 36640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679012682, "uuid": "f7e4f6c7-1110-4020-8f39-80d557684dd5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679012682, "uuid": "5a5ce772-5be7-4486-856d-fc292d216e56", "value": "bok.mips-20230317-0024", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "261fbf99-c4eb-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679074975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679074975, "uuid": "7d2fea31-0fce-4eb4-9568-4bf436be15ee", "comment": "Malware payload (RedLineStealer)", "value": "e2651400728b61f8619d871bb82e6ad4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679074975, "uuid": "18292c03-ff70-4fb9-9734-87f22d0fe82b", "comment": "Malware payload (RedLineStealer)", "value": "e1215cc6709ce76ed5c1dd8af05107b036670cc5bd3fd414ebc981e71f323355", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679074975, "uuid": "5c49aea2-5340-4b61-8b16-38e4e7b02c55", "comment": "Malware payload (RedLineStealer)", "value": "d4e558237976d5639f233d555fe31688b2af60d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679074975, "uuid": "6c00160c-bd05-410c-8da6-55124fc71e2c", "comment": "Malware payload (RedLineStealer)", "value": "5eae53a3913f814c7285e3934145f0a6d47e975dc6b56d0e644cf65d97f4e5ecf106ddec10b79a1e63f9723862a89816", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679074975, "uuid": "8a764df2-1874-44a6-855d-fc8f19882ace", "value": "T18744D638261846E4E4BAD83C2D90B4D070BA7533E787B8FF5E1D3726963519F74A027A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679074975, "uuid": "e14e9608-c616-4365-939d-93497e2c5007", "value": "0c901bafc3dc9a701eb7d97dcf772d0c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679074975, "uuid": "f2b13d1c-3a6b-4707-aa45-01beefeb5696", "value": "3072:h11B1q3yuvqIAsKYXtnBAo39tB66rGD8GsZmT/2UBu8H/+jN:hrIAsP9ao39K6rFGsZmHHG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679074975, "uuid": "26499325-9025-49ae-bf8e-c7a5b09ecc5c", "value": 264088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679074975, "uuid": "6291774b-ceec-4b69-b301-51928ec3f1b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679074975, "uuid": "e395c318-b644-4624-92bf-e356e8056de5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "531f1cb2-c497-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1679038973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038973, "uuid": "ac3fb97c-6bea-4328-b033-49f1146b782f", "comment": "Malware payload (Heodo)", "value": "0a7329865a1ca2b01ab193ddb30331bd", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038973, "uuid": "6cd7ee01-ca1d-416a-87c6-b32a09445879", "comment": "Malware payload (Heodo)", "value": "e182025061a8eedb066d78e6f7d6bf1bc7109e9e447cec28996df871f284c8a0", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038973, "uuid": "cd685ea5-ee95-4751-a30e-0034336de880", "comment": "Malware payload (Heodo)", "value": "89faeaf718460b64e2d078c780fa734aadc3eaff", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038973, "uuid": "a8814e1b-2eb7-46e3-a5f4-ea4f41cfb2c8", "comment": "Malware payload (Heodo)", "value": "c740f1ef54ee719bfebe0dac811acc9457b9e41906ac1b9a99530be5119d9395f4291bb29089a1c1b3e78dec3b5a9ee1", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038973, "uuid": "bf100644-539d-45df-bf9e-cf8eb1be1835", "value": "T1E9C32BF1A8025C0AE123C976B1FB661399D051ED42283B2BF87D507DD978A20D6DD8EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038973, "uuid": "864b5dbf-8531-4dd7-9b7d-ff557f745528", "value": "1536:RDBoTVdaeNtuXndCrJJmT4HVnteV4FrdMiYcx7bfCb6HPdnXD:1BoC+tCYvSMVnte8ZP1Y6JT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679038973, "uuid": "065da6a5-e6d0-44fd-a927-5d88b2c568b1", "value": 120428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679038973, "uuid": "a22b5769-dfb7-4535-a28d-164c70dd468a", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038973, "uuid": "21e2608b-6b27-4245-bfc5-c861e9ba243a", "value": "Insight Medical Publishing_2.one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77470d43-c473-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679023571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679023571, "uuid": "c5948413-e157-497c-9472-2a52a44d2b4d", "comment": "Malware payload (Mirai)", "value": "1811c02b18ef5aadc015e19ccb0a6750", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679023571, "uuid": "3d207d28-1a91-4f25-90c1-e0581cff89cb", "comment": "Malware payload (Mirai)", "value": "e1ca82938e1b99c85261a501064faf45f8ae8f6818cd2a30a1535fdcac510d19", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679023571, "uuid": "91c6c0de-cc8c-4531-ae7b-dfa7d37177a6", "comment": "Malware payload (Mirai)", "value": "2ce560e43da399e1fdc8ae0f0f587738b5caac78", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679023571, "uuid": "220aa449-ea51-4b8a-87dd-26e3688f2502", "comment": "Malware payload (Mirai)", "value": "19292b8c20aa9b500c340bdc089ab73884d39c45a43bdeac6e3c1eb0313b2dcc5a1419f390407e3cb550a2e6ac874297", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679023571, "uuid": "18943f2b-c72e-43a9-b15b-8728afaac6f4", "value": "T1D3437C3AF0151DB0C95210B8F66CCE344F12ADE492A12CB27FDD49E548B762DB44DFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679023571, "uuid": "822bce55-0723-412d-88d3-0eba3e8c9428", "value": "768:M/17lLEFQu4ovw4tiOdb9mNGGaNa0z9aeZVc2Y/P6NHAV5LVJg/A3sAQ+w:SRlLEfhXiOua3Vi6NHiJ8P3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679023571, "uuid": "e2f48e85-e46c-44bc-90d8-7a54f8dbc013", "value": 57972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679023571, "uuid": "fe19760f-2631-4d3e-89a5-4e2812ccf64f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679023571, "uuid": "32114188-8263-41fd-9c5c-6e6571e23173", "value": "1811c02b18ef5aadc015e19ccb0a6750", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fa10bac-c46e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679021411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679021411, "uuid": "873ccb6c-3a2c-4082-aceb-f9c0a502796c", "comment": "Malware payload (Mirai)", "value": "5722f74324b9b128bd2b21dc76a36316", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679021411, "uuid": "7fd0ce3b-8164-4256-b4fd-89ba5677ad28", "comment": "Malware payload (Mirai)", "value": "e1f084566c57a83ba6179c6738908ccfbae1c8c0e389a0f1011095d3ec180bbd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679021411, "uuid": "14ed8f8b-3776-4559-93ce-2b306cac0a3e", "comment": "Malware payload (Mirai)", "value": "22e84056f0a89faac70032ab808f66b2cdf5c101", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679021411, "uuid": "cdd860f7-9218-4416-89e6-128e2e9c04d5", "comment": "Malware payload (Mirai)", "value": "de2f5505d9f0e01d95ba1ecb3266539a33bed2d55713a627ad91e05ddbb962c12afdd9c72348fdaba4697e8ef0419dbd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679021411, "uuid": "87031697-6fe2-4ec6-b02b-983e919051d8", "value": "T16AE31A56EB414B13C4D61775BAEF42453323ABA493DB73069928AFF43F8279E0E23905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679021411, "uuid": "a2b7a2a9-f455-4b11-aebc-b40888854f62", "value": "3072:CW2gksHLoGSaXwGrW9Bfv/xya9BpWrISYo1M/9bTNo:CW2g7SaXwGrW9Bv/x3YrISYyM/9No", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679021411, "uuid": "2cf49f41-7ac6-4ce8-8356-254fb3db29d5", "value": 146122, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679021411, "uuid": "2d181ae2-f045-4f8d-933d-43a82f95bb4e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679021411, "uuid": "ec60c573-b636-4281-b964-42c2843675d9", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b66d5440-c4ac-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679048159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679048159, "uuid": "7fd3a904-fe8c-48d8-bced-a7a39db17206", "comment": "Malware payload (Mirai)", "value": "ed58c74be1eaba7b1b79c8b8eff0db81", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679048159, "uuid": "d61fde3e-02d7-4e5b-b539-ef9ba8e521d2", "comment": "Malware payload (Mirai)", "value": "e208daf5984c600dba638e2794acb6003443417e0dfed3bde77ce87b70f6089a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679048159, "uuid": "e5e09348-b33d-433c-881f-56a77dcd3492", "comment": "Malware payload (Mirai)", "value": "67d8e51c3a857d5a88857b977c5c37f823e37671", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679048159, "uuid": "f01e7b33-27f7-4189-a459-77729a496fe0", "comment": "Malware payload (Mirai)", "value": "0db8c6f25b76cff36907dd96d073c647bafe2e6fb2f420904f81911482dace2599686f1b4a31d225225b9e381a353fa3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679048159, "uuid": "c203d5b6-ab6c-4dc2-bc7d-507178a556b0", "value": "T1B2431845BCD19A12CAE4237AF92E41CD372523E9D1EF7217CC112F10778A82F1EA7A56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679048159, "uuid": "3f01e7a1-89ab-4e64-8dbd-d53bae9e10c4", "value": "1536:D9PcRxxfdqcicMnroYVbJiYOg19Iwwh+1gAL2i0Zec1aRQFO6:DhcRxx1wwEr2itTQFv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679048159, "uuid": "fc41b33f-9b47-4bf9-97db-98ea4a3f9ed7", "value": 58432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679048159, "uuid": "3b056a28-753a-4ae2-9684-6745911a1d66", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679048159, "uuid": "dfa32fd4-7731-489d-a9f4-3d8bace80e32", "value": "ed58c74be1eaba7b1b79c8b8eff0db81", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77302427-c4ac-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679048053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679048053, "uuid": "3efd1bf6-3ea6-4f08-a43d-d51aacc7e0fc", "comment": "Malware payload (Mirai)", "value": "9b0dce4876fafe6f5874433889fd92cf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679048053, "uuid": "c0828d74-906f-45dd-bcce-e4a35f0f21c6", "comment": "Malware payload (Mirai)", "value": "e28750f7b3e92717a2502ec9e24fb568b518d0fd4283212c9593203bf5489492", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679048053, "uuid": "c9eff435-13c0-46fe-849a-77a393ab3a54", "comment": "Malware payload (Mirai)", "value": "2a41b4e12e6bc39b31e2037c6313696702785871", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679048053, "uuid": "41d6dac4-90c2-4d22-a2b5-1944b2300c01", "comment": "Malware payload (Mirai)", "value": "9695b3ac79ea226d68626e3e9b7a34b84383fcebe0b74f2ec488b8f75007623317afb970f899285d28053c14e5d02cfc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679048053, "uuid": "3ad8db9c-0df4-4bf4-bc9a-343534c0a8f0", "value": "T1C2735D24A9792E26C0D4A17B61FB8361F2F6230E2570D65D7C760F8FFF2464468162B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679048053, "uuid": "45d58dca-c3ed-40a0-864c-8e486cd37b62", "value": "1536:5ms+geQfvznpCR8ee84cNsAUiAvFI7IlNnws8V:YwfdNu4cmZvFqI3w7V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679048053, "uuid": "85359a4b-4d04-49c2-a692-2b96a8b11e77", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679048053, "uuid": "7e30302c-f5c8-44e1-b674-6315cd67533a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679048053, "uuid": "ee8886c5-c3f1-43cf-a0a7-c425be2f9c64", "value": "9b0dce4876fafe6f5874433889fd92cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "557d403e-c498-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679039406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679039406, "uuid": "6158b56e-5c20-481f-9010-ee17ed74a568", "comment": "Malware payload (Mirai)", "value": "ca7efb0bf956ec2e32b57c8bcc41800c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679039406, "uuid": "62587f15-33f9-4506-baa1-4d4b1cbff64a", "comment": "Malware payload (Mirai)", "value": "e2ff90f5bdf51da577be88266cc9dc8be48f1776af46949dcdd2d54e4c84449f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679039406, "uuid": "b56026c5-e5fd-42b6-b4ba-f0a0840ba58f", "comment": "Malware payload (Mirai)", "value": "36ab91b455da32b9917c3ff855de2e02d719a128", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679039406, "uuid": "478b76b4-3898-41e0-bf85-726599774983", "comment": "Malware payload (Mirai)", "value": "ed2163f1ad92518800ca3376793d346d55814d540569bd5f7cc8771eea961cc2743c4687c6d1cef014d340584ca68461", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679039406, "uuid": "65f6117c-052d-4a71-9b0b-fe3764821a84", "value": "T16A3339C9FA53DCF5DC570170207AEF379E32F1E52218D653DB759A32AC52A01EA06A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679039406, "uuid": "1de01f9d-f7e0-40ae-a51c-d5899b9415dc", "value": "1536:v/+4zLw36I+rSHPfxUGCVdox1WxcKnLpYHhrIx:v/+4zLw3mmvfxUjOrOTLCH2x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679039406, "uuid": "d0f60eb3-fc62-4e0e-979d-a5590f0e4f9a", "value": 51504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679039406, "uuid": "da105283-af27-4b93-b5bd-b3e26d3d262b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679039406, "uuid": "22cf199b-8c63-4270-bfbf-e60fe7a31890", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2724cad7-c496-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679038469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038469, "uuid": "6195cc58-f4e6-474d-a838-c3becada08d5", "comment": "Malware payload (Mirai)", "value": "51b453470f05bf4d976ce6f0f95629c4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038469, "uuid": "509add92-6bce-48c2-903e-ca4799d9197d", "comment": "Malware payload (Mirai)", "value": "e30c20c5f331d5699c26502c253313ecd26d39643664bf4521688a43f126cd8b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038469, "uuid": "4ef7d6ac-da84-465a-b8ba-0dd4333378ac", "comment": "Malware payload (Mirai)", "value": "45dc95762ea61ebe5a28c0fb5995b0d539013516", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038469, "uuid": "2c9dd9ec-7c4d-43b5-a816-7a73e7d1f1b1", "comment": "Malware payload (Mirai)", "value": "e452933eaeb0dadab5bc56e760c7aa62c3b4dcf28408e467453f0b746d9a40623dfd2b52a9baa5b65e60819cff6d9916", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038469, "uuid": "2088ae38-575e-4230-ad6e-5a200fb9286e", "value": "T1EBB31A37A61C0B43C09B55F02DB77BF24F69AEA313A611C46609FEC04B73AB22551F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038469, "uuid": "c7b12e90-b194-44b4-9f24-7c73622769a4", "value": "3072:pC/4rdZHsXsZwwR9NNk5mm/QcuLmHniPNb:pCwrvHwsZwY9NOmm/QcuLmHniPNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679038469, "uuid": "73c5c5b5-c44b-4eae-8d36-934f5db4f950", "value": 116786, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679038469, "uuid": "8ceb6666-44f8-402b-a5fc-d86ed7067d74", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038469, "uuid": "6a9b0412-a969-4dce-a061-f9e2a89fa751", "value": "51b453470f05bf4d976ce6f0f95629c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aff8cba6-c4d3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679064898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679064898, "uuid": "5321109b-0ddd-4649-b2bb-03cd353d9fa9", "comment": "Malware payload (Mirai)", "value": "8a2a388faf9043795a9b99a3e343bd55", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679064898, "uuid": "7b8184dd-65e0-44bf-91d4-c8e953adad3f", "comment": "Malware payload (Mirai)", "value": "e38f675691bded7a67ffeed5d350d6a0580d841f676f728be769c4358886105e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679064898, "uuid": "4b0ad1d5-5dac-4255-a287-e73a8a13934d", "comment": "Malware payload (Mirai)", "value": "faee179cad66ce6aaa12964694e41b9cfebb070a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679064898, "uuid": "c05bfb8e-9bda-4f8d-a4b1-a0ddf1bedb07", "comment": "Malware payload (Mirai)", "value": "a1d349623718cf1d2a7f4b1c9e8ee92ecf535c7d2fadbfc3c35cc29484d5e581f93e601cc86687e9c99556a84d04fa20", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679064898, "uuid": "a094b340-907c-4bf4-867a-ba8aa0647afe", "value": "T1A4336C36E029DED0C6560134A4E88F751F03F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679064898, "uuid": "22dbdd26-6a8f-4026-abcc-11662a6f12db", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679064898, "uuid": "76434560-5dcf-472a-8e5f-43bdfbd00ac8", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679064898, "uuid": "1bd7dc81-9f0a-431e-948b-93ac3bdc98f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679064898, "uuid": "68b3a0a6-98fe-43bb-b549-925bae473f70", "value": "8a2a388faf9043795a9b99a3e343bd55", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfb8e97b-c468-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1679019022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679019022, "uuid": "196de2fa-073f-404e-8f2d-be2e9b182fd9", "comment": "Malware payload (RecordBreaker)", "value": "6058ca6e0130b3bb6511f9ec87df159d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679019022, "uuid": "3acee4ef-2a32-4eba-a2cc-eaf7c5b630d1", "comment": "Malware payload (RecordBreaker)", "value": "e3fd5355b2d76223c6572072200904db0f4dd431961e10d01e482e8546e93cba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679019022, "uuid": "d9ee695f-8577-4dad-9daa-de6a0078c3cc", "comment": "Malware payload (RecordBreaker)", "value": "eae17c31fdb584728568e08d4f4e0e5161e7c2a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679019022, "uuid": "7445c945-b34c-4b8e-a4bf-3667d831ba25", "comment": "Malware payload (RecordBreaker)", "value": "ee0d09b19cf2dbb66cc7f2b81ca072682bb2af7dfb75cf26b0b6312e2653a52d0e77b8d729651e4d50afdb17aabd27f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679019022, "uuid": "1cd99c04-e834-4591-9b4d-2c5c737ba746", "value": "T16DD6336317A95181E8958C3B8527BEC8B1F23E775AC0F4BD2986FDC50A376A0F146E43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679019022, "uuid": "30a577a3-c9b2-4731-9831-328b556501dd", "value": "a9168cc43274820afc74b8e42a968652", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679019022, "uuid": "373cf9d1-b15a-475b-8814-98f2b6a1bed2", "value": "393216:uZ0xUYtWHm3VeSqN1muvlAmuprNbt3AcBAQ:W1g3VeSqyubu9Nbt3AcBAQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679019022, "uuid": "4a8c878e-10ce-4a46-8e40-17eb1007e4ef", "value": 12678656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679019022, "uuid": "bba3dc54-f579-4e0e-aa91-78781fdab62c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679019022, "uuid": "8c9ac10f-7ede-4872-b13e-4c0fd90cd615", "value": "6058ca6e0130b3bb6511f9ec87df159d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa1fc546-c495-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679038394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038394, "uuid": "34fbab2e-fc2a-4976-88e0-596f05631dfa", "comment": "Malware payload (Mirai)", "value": "2c9ade381355324707783ee8afcbc4d3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038394, "uuid": "3cf7d265-3136-4eaf-ade7-698268a4b723", "comment": "Malware payload (Mirai)", "value": "e43b14124352f780afcb24d06bc658d260602896a885ad7eecb2f4fdb85000cf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038394, "uuid": "7b19fd38-52df-4ba2-bc46-e1e127568614", "comment": "Malware payload (Mirai)", "value": "9a6424aa0e40321b1505d0f0dc36a65710b39c72", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038394, "uuid": "db4bbdb4-a372-4b33-825d-180bddaec248", "comment": "Malware payload (Mirai)", "value": "123333524ffeaa509a29aae2d14d898e00afee7868af53e39ca71f26a754674b7b61e7998a59d89852336e3103002075", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038394, "uuid": "a94fe5c2-5eda-4555-80f1-a246737aff5e", "value": "T1A3C3E730E8044B1BC2D223F6E75A869E3F351E9797A733155B3879B02FF27991E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038394, "uuid": "9d0a47e5-89c8-4d62-bcac-d55f12ec2674", "value": "3072:4jDy/+mh1vtbPIKaRbpcUPium7/L7QsvmGfIiNb:mOJ1vxfaRbywm7/L7QsvmGfIiNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679038394, "uuid": "ad92fe7f-09d2-4da5-9af3-77d33e76a8c2", "value": 125008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679038394, "uuid": "0516b40b-7ce0-4675-8f95-ef76af9bc145", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038394, "uuid": "c633073a-2560-4e15-b5b7-f49b34a4013d", "value": "2c9ade381355324707783ee8afcbc4d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2df0a07f-c4a9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679046641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679046641, "uuid": "e5d447e0-7f82-4f29-b842-3a7fa7d20388", "comment": "Malware payload (Mirai)", "value": "3bfed74592cea7838ddedf11ee0e851e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679046641, "uuid": "06b4353a-0b3f-4da8-98b7-3b1a3f3dd4d2", "comment": "Malware payload (Mirai)", "value": "e6314e97ea1aee920fada8249eca5beb39fcda0d21d9016f240a9843476bde7d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679046641, "uuid": "11734d19-5ddf-4c48-bfe7-0d0b3f5ffe1f", "comment": "Malware payload (Mirai)", "value": "6dc0e62a88ef4361737b69236d5a45de0c31e410", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679046641, "uuid": "eea0500f-8cad-4e9d-b338-bc243b407578", "comment": "Malware payload (Mirai)", "value": "713e300fba943c3b9d96d09942f767e721bf827d4e9902e6356f99e2d07fcd6bbf00492510f8500223bbc17c7a863351", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679046641, "uuid": "defd8871-998a-401c-af8d-f2fffb89f235", "value": "T151D2E11CD95D7D55CA6D3EB951CE56B6398CB0C0A35DF6CE1712C40CBA17A8BBC070A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679046641, "uuid": "5780ce51-f28a-4c69-b8f8-92535a311781", "value": "768:D1uUtLrVDsAp6tLkF4FuetwEub4sU/M9g36KNX/iJbKWUT:DbDs06t4BEub4sU/MbUK+T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679046641, "uuid": "973f8255-096b-4edf-b3c0-4a2e522288c1", "value": 30324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679046641, "uuid": "ae34b697-2daf-4516-b4b0-8f001d99a078", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679046641, "uuid": "8af32b30-084b-4481-9051-aa42a9d9b75f", "value": "3bfed74592cea7838ddedf11ee0e851e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdd70228-c4e2-11ed-88f6-42010a9c006e", "comment": "Malware payload (LaplasClipper)", "timestamp": 1679071391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679071391, "uuid": "0e06a089-9f4b-43be-888d-0125cb497fee", "comment": "Malware payload (LaplasClipper)", "value": "852d500848fe90631597f4c6a195dd37", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679071391, "uuid": "ff117e1f-68e4-4cb9-ba0c-e255e1eae04f", "comment": "Malware payload (LaplasClipper)", "value": "e6e18386e2e9ec24934db1316e29a6e1c104f0e14f61d72934c96270b098d62d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679071391, "uuid": "a464ecdd-d112-47d2-8f26-49b8a704dfcf", "comment": "Malware payload (LaplasClipper)", "value": "7fd52d47c7ca04b3ce7dbda0c3ff7bf8518f696c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679071391, "uuid": "05c75e26-681c-4932-9e06-a4df89d7a6f8", "comment": "Malware payload (LaplasClipper)", "value": "243e30c7f5daa48e75b93719da3adb2e7f32466c390e25594940def39d8da8c5d9e5f79abdd63527f046736e6fc74b18", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679071391, "uuid": "214b5da0-53ea-479b-80f1-f9a073b0bcdc", "value": "T1EC9512039BD17E55E9268B73AE1EC7E8761DB510CF197BB62218DE2F04B12B2D163312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679071391, "uuid": "b145702f-eba8-4b5a-a22a-ab7143b6e364", "value": "abe3ddf8623240e0db2d6ab65f42f1d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679071391, "uuid": "fd0006d5-f971-46b1-96d5-3fb42aacb1c1", "value": "49152:vL2WrgyYRhEhqLpAL0GlargNtYafIj/fWC2+Xa0:vHrgyUE+pSlkUo/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679071391, "uuid": "4af78bb7-d18e-4581-a5e1-daf28b0f324f", "value": 1965568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679071391, "uuid": "feac4941-d6f6-4c34-b6b9-908f7fc5d0ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679071391, "uuid": "34763e26-b974-484b-90e9-83ed7206010a", "value": "852d500848fe90631597f4c6a195dd37.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee185601-c50a-11ed-88f6-42010a9c006e", "comment": "Malware payload (AuroraStealer)", "timestamp": 1679088625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679088625, "uuid": "21596a57-1e20-4418-9b1e-c1a2268e268b", "comment": "Malware payload (AuroraStealer)", "value": "98b75c052e1c6cb0ba7fa1d96428d511", "object_relation": "md5", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679088625, "uuid": "6bcf7632-1f88-4b5d-b71c-45d2725298dc", "comment": "Malware payload (AuroraStealer)", "value": "e73684efd4a0a9582be97a9353e9044c0fb501af7a9c89e15fce2434595d4156", "object_relation": "sha256", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679088625, "uuid": "a7667e2b-ec1a-4fb4-b07a-2932253baff4", "comment": "Malware payload (AuroraStealer)", "value": "cc12ae6171b2bd7c7f1d7c1e09d9c018a0ca4ce5", "object_relation": "sha1", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679088625, "uuid": "5e98042a-adeb-4055-aa07-29dce8ace24a", "comment": "Malware payload (AuroraStealer)", "value": "9712a65d2e2bb4733a08a6c099bb871e6cde0f0cac77a4227785b5b2ea21a50a21d48beba34831b8d2bd58327acb535b", "object_relation": "sha3-384", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679088625, "uuid": "4147e29f-6944-4756-8591-76f54de4302d", "value": "T1F254294392E17C48E9268B729E1FC6E8771DF6618F897B6932189A1F04F3176C163F90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679088625, "uuid": "31e7f787-8936-4b7e-a9ac-e40742b64226", "value": "9fce6c081ab87c2bbedff5f8a5ba7a52", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679088625, "uuid": "d44b8b8c-7a81-4194-829f-033188a9317b", "value": "3072:yU887wzLvxWtbhJxJDnp7UhDsqcEq4Lkn/QOpwydfteuMb:zNwzLvwtbF1p7Uuqi4LW4G+u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679088625, "uuid": "0e439a1c-562f-4c23-8369-ebb403d6e8e3", "value": 302592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679088625, "uuid": "4682bf57-ea01-4abd-b751-0ffb9e00959c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679088625, "uuid": "431c95da-8d36-4ab0-a4c9-9ce7c390c4c8", "value": "98b75c052e1c6cb0ba7fa1d96428d511.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad7695bf-c49b-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1679040842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679040842, "uuid": "878e13d5-5215-4a6f-a44e-c784e673494a", "comment": "Malware payload (SnakeKeylogger)", "value": "4fa7d25c3ea8691d2f4617cb0a16ce02", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679040842, "uuid": "fc68e514-6c03-4dbe-8f7b-b2b99fedde71", "comment": "Malware payload (SnakeKeylogger)", "value": "e798492a89e02c3bad8cce0a3051f7b18018d56c3813b6ae2d0a146e005b51dc", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679040842, "uuid": "946b7cad-827a-4b9e-91f1-d04772656451", "comment": "Malware payload (SnakeKeylogger)", "value": "1c26de1da1903715a1c5d56391da6c6ce1ef72d7", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679040842, "uuid": "f91990a3-6ed4-471b-a689-ee9c68af5f92", "comment": "Malware payload (SnakeKeylogger)", "value": "ef1b3861b746a3ce5ad85dc580a8437e29379094feff48c6e4c2949b6c5e90642b4636a7217d9b9d47e7334b5c385c81", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679040842, "uuid": "fcb1f43f-674e-4ede-9b07-82de9987c5b2", "value": "T14FE4235D909DAE72AA1909086A796AFB3F7D40932F3C1CCE5237235C68C6F1947442FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679040842, "uuid": "3e67ebd7-f08e-481a-8429-3ecc195a9e76", "value": "12288:Z4c9yrkWvAu4h1znqLNySLUE8o5DeOTFmERydrMjs00j1N/RMVb8Aa43:ZowS8nqJLfVjFHRyJMg3hN5MiAB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679040842, "uuid": "b7b9ce46-0569-42b6-bbe3-c4c33d144aa0", "value": 683327, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679040842, "uuid": "96413f44-8b13-4551-a097-7278d0a6c041", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679040842, "uuid": "c4093118-a67c-4a89-b50e-bb23df42ad2c", "value": "Remittance slip.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e479ec0c-c488-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679032774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679032774, "uuid": "09fa5697-bf35-4dd6-aaea-ee511690c465", "comment": "Malware payload (Mirai)", "value": "fe963f16c3f84065d57c79cf2a706cb5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679032774, "uuid": "b8f21aec-8699-4577-821d-7f3340c85b82", "comment": "Malware payload (Mirai)", "value": "e7b80abd4d4d7283d4572e907a63074e71294a8f40d4d6f9c817021d9922e623", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679032774, "uuid": "7358b9ac-086e-4069-b4f1-609eef7de9ea", "comment": "Malware payload (Mirai)", "value": "27a5db8e6f57638582903b9801e0c0235803c259", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679032774, "uuid": "f0f4d0e6-5a5c-4845-a192-89fbad95c0a5", "comment": "Malware payload (Mirai)", "value": "dad153824ecb72a480bc8140b47ef92de90e9997c6e0a5d484619956a9194a7cdec15ef65e8359db456408d7d3f1ecf6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679032774, "uuid": "507515ed-9ba5-483f-b4c2-534aa9c94c68", "value": "T13EB2C0B16663D47EC029E57D4B2F04E597986CD3CFE682867508E4DE01AA0B6BF7E40C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679032774, "uuid": "a23cad14-bc5b-419a-88a9-fcc23ecc006a", "value": "384:MD1Yo+uapdtJ55oPvKju3vunxsjmJ956ZQqvNXcRs45Z+B/ymIS4q+v1Rc:LuSdtJwaju/unxsjvZQqvOD5Z+B/ymWc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679032774, "uuid": "5424269f-e1a5-43d9-b20e-56a00176afcd", "value": 23512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679032774, "uuid": "2d08c7eb-80b6-476f-8f85-f16791e44a49", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679032774, "uuid": "6feec790-94d2-4759-8125-3f6c73f71d95", "value": "fe963f16c3f84065d57c79cf2a706cb5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be1ad546-c471-11ed-88f6-42010a9c006e", "comment": "Malware payload (LaplasClipper)", "timestamp": 1679022831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679022831, "uuid": "2deb3e46-0fff-44ae-98ee-08f9bc838e03", "comment": "Malware payload (LaplasClipper)", "value": "ce0f1f85a927d457599097096d857bd2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679022831, "uuid": "ba863bd5-b301-4da7-9b03-5faee61caf00", "comment": "Malware payload (LaplasClipper)", "value": "e7c00ab7a27a5edfe559c63dce0cf8091c62d5139b45ba895dc4a71a58b47f97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679022831, "uuid": "82f7ccc9-3d0c-49ed-86cf-39a07c3fd5b2", "comment": "Malware payload (LaplasClipper)", "value": "4c368c5beb62227a21ef3e4c119646e06fa27da3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679022831, "uuid": "72d0a089-7177-4f0c-8f51-23072636760a", "comment": "Malware payload (LaplasClipper)", "value": "06da1593776594f8d8b229bace78295802de92369c7dac5585bc4248a5089637d59453f081fec8bad2073f153dc98a12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679022831, "uuid": "4532db4b-c799-4b71-b4b8-b5e5314903ba", "value": "T15134BF0353E56C64F52656369E2FC2F47A1EF8138E79AF5B22189B2F08B11A2C57F350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679022831, "uuid": "06909c5f-e8d1-4fac-9865-8930744f856c", "value": "4b2faf5e2157c756cf2fd31d6cfd3d44", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679022831, "uuid": "86b6d709-c37f-425e-ad59-d338919e6d7c", "value": "3072:5QPbxBn1JYIYtNIGIVsng6gwBownWKotYEF8JY7FwZBHxFsLPdsfhVMAdJB:kbbotNIGIVsY7wWnn8JCFyFSQhCGJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679022831, "uuid": "216d5733-f2ad-4d7f-bf72-aad0496d851f", "value": 250880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679022831, "uuid": "d3458b4b-a966-49ee-b2b5-0a22bcb601ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679022831, "uuid": "26b770e0-0fd9-4ad4-843b-a9debddb2160", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a33a24f6-c4c4-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679058434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679058434, "uuid": "a699b1b1-22d2-4052-9221-e6b78a751152", "comment": "Malware payload (AgentTesla)", "value": "63716b0544c7e08b7b8c1d0a94798329", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679058434, "uuid": "4be86b58-6534-43ed-a51a-a0bbac5401d7", "comment": "Malware payload (AgentTesla)", "value": "e7c8bff165cd2934371d0a9d66813088d9dd7640137f166ab3bce0cf6475f90e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679058434, "uuid": "1190943a-8fc8-4a1c-b6ae-f0c3e3cd68b6", "comment": "Malware payload (AgentTesla)", "value": "f6eeb3d2f6bdc4d70c4066bb7b6ab305694d85df", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679058434, "uuid": "46714566-2f5b-4b39-91fa-1ddcfb3ab459", "comment": "Malware payload (AgentTesla)", "value": "69c48f3e8ed9539397778c803824601d8d2f3d8d1c939be699ad3848187c0fb7324df67ca7bb67a8a977f01d25e9e55f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679058434, "uuid": "555959f5-0360-4579-a96a-a9d195fc1b53", "value": "T1E2F43391323A2A5C5F892D49E3DB58F1CA271C74B631FC881686CEDD152CE217E3D3A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679058434, "uuid": "c4504ba5-7c05-48cc-bbf2-b555b004a887", "value": "12288:3AyoWif3DSNvChXkgZh7q7mXtBmIpPDWdJMs6uz9+LflnxiqEgntp6MUNqZA6+p:gWif+vCh0gZhWm9MIdUCRuz9Sqqbtp6r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679058434, "uuid": "62c5c3ed-f200-4beb-a260-8bdcddf54a55", "value": 745162, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679058434, "uuid": "91fe88fc-b8bd-41fe-9978-6389d72dba93", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679058434, "uuid": "9124664e-7b84-433c-af10-c0eebf3721e8", "value": "PURCHASE CONTRACT.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c4d4af8-c51d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679096433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679096433, "uuid": "df1b165e-8b2f-4597-b3c9-8ae68bbe392d", "comment": "Malware payload (Mirai)", "value": "945018a7a03002f59ffa2ff7536a083f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679096433, "uuid": "1c685ff0-3bdb-4beb-b72d-8138b98be130", "comment": "Malware payload (Mirai)", "value": "e80bc31b44b2a9ce73dc9176e603861378fbd48c4c2e70976f7dcb857258a597", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679096433, "uuid": "cedbaa6e-5346-4a24-9bb2-141d1aea08b4", "comment": "Malware payload (Mirai)", "value": "49491b076204668ab466a427ccb5010c18811d16", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679096433, "uuid": "320041ba-aef5-461e-a7f0-cf526015f121", "comment": "Malware payload (Mirai)", "value": "3d4847d024921043f9a223a3192aaa0fc7be15ce41f1dee9390b54c4aea0475d4f22767b3e2277d3a9cceaa599234270", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679096433, "uuid": "e3f08c60-d0d1-4f41-92ee-919fdd35bd07", "value": "T19F03F18D95604645C03D8EF405B4CAD1732E4A02F2F26F6CA4ECEA15AB225D1CE99ADF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679096433, "uuid": "c697dc40-d3de-4014-af60-93df5de57497", "value": "768:e28TZHBQQ3IoceawJSF7DPWUlSFVMUMHrh8ajACJ9PxlK6TP:e28ZHBQvO0F7D5lAMUMHl8kAu97", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679096433, "uuid": "b167c7f1-826b-4cf8-8397-6a0ca0998d46", "value": 38636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679096433, "uuid": "d211a52a-0daf-416a-954c-d90cc1752a15", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679096433, "uuid": "5b96a693-3751-4f9a-a8e7-2a31102f9e50", "value": "945018a7a03002f59ffa2ff7536a083f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e34d4e4-c4c6-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679059124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679059124, "uuid": "3533aa52-96fe-41ce-b940-f15a4277787a", "comment": "Malware payload (AgentTesla)", "value": "3a8d2325fc0095fc01cf14689cfb4f7f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679059124, "uuid": "29ac3124-3766-40b7-8e2f-d08063cfbd37", "comment": "Malware payload (AgentTesla)", "value": "e829720bbe99c3071e0019a2ab941bda898a81d78b9813597467f6cf639a9a88", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679059124, "uuid": "451799ae-6d55-488a-aee6-e9b3d852204e", "comment": "Malware payload (AgentTesla)", "value": "15e14bb64e70c093b45df00aa7ff9897c10a7aa4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679059124, "uuid": "90c8ccd1-d5da-4cab-9724-c18b113ceb46", "comment": "Malware payload (AgentTesla)", "value": "069df0baacfaaa274b672f25141de8628c062e086b7a7100ab70e99054e803255e967ba54bdce91c93b7e1f1338667c1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679059124, "uuid": "e63a9e48-25d5-4984-be85-cac47a5e28a2", "value": "T11F15124C49BE9776CA2C33BEB091660403B1DE21A611F35D9EC664E70FE2BD9C512E93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679059124, "uuid": "a0d1d443-8642-457a-a135-b3e4cf17817c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679059124, "uuid": "a019ddfb-ed07-43a9-b022-caf3e4c9eece", "value": "12288:nmjY9/2JGRTwBgT3i1wRSGP4F/BWfFVLiqo/AegM0KDvUMKnXaFn7eNSncat6y7a:7/2JTBHwsrFMuqxeuykmnbgy7FRb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679059124, "uuid": "383bb874-bd1e-41ba-8409-a2dd516bd58c", "value": 925184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679059124, "uuid": "e9340924-e212-4c35-8bc1-d01f222f094e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679059124, "uuid": "669966e9-11dd-40dc-9acc-526943ddf6fb", "value": "VCO00IddkzE1Fea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "143322b8-c4a7-11ed-88f6-42010a9c006e", "comment": "Malware payload (AuroraStealer)", "timestamp": 1679045739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045739, "uuid": "3777fd95-41a3-4373-afa6-9f35204d84a4", "comment": "Malware payload (AuroraStealer)", "value": "96a4bad863093e363a64c222e89ec8b0", "object_relation": "md5", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045739, "uuid": "64bfa919-d5ee-4a74-a752-4e9e1a274ebf", "comment": "Malware payload (AuroraStealer)", "value": "e87d0fb6c7befad21a15111bb01b2b338067675aa364c5885f9924e3c23a850c", "object_relation": "sha256", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045739, "uuid": "fc1b0b19-1692-425c-845e-041240332ee7", "comment": "Malware payload (AuroraStealer)", "value": "5058fd4705213689f837b689c5bc4d38847a0cb7", "object_relation": "sha1", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045739, "uuid": "c758ed34-903e-4e0c-8ff2-c326f7c63fd8", "comment": "Malware payload (AuroraStealer)", "value": "2e485ad41b1da7b1fe3b785f4f883dae2024c2af0e5d409f81cec57d205c89b379cd3399ddde6d988630551638925769", "object_relation": "sha3-384", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045739, "uuid": "c51841be-0d01-431f-8b7c-82e8fba6d30d", "value": "T1FC642A4396E17C44EA268B73AE1FCAE8761DB661CF4A77BA1218DE1F04B1172C173712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045739, "uuid": "b49a22ae-a59b-43ec-bd54-ace290595150", "value": "abe3ddf8623240e0db2d6ab65f42f1d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045739, "uuid": "7275a164-713d-405a-803b-5f502f6f6809", "value": "3072:W+eb5EGLFAwGLut0/A8MQ489KwmJrt2oy914eIQBO/4sDpTqMI3A/LK:W1b5EGLFLGV/A8sZ1xy914LQU/FZ/L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679045739, "uuid": "86ab971f-7a86-49d5-b446-58030a04dd09", "value": 307712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679045739, "uuid": "d9a4770e-1c2a-4a63-bcd2-1a3b1f0ad2b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045739, "uuid": "aee68147-e49e-425f-8f09-016936d7cc46", "value": "96a4bad863093e363a64c222e89ec8b0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efa722c6-c492-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679037088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679037088, "uuid": "2e55d7f0-addc-420f-abde-7fd628d730d1", "comment": "Malware payload (AgentTesla)", "value": "d0a29e2184b95702c6e059da61999c51", "object_relation": "md5", "Tag": [ { "name": "498443222203]", "colour": "#3EAB35", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679037088, "uuid": "81e97270-6d24-4e38-bd23-b2789008faa3", "comment": "Malware payload (AgentTesla)", "value": "ea02a1c241a891a03d15dcbe9c1b6a3dfa9040fba80b615669f618918cec18c3", "object_relation": "sha256", "Tag": [ { "name": "498443222203]", "colour": "#3EAB35", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679037088, "uuid": "1b66da38-fa8b-40bf-a998-2ecdc3426c9e", "comment": "Malware payload (AgentTesla)", "value": "65578084a3cf3cc1ef4af23022dbf6888360816d", "object_relation": "sha1", "Tag": [ { "name": "498443222203]", "colour": "#3EAB35", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679037088, "uuid": "9f3964b5-aab4-40af-a5ec-51c6cfd276a2", "comment": "Malware payload (AgentTesla)", "value": "85d055521bc4c18b27a5737a36c6f022db5fa9413fedd4b0e4bc6e4041fa7f1c3df4fe12039b168bacfac586aa308d63", "object_relation": "sha3-384", "Tag": [ { "name": "498443222203]", "colour": "#3EAB35", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679037088, "uuid": "6f160548-743f-4bd6-ba86-44947c612c84", "value": "T1D505024DBAE5A520CA7D0BB790D3207093B199174F82DB1FAEC206B62F227C7D581D67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679037088, "uuid": "b9085448-ede8-4928-a3ab-214d778ccceb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679037088, "uuid": "7dce6bdf-40b4-43b8-b6b4-9ce4745c474f", "value": "24576:pwZQwcJzOIzZAHmszL4S5nHROv/ELVjS/CN2hQ:/J1azL4StHRK/wS/4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679037088, "uuid": "35baba88-103d-4300-b4c6-4a9521618111", "value": 814592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679037088, "uuid": "db5f6fcc-0ea8-4f01-981b-12b8a843721a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679037088, "uuid": "786fae51-00d8-4b43-a835-cf8b75ee224d", "value": "Inv-67383728 [Reference Nr. 498443222203]", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40cdcf24-c4a6-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1679045384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045384, "uuid": "e87ac241-5af1-48d9-9371-65f89d3cbe6b", "comment": "Malware payload (AsyncRAT)", "value": "36e4122b5fdd4e5b802aa7c109c354fb", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045384, "uuid": "72976c10-eda2-41fa-9e97-2de88fccece5", "comment": "Malware payload (AsyncRAT)", "value": "ea9a3686784c9990761ae93d2a99fdf2bd2a4270119068542ef018e8f248432e", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045384, "uuid": "adf58a8c-d1ca-4d26-ab62-2a0f913bcb9b", "comment": "Malware payload (AsyncRAT)", "value": "36c47932fe865d933f2012182acfd1f05ba2002b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045384, "uuid": "56df8cbb-5c4a-4f34-b3a8-fa6f09f63b84", "comment": "Malware payload (AsyncRAT)", "value": "eb263ef726c678f6fca79de55e8e10936db6113c0da9e810be7c42b29f4821fffe3733d11b2db2b2c5b728989b6a0201", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045384, "uuid": "fb7cabab-a487-439d-8fb5-68be4ee5d49f", "value": "T168F6FBDC726072DFC857D472DEA82DA8EA5178BB931B4203902715ADEE4D89BDF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045384, "uuid": "45bc9141-4b69-4956-a9bc-865d22b4296a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045384, "uuid": "6bb1065c-820e-4f8a-b5b6-ba2206a8bf1e", "value": "196608:QU1b3Qw99ayoBNXfDbwbMnFGUVpH0AJyLARm2oFqD7:9vyBNXfYbMF7XTMAR4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679045384, "uuid": "07a41479-268e-4a78-9630-d3ae0be87df4", "value": 15378944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679045384, "uuid": "0b980284-c059-480a-a5dc-2b83680ca763", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045384, "uuid": "69707390-cf06-45d4-b167-af2e43ee2d8b", "value": "SecuriteInfo.com.Variant.MSILPerseus.238084.12398.30031", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ba5a8a3-c4a9-11ed-88f6-42010a9c006e", "comment": "Malware payload (zgRAT)", "timestamp": 1679046718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679046718, "uuid": "876654c6-4394-40a6-8263-90b2a206e084", "comment": "Malware payload (zgRAT)", "value": "e892ba36a0122b457037ba9cc2fa3c1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679046718, "uuid": "9fcb83fe-7939-479c-a813-da2ffea5d7a0", "comment": "Malware payload (zgRAT)", "value": "eb80c9d327ffd6ede1d2b0558572de31384c0cbbd8520fd3093ffb5266f7fae7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679046718, "uuid": "0250bcde-7938-4be2-86d4-c9ec3e303302", "comment": "Malware payload (zgRAT)", "value": "f5f134bef0147d7318337624ea5ea9444cb86936", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679046718, "uuid": "cde23686-e411-4177-acd4-ab0b7c713b3c", "comment": "Malware payload (zgRAT)", "value": "3dfc4139f251ec65f7ace38e35c136292f609933f6f4c070f6e958670c0dc755de346cde4ca9724016e11fce1f40956f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679046718, "uuid": "ea968d93-9a6f-448e-a1da-445914c66e3a", "value": "T15A06BFB10AA3EE87E37F1E71943825809C3C642F979D975CB8C4299687D4758CF8D2B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679046718, "uuid": "54607eea-6342-436d-a8f5-c97a0850dd06", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679046718, "uuid": "4ddf90c5-3c4f-4907-9387-cfa9c5016ff9", "value": "49152:ZkFn+eJtmmiww1udq1aKT5V/OQOt5Z9id3Z:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679046718, "uuid": "ccf99ea7-c9d4-45b7-8d87-f111e96c5d61", "value": 3901440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679046718, "uuid": "b5f4a164-d0c5-4582-bb00-9ef98247998a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679046718, "uuid": "d0b9b554-e72e-44f8-a0f7-890358c24d12", "value": "e892ba36a0122b457037ba9cc2fa3c1a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3483182d-c502-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679084877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679084877, "uuid": "38c1fd5d-dd60-4cea-b51b-f8ef8967676c", "comment": "Malware payload", "value": "97bca68c8f1c8529a7eccea1cd9d7676", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679084877, "uuid": "d0545977-ebf5-4e57-b745-1480f64d0fa8", "comment": "Malware payload", "value": "ebd04b62491c472da02e878c6514b5b2bdf17a7fbf3760c75b6313b4de3356aa", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679084877, "uuid": "ae3c9761-efed-4c17-ba21-a3124cb4efce", "comment": "Malware payload", "value": "9fb457131419c3def2414437ce3e86722f3b12f5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679084877, "uuid": "c1f57cdb-5bc0-4a5b-ad6f-15cf19a2cb64", "comment": "Malware payload", "value": "29fe2a3b9fe43463552921df9ab2e6e7888cfca83256ff641fbf57d33e57d9514cbd9e1ea7e0151b1b620e4af1a08f8b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679084877, "uuid": "89d05ee7-dcb4-423d-aee3-ad358e4187c2", "value": "T127E4239DFB05E931CA2675BEB47A7056E3A38C4DC493E2B892DD4C38F81775CA845B80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679084877, "uuid": "87fb0f29-bd0a-4e83-b82b-ed90f9f74c9a", "value": "12288:rXyuaqmaCJ5lCbj7khnBJQYXEIJrZx8fdGDfjO2Xu4m7kD2py/sTHMFINH:r+iCxk7u3J/rAdOxeFALeMk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679084877, "uuid": "f6849d45-a705-446f-8e9a-aa49716f055d", "value": 692925, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679084877, "uuid": "7f58cb30-3894-42d5-aaf4-15340efa2182", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679084877, "uuid": "2bc4927b-486d-45e1-97b9-c095e22f1b0d", "value": "SecuriteInfo.com.Heur.25229.19484", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d61fd62-c4a6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1679045379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045379, "uuid": "e518997f-8e12-40bc-babc-db348f414e4b", "comment": "Malware payload (Gafgyt)", "value": "b110d1a0fdfeb62b4a1ac1a3a6da6c86", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045379, "uuid": "f4bdd808-c76e-47da-a97b-b9aa04171fa9", "comment": "Malware payload (Gafgyt)", "value": "ec09e88e96cbcc1d68f7902592238c8684f882b53be837d9f0e8823468ba2ee3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045379, "uuid": "e413f5f1-8dcd-49d0-91a6-e77d7bdab72e", "comment": "Malware payload (Gafgyt)", "value": "ab82d43c260ce4c8f375cae54ce3eecce907d069", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045379, "uuid": "21ad3a0a-0d5e-4dc2-90fc-473102edef3c", "comment": "Malware payload (Gafgyt)", "value": "a7c30497308d623da4c4101936bd984d4cfbb8ef94a5331b6c58275d40bf54c06dcdd6e4ee127f9fa439b94e4da69a3b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045379, "uuid": "d1cea1eb-aebe-49c8-96c2-4a6e7fcfdd80", "value": "T1C113F190F03E455CE2D941B32E9EF71A80D96227C5941DFAEFE473B34A35982390932B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045379, "uuid": "a773cc81-1813-4986-a075-c0f250e6f7b6", "value": "768:CNc7dJyrsteeIZPdLSPs9Nud9NkY1+Q9t8QHR9/WfmZ0oc+ibqbyulnbcuyD7UrS:Cu7SrNeI409gd31XnHGmZ0P+iWbyulnc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679045379, "uuid": "f4cf57bf-af95-4042-aeac-93c0521c09c9", "value": 41984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679045379, "uuid": "7cb97164-a87a-4149-9880-dc8649cca0bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045379, "uuid": "366b1c00-ab55-4e2e-abae-3013a246c7f3", "value": "b110d1a0fdfeb62b4a1ac1a3a6da6c86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "388c2439-c4dc-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679068563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679068563, "uuid": "bc605090-09fb-4786-a05c-a6379ab294a1", "comment": "Malware payload (Smoke Loader)", "value": "4fdea942b5abf100a6cfb118063756bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679068563, "uuid": "13be10e0-2486-4571-8dcc-72512fbcc4d4", "comment": "Malware payload (Smoke Loader)", "value": "ed957035bd490972d13d59763562573c5c24c352997d989e221dc1a8f4468c97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679068563, "uuid": "bf07e1c5-61e9-4b39-932c-ebe1d2066f62", "comment": "Malware payload (Smoke Loader)", "value": "9438978a707bb8438bce8a65945b3239c8209d7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679068563, "uuid": "5a6cbcad-63bd-402b-beac-869cef7b33dc", "comment": "Malware payload (Smoke Loader)", "value": "ab86bd237a38d1ab67b12f5d0b6c676a4dfff46b3d1d4e871981900d3f40454e7b7419739ddf31e935221fd161476915", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679068563, "uuid": "e3212a93-2f41-47cc-8211-4a97ec1f22f8", "value": "T17054294386F17C41EA268B73AE1EC6E8761DF651CF497BB62218FE2F04B1172C163616", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679068563, "uuid": "2a396c50-3bac-4ff3-88d5-f5c3d3689659", "value": "48e7bdebf7b90ec755513d967cfa38a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679068563, "uuid": "a46dd0e6-738b-47e6-9232-337d4d3728f3", "value": "3072:71rjwHLJ2W6Js0n+UgEe9Wg6R/1flgE6n6AiI3GqbjY:xwHLJf6Js6gE80c4dqXY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679068563, "uuid": "c38272d7-b9ae-474a-8b0e-dab81bac40d8", "value": 302592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679068563, "uuid": "046f7933-4b24-4f44-a3f0-77e9e1dea97c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679068563, "uuid": "097aaccf-68d1-4d5c-b9cf-c6ddecc0cf24", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "182becbe-c4a2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1679043598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679043598, "uuid": "7ee3dac8-11c2-4b0b-aa9a-89e5c36326af", "comment": "Malware payload (Gafgyt)", "value": "f07946e95b27ddef0af4906e8fbf9772", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679043598, "uuid": "1816aed2-8ddf-498d-a6eb-e92fdf1885d1", "comment": "Malware payload (Gafgyt)", "value": "edae1ab928e8c497310c2403f14b558707f6d3b3209ecb67cd04bbb295755ba8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679043598, "uuid": "bf54a0b9-abe9-4890-b15e-6ef926238c4c", "comment": "Malware payload (Gafgyt)", "value": "944975bd28153cafa0a672f466d59754ba0d198f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679043598, "uuid": "2d1ac76b-c907-40b5-9026-cb0871694e91", "comment": "Malware payload (Gafgyt)", "value": "11339e16b5d8c08f1891c84d44c0467e82565cb72941cd94b18d7692670bc10b7ac1edda8df3d279d718bf3e4315e470", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679043598, "uuid": "27dc9708-b350-45af-9217-2509df44299f", "value": "T1E8B328436B1C0B87C49B9AB01DA737F18B69BD7112A351C9A90BFEC04733AB81527F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679043598, "uuid": "dcf7aae4-9e9f-46f4-bf47-ce34a6f60f1a", "value": "3072:WD3l+XQzPeV91310pWudvKakpNDtm2pgYMidIP1W:WD3l+XQzPe713CpWCvypxtm2pgYMidIQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679043598, "uuid": "4bf9a7d3-56bc-4527-8c6c-16acfb15877f", "value": 113194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679043598, "uuid": "470bfc97-1012-418f-a436-10d467eae355", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679043598, "uuid": "4410e245-e6e0-415e-82b6-14c2e011cc85", "value": "f07946e95b27ddef0af4906e8fbf9772", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6125ff8c-c497-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1679038996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038996, "uuid": "aeaff669-bfaa-4b63-967a-95f7905ce617", "comment": "Malware payload (Heodo)", "value": "90d7180934926e1612b4fff940defaae", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038996, "uuid": "328c9306-8dbf-4087-9667-91307751d7dd", "comment": "Malware payload (Heodo)", "value": "ee1a62d1c2354e54f1763553619159f630f45db3adf53d8970d12d010de3bef5", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038996, "uuid": "ade3e1d4-b1bb-4990-9685-11974e15e85e", "comment": "Malware payload (Heodo)", "value": "98143acb304f201ff47c2825edef5f273bd726b2", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038996, "uuid": "8f5ea54e-f743-4766-a007-7f0dce94e07b", "comment": "Malware payload (Heodo)", "value": "14abea43064cbb9cd2603f724589808af6a31b0a82a974fbebf0380404e8281f96cf54f4c7ee75ad3d92281af327b366", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038996, "uuid": "19808f9d-8fdb-4b29-9496-aaa942271c16", "value": "T1DCC33BF1A8025C0AE123C936B1FB661399D051ED42283B2BF87D507DD978A20D6DD8EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038996, "uuid": "f0804786-9856-4e36-8815-306f012834ec", "value": "1536:RDBoTVdaeNtuXndCrJJmT4HVnteV4FrdMiYcx7bfCb6HPdnXn:1BoC+tCYvSMVnte8ZP1Y6J3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679038996, "uuid": "902b09b1-8a75-47b8-b562-292bb0a90705", "value": 120428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679038996, "uuid": "00857c8b-82dc-496e-8733-6cc6bad61975", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038996, "uuid": "59153c39-e18a-48fe-ba3f-2d4a854268a6", "value": "Opast Publishing Group.one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8cb66f7-c500-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679084240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679084240, "uuid": "79a23ec3-cf4e-49c0-81aa-b6d61c2c7474", "comment": "Malware payload (AgentTesla)", "value": "1af0bca4e65839b3416675ad0bd914f3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679084240, "uuid": "c0ac0211-25a5-4228-a28a-7b59eeb50cc3", "comment": "Malware payload (AgentTesla)", "value": "ee361abd551977efe8d984071743ee90b31c06573f5b5f954f3aad9284c18552", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679084240, "uuid": "ac1271e1-d8c0-49f2-8c20-3e9fa28ff9ea", "comment": "Malware payload (AgentTesla)", "value": "71ef20fda289218eb6bc651dd1c4bdfdc75cccd9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679084240, "uuid": "db7a04d4-b87a-4345-9abe-55a373bbb86d", "comment": "Malware payload (AgentTesla)", "value": "e75dcac122b242571a0f0017c829703caf25232043d0b6537aa41d32eaadccf95ef306a26fad903e9b6ab4a7837dc926", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679084240, "uuid": "8523450b-3ede-4648-920c-1f1738935eac", "value": "T19405025DF229DF62C73F87FEB0B2746593F3581B5229F2889CCE64DA2A62F904501907", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679084240, "uuid": "d2584c0e-c987-402b-91aa-13c76bb47749", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679084240, "uuid": "d608887a-7922-40f2-bfd6-6c50fd417c30", "value": "24576:7Wjkj+yMy3udXDAu5aFw363tCzXRwicA:7Wjk8HdXku5aG57RhJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679084240, "uuid": "789ac997-f246-4874-92b7-4ea576e9e15f", "value": 866304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679084240, "uuid": "e6c4d9e9-3f2e-4d1a-babb-ea355222b03d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679084240, "uuid": "e3e123c2-10d9-46b6-853f-f804a2f5377c", "value": "1af0bca4e65839b3416675ad0bd914f3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "253e7515-c46e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679021286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679021286, "uuid": "dc043263-dbe2-4d3c-8f5a-c485b66c9f6d", "comment": "Malware payload (Smoke Loader)", "value": "d946340dedfee84a6e201e86ea0d744c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679021286, "uuid": "3764c8b5-f469-4044-a40a-2293e5f789e3", "comment": "Malware payload (Smoke Loader)", "value": "ee80c53428a32d37131195f3e81caf8c1f82b771cbd175543cbf6cb86de3572a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679021286, "uuid": "87a6fdc7-7085-4b89-b053-8a673e7ec0b4", "comment": "Malware payload (Smoke Loader)", "value": "bb26294f7644ebf0307dfd76d0ccbf0ad872a7a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679021286, "uuid": "23c62c98-a666-4c70-a8ab-3d7786514107", "comment": "Malware payload (Smoke Loader)", "value": "a804abd73bc051fdfa3aef4512bafa999dab6957ddced787ec6508296fe13315843902c1d14e7098ab472efefd22c440", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679021286, "uuid": "9a3c02d9-75e4-4697-9211-e24c2f49aa62", "value": "T12E643C0383E1BC84E92A8B739E1FC6F9761DF6508E49776922289F1F64B01B6D163F11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679021286, "uuid": "2f72ed26-ec42-4ca2-89fc-1debed1021b1", "value": "25b97b20ea5f74ae1a1939bb76680477", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679021286, "uuid": "d85b1baf-9118-438f-9de3-fac01a5eee3b", "value": "3072:JDXIgEaL8ngwJRSbcT+1USqSTENnxwoKvV9W/5wwXpkF/qvNlfCWDJ:1IgXLv2V+5E4okwOI6FiFFJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679021286, "uuid": "90258312-e167-43fe-af9d-62ff5e1f8c16", "value": 315392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679021286, "uuid": "8e98a888-dcdd-446a-a9ae-c71138d97af1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679021286, "uuid": "dcf87a54-0748-44fd-af78-4e7a03ddaa37", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa0ee57d-c4d3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679064888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679064888, "uuid": "6b5ea964-dfc9-4cb1-8c2b-0f5fc2bb1982", "comment": "Malware payload (Mirai)", "value": "f656d57d1c8e03caf3d38d9626e0a87e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679064888, "uuid": "695f4c02-1bb6-485a-b91e-fa70fe03c504", "comment": "Malware payload (Mirai)", "value": "eec7e4abc9987643f03c706ec0e1e77576a747fffbf3d8b2625f0402e6d85be8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679064888, "uuid": "07ce4ecf-f048-4100-8f58-5fd58362ad0d", "comment": "Malware payload (Mirai)", "value": "c4518440b773d052c4237b395c5fa17b9b0e32d6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679064888, "uuid": "2761cd0a-04d1-49ff-81e3-bdc8e475f740", "comment": "Malware payload (Mirai)", "value": "1653ce22bab20e770da5ea61743140b7ace9e5fae15def42471b2a11e80c1a7794faa7b14259ac982e61bcc88c0e5ca0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679064888, "uuid": "b25b8436-9cdd-4a44-9532-5e5879d561b1", "value": "T12D330A8EB8029D3CF91BE6BE54164E0DB93177C152830B2767BBFDA36C721945E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679064888, "uuid": "2dfe3697-32c1-47d7-bb48-ca50c3d5c423", "value": "768:gduPBFnHooqR8qOCKq2cH4Kg9e+TK806MMUVjzkfQXObHud2oGk:r/hqaJMDg9eqK806MHdkfQX6HuCk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679064888, "uuid": "306645b7-8224-4f6a-ab1d-7441e22b34ce", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679064888, "uuid": "72278bdc-8240-4df2-9c07-10cb36f0f000", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679064888, "uuid": "bfdc85d1-54ec-4d82-a83d-a7d61d109fef", "value": "f656d57d1c8e03caf3d38d9626e0a87e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98754f61-c4a0-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679042954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679042954, "uuid": "ce8ba5c5-82b2-4864-9648-69cac9b4583c", "comment": "Malware payload (AgentTesla)", "value": "7ce5957d016bc558a8aa30c3f28e30d4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679042954, "uuid": "f27ba143-e1bf-4f06-9e48-d29505e554e6", "comment": "Malware payload (AgentTesla)", "value": "efa6869eaa796429cbd684b030cb6873262f6009997fe6f4c20ebd69b4ad54b6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679042954, "uuid": "34ef970c-5859-4224-bd00-993e669c59f6", "comment": "Malware payload (AgentTesla)", "value": "16be243943b88ddb768298f2370f583dcffc2211", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679042954, "uuid": "de97c1d1-d31d-40e8-8cea-77cce4487052", "comment": "Malware payload (AgentTesla)", "value": "85fb3bc3bfc32534098078e9aae5075f831691ffa8018630cdfbbc54744d8a0445a496eb6d9f40170fdc8d65d457f91d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679042954, "uuid": "da7b86a3-007c-4391-97f1-d34e4cbbd8a7", "value": "T100C48DA8DCBB46FEC5BF053F41D62B76EB2B33D650458D7F8AC4A92595520FAEC08600", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679042954, "uuid": "dc197c65-6057-4b5b-a31d-101822b44ceb", "value": "12288:9AbaXvQ2opbrGunDF6S9Dp9g2okqVvujHW7vU:mbuvQ2opPhnDF6YYiqVmj6vU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679042954, "uuid": "c6b42081-8ff0-4faa-93d3-aca440f82293", "value": 593808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679042954, "uuid": "969343b0-71df-4f36-8068-2db09183419a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679042954, "uuid": "372d3f5f-24cc-424b-89dc-7bee770bb1bc", "value": "DHL Original Document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "347f2d88-c4af-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679049229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679049229, "uuid": "fe100f61-9eb9-4e86-a3a0-15807e4ab395", "comment": "Malware payload (Mirai)", "value": "3b270728781dd886c8447da798c9c295", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679049229, "uuid": "e19a8059-8629-4b19-9ae1-fab7ae62f6b5", "comment": "Malware payload (Mirai)", "value": "efa89228269d2a8ed6d4a148fbc1049eb68dc4e74da558cadb22aad930ba4c28", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679049229, "uuid": "7eb6a106-c0e7-4816-a29c-c88e992338fd", "comment": "Malware payload (Mirai)", "value": "fc5df925f36efcd9b967d24d15dd01084c6b9e62", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679049229, "uuid": "c22c4366-e408-4812-9723-16496d1b8585", "comment": "Malware payload (Mirai)", "value": "8efa5cf3d05f476a7f5f5f60f11442b470a26e672736a55ff484a071de0cadd39c19bf1f69c9fb209db6d3e0b34a1542", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679049229, "uuid": "0b482bad-c7e7-4781-9100-7f684121d1d1", "value": "T158F35C21A57D2F17C0E0F47E21B78751B2E1278D26A8D68E7DB60F0FFF2128069466B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679049229, "uuid": "7174a424-2324-4935-8326-8d12bdd1532b", "value": "3072:yqTgQdPgtF4S0aHNxqvUwVQTPLuUXZi1ha+Zy7n7YUgqU2rk0c2gNJ8FdsZ4OG+v:agNJ8FdsZ4OGfXZngNxRz5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679049229, "uuid": "b491d32b-8b53-4361-a99f-2548f4d64d85", "value": 160760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679049229, "uuid": "031d18b4-6f4e-4b53-af01-c88859ebc82b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679049229, "uuid": "a68e5d49-cd8f-4b04-80e6-53c078e0e097", "value": "3b270728781dd886c8447da798c9c295", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f44ce90-c4ca-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679061005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679061005, "uuid": "b4ace60c-dc03-4793-b167-4e115c5a4e11", "comment": "Malware payload (Mirai)", "value": "6d61d7c3319620154aae4d67ae82405c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679061005, "uuid": "b7edc728-e9ea-402e-98a7-07abe8212474", "comment": "Malware payload (Mirai)", "value": "f067dbf0642d4e2ae59f611f91c5587d28b55af26a1e4ab747ee1344cf0e1325", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679061005, "uuid": "a69a577b-846e-49ef-9559-164f221de1b5", "comment": "Malware payload (Mirai)", "value": "dba52738c3a3a4176bf976a6eaed09a75b165a04", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679061005, "uuid": "f0466730-183d-422f-92a4-f68887ccc761", "comment": "Malware payload (Mirai)", "value": "20ede60ced254f7eb14189a2dd0c069ee9ac78ab625cd5a9a8c7daac1b7d465084e5ef842532f6b3217c3c989b24d361", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679061005, "uuid": "c438f7ec-df6f-4283-a957-30ec0bfec287", "value": "T1BE230271890A9EF125303C76DF95D393B6E12AB1C6673013D6290A382FB97131E57E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679061005, "uuid": "f52298c5-2460-42aa-96aa-aa2db7260b4f", "value": "768:D/TYCoIxdEk+AxoTZAZHFeq8b3x9q3UELbUXfi6nVMQHI4vcGpve:DECFd+A6YHAxkLRQZe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679061005, "uuid": "91348964-7a5d-4cd0-a838-9e0062d29244", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679061005, "uuid": "7b0271c2-4981-47ad-b338-bb9f0d52f835", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679061005, "uuid": "4c9e004b-13c5-4fff-a98f-b4a419f12ef1", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "100b467e-c4af-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679049168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679049168, "uuid": "b83dfeeb-b31d-4f0e-a435-2c847c2e4458", "comment": "Malware payload (Mirai)", "value": "06b48f2fc2bdfe2b4099ca68dfa6ba57", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679049168, "uuid": "41c489d9-0523-40f6-9f87-8a5ff5542a5b", "comment": "Malware payload (Mirai)", "value": "f0e5f6425499acb62ab1fa8933718ea26ac779bfa85de0d8836ecadd50274834", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679049168, "uuid": "0e4b88a4-4f16-4f0f-abca-56971452488c", "comment": "Malware payload (Mirai)", "value": "913543fb76b130b6895572775653871900b8bde6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679049168, "uuid": "f691d321-fb9f-4bdd-b51e-460cd18fc80e", "comment": "Malware payload (Mirai)", "value": "8f9faba0b9d0f28f3870ee31d3bc184b40b5611f78714a2e8a7aca8023a3dfb7fd50cb8a99cad1ad859327cd10ee71d8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679049168, "uuid": "fe1c990a-e108-4a84-aad4-527c014b79b5", "value": "T1EE434B0232680E17D5A21EF5353F27F083EEED9121E4F689254FC796463AE33458AE9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679049168, "uuid": "26534efd-231d-47c6-a07d-a495fa015cb4", "value": "768:vETst2s/uhZo7Fgbb1vJdQ/uQ4GOLK5302vyeLr6QjMXjhu6keoSnuNRvVx:2hrb1TY2sB2foSnEdx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679049168, "uuid": "c48d82bc-7df8-4b97-8b6c-7d64d17d4e5b", "value": 55604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679049168, "uuid": "05637980-f617-4b76-958a-697587e9feda", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679049168, "uuid": "7a34dcec-8bfb-4882-b8a4-77e0dd13f9e7", "value": "06b48f2fc2bdfe2b4099ca68dfa6ba57", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "580d130f-c4a0-11ed-88f6-42010a9c006e", "comment": "Malware payload (STRRAT)", "timestamp": 1679042846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679042846, "uuid": "a13715cf-eb56-4b3d-b925-29f50732f00e", "comment": "Malware payload (STRRAT)", "value": "8cd0d57bd4672a761ffb9df48198cac0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679042846, "uuid": "afa5f4c9-abf3-4a09-8b7b-bad344065717", "comment": "Malware payload (STRRAT)", "value": "f0f9f33c8d007ec17cc686c626e3615516bb4c75a6c77810719e0a8c6cf111f1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679042846, "uuid": "8d04781d-178b-4e5d-a405-077cfc98c52c", "comment": "Malware payload (STRRAT)", "value": "089669a4f80cba2295a8d86d47f02b7ea67e1916", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679042846, "uuid": "cd6ebbaf-91ad-4d30-80fc-46a79fdc6d36", "comment": "Malware payload (STRRAT)", "value": "8e3caf23bd105ebd94c5eaf6888a5aa69c31be6f5b2656e3fae6456d940c270dfd6990f2b6a9d5b24b087906ea85c943", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679042846, "uuid": "e503084a-c25a-41af-a628-2ae80ff9e8fa", "value": "T1EA748ED691828B1E99390C2B859AF7114BE7F20A79178578D9FD5F8FFBF2C46001829C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679042846, "uuid": "9a25c783-ea87-4494-b0a0-1d66f2dc9672", "value": "6144:GQWwSOwzzZmp/ff+xMObFX7m/XawWdeaQj/kw36sbfuB08B3MLaPNSckb:Nf73qOXawWd8jkwpcBvlS3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679042846, "uuid": "3f4817bd-1f44-4de1-93cf-eb9aead0b765", "value": 358959, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679042846, "uuid": "ac230afe-f546-4b33-99f0-c1b6d7f998fc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679042846, "uuid": "a0559514-2d4a-4330-8e02-70ad7d65d05b", "value": "doc08611720230316153221.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07eba788-c4a4-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679044430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044430, "uuid": "e087f1cc-d866-4157-8eb4-89cefd4755b4", "comment": "Malware payload (RedLineStealer)", "value": "e72d9390fa6c068e276424f3e26eb389", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044430, "uuid": "695caacd-a2d4-4e2a-b903-dd95e58cbd8b", "comment": "Malware payload (RedLineStealer)", "value": "f1be808812aad08c49e977d77911399765923f01960f6fd1e327abf32a331c63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044430, "uuid": "83038b78-d510-4f7f-9785-8eecd4f3e98c", "comment": "Malware payload (RedLineStealer)", "value": "b6a34db4ed94cdde6c93d9a403825349b36f1c03", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679044430, "uuid": "80389074-715b-4480-bdaf-95f0550fe2b0", "comment": "Malware payload (RedLineStealer)", "value": "02205db2fe90ba0a1fd0cd43646aab20414dee3609859192a2657eb70db75b32d50322545360aa5ef5fd3b88229e2dfc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044430, "uuid": "c7504509-246b-45f7-ad0d-ae35a4d55e49", "value": "T11615124BABEC8431CE745BB01DFB02D30A36BD516B388395178E655A28B26F4A371737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044430, "uuid": "4eb7efee-a0e3-47e1-81e9-ac21f6c9e37d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044430, "uuid": "1a9948e7-1ce0-4c2d-b0dc-c812703e951b", "value": "24576:XyzMJaSHm2z9u1go91HkhnJKycFtBVdpEElF:izWZPoT9yhnMP7vpPl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679044430, "uuid": "6ba7a1f6-e37f-4a26-82e0-6ef31c0aec80", "value": 882176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679044430, "uuid": "cbffce81-90cc-4c91-97cf-17104ff27b15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679044430, "uuid": "a4d0faa1-90e7-484d-aa8f-9ff597e6e21b", "value": "e72d9390fa6c068e276424f3e26eb389.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57c998ba-c49f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1679042417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679042417, "uuid": "a0d44a4c-b71f-4e83-a354-03b8dd557fd6", "comment": "Malware payload (Gafgyt)", "value": "17a7fe2e45cc72b1b8575a70a37d069f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679042417, "uuid": "b7ebd2a7-2ae8-4752-9b15-022383e2ff24", "comment": "Malware payload (Gafgyt)", "value": "f1d9ebd547140157f30a10092a17e2caf05a5fd2fef0764862f27a9b0caac237", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679042417, "uuid": "15afbfac-d6a5-47df-8c02-520e3814ef1f", "comment": "Malware payload (Gafgyt)", "value": "d6a17685b20472dd00fb476f2ac495c8dbef9487", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679042417, "uuid": "f035434b-721d-4d76-ae5e-73950cd39b9a", "comment": "Malware payload (Gafgyt)", "value": "c0ae950a5753f53fb0ccc0822be7485df6048c2fc8be8db45c27d0fcebdc35edd74eef80f1bc8ecb46e84b7e424ec4e0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679042417, "uuid": "1537e546-1dc8-45bb-b887-dcce0d5e9789", "value": "T151B35B23AA62C67BC08357B42BDF99919923BC7C1B32612B33E47DA42F758C41D6D706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679042417, "uuid": "3f40138f-0cc4-414d-b288-9509ed79d79f", "value": "3072:1Ye6WOxfGgkCLqxMnpBjd1nNF7FFI3oF9F2LNO:NCumB1nNF7FFI3oF9F2LNO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679042417, "uuid": "2adc6a2f-4f38-488d-8012-9070a8bf323f", "value": 109352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679042417, "uuid": "82960b08-ae74-4948-95a4-bd923a4f57bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679042417, "uuid": "d87c9a20-169c-4cd0-9854-81559be72ecd", "value": "gummy.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c1171e7-c497-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1679038961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038961, "uuid": "80a95545-bb63-4461-bf41-89b3c0e43b60", "comment": "Malware payload (Heodo)", "value": "56db6c90b56003b852a9125ed0217efb", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038961, "uuid": "17a63b3a-30b7-48c9-9083-eb57fc7822c2", "comment": "Malware payload (Heodo)", "value": "f3f81c26d41599bba176e70db1f9354b2bdf9dd4c0e8fbaa710a213c010d88ed", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038961, "uuid": "08d2a4a3-7e05-463f-8da2-2a73bced79d7", "comment": "Malware payload (Heodo)", "value": "c556333d1cc5f0ab3ad520524f23a0af621c9a2b", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038961, "uuid": "2033d121-2a95-4519-add0-da745d5582cf", "comment": "Malware payload (Heodo)", "value": "2ab7d1f98acbb4b73e99e9dc593ccbaee120d69f30c460a07a4965f2040b205eb90d91e59ea0ae04ff78d8c7486b18d6", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038961, "uuid": "b9d4dccd-89b5-4166-9b67-442171b10f82", "value": "T1CAC33BF1A8025C0AE123C976B1FB661399D051ED42283B2BF87D507DD978A20D5DD8EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038961, "uuid": "1bbe511a-cbfc-4237-bad7-93bfdb72110d", "value": "1536:RDBoTVdaeNtuXndCrJJmT4HVnteV4FrdMiYcx7bfCb6HPdnXa:1BoC+tCYvSMVnte8ZP1Y6JK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679038961, "uuid": "d44c6c48-6aad-4082-8d2b-8df78b8ce366", "value": 120428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679038961, "uuid": "c25e7298-af8d-4dd7-b364-d4df073f5dda", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038961, "uuid": "4b43c9a0-a7e8-4592-a97b-e1831062c1e2", "value": "iMedPub LTD_1.one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e680919-c497-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1679039018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679039018, "uuid": "4a4f934e-4696-4f17-8636-b0c7302a6fb6", "comment": "Malware payload (GuLoader)", "value": "96e1e028ea09161bc14abb42586bbea1", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679039018, "uuid": "14f237b2-0416-43d4-9c0f-523f06eb1be7", "comment": "Malware payload (GuLoader)", "value": "f44db2964a27c9684530ae78700adf2c4b17ebfb371212ce41f9b4444594f639", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679039018, "uuid": "8266f200-a70f-4642-acf4-8cc2da07af5c", "comment": "Malware payload (GuLoader)", "value": "90def220920af0f81736287e642d4deb2f1d6535", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679039018, "uuid": "a8baad96-a5a3-42d9-a711-bd774aff80f5", "comment": "Malware payload (GuLoader)", "value": "fd5db83e6a269e849cb2bfc9299d3e5b079606cc70fab03e9255d2f9f64ffdfa65753b51d17d65ba8419f6f4c014014b", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679039018, "uuid": "fb973bda-b3ef-4c40-9fb4-2071e5df58aa", "value": "T1A04422813F72DAAA90259C20477D90AB8522B9CA1CBC356E633936FD2FFF14C18594D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679039018, "uuid": "0de953f4-b0ca-4651-9692-dc553f7199d7", "value": "6144:+zqB1+iTDPsYWDiyVRNzI8H3qQ/CzffW2c+IA41OJEaqd:/O8EBHLNzxJ6zf+X+IAFJEV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679039018, "uuid": "c7ac2d3a-d9f8-403d-a935-172d926abc97", "value": 276962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679039018, "uuid": "feb744cd-6f73-4be0-9a3b-5e92cd743d82", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679039018, "uuid": "8f903287-8b08-4eaf-a7ca-f05db3a36f38", "value": "SC_TR11670000_1.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "828c54e1-c4a6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679045495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045495, "uuid": "b9b00609-d50a-44f5-9376-052a4bc39737", "comment": "Malware payload", "value": "8ec7b07f258588237cd64e4c842a96f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045495, "uuid": "382df6a3-3c68-4fd7-94a2-c736a3e53fb5", "comment": "Malware payload", "value": "f49db6a8985c634f712aac39180f777ecf887b0c393ac5882f3c4caefbaadcb7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045495, "uuid": "22c115e9-c028-41b1-b85b-9c88284ca348", "comment": "Malware payload", "value": "4bfe447c636cd1c71bb0f7ad3d3e7cf131fc8044", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045495, "uuid": "a0e12175-52c8-4d47-abf5-dfea25893fdb", "comment": "Malware payload", "value": "05a3e9e3955e7bf732048b65c3cb4453642cddb7f3cdd0673d94bb6f73dcbdba143999347f7fbc195f8980b6fc9c2d09", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045495, "uuid": "14be5b37-caec-4f0e-a6b8-ebc197b310e2", "value": "T10DB4121A35E04F48CADC837887E15C4C9AF5A70B6668EC24383F17266DC52B54B536EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045495, "uuid": "cbfaee92-20b8-4241-aeb1-d2a5cce56d5f", "value": "12288:dp+aPtj1xKG8OcvvDuYJWjz7vtLH3GowxfKVqQcH1:2aPtBgG8O9jfx3Of8a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679045495, "uuid": "ead8f834-ad11-4eef-ad49-afa3aaee2028", "value": 537968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679045495, "uuid": "37c5947a-e977-40a4-be5a-c7a4af564df5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045495, "uuid": "2a41e0aa-07ac-440c-a607-c67f5f4f9a69", "value": "8ec7b07f258588237cd64e4c842a96f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81241535-c47b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Chaos)", "timestamp": 1679027024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679027024, "uuid": "585e1d88-ced0-44ac-8630-79e5989f6fd5", "comment": "Malware payload (Chaos)", "value": "80588ef251b3ebaa3da89fece7dd9743", "object_relation": "md5", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679027024, "uuid": "80626308-4dfd-4c49-be87-c77701363112", "comment": "Malware payload (Chaos)", "value": "f4a5aa80ca26fec66638d8d42d54bf261580b8a2d6a664cf74dd47028bfe20a8", "object_relation": "sha256", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679027024, "uuid": "7ac42b52-81f8-4ec0-82a1-20ac8370da2d", "comment": "Malware payload (Chaos)", "value": "8e9cadf5793282e9c3127b0c6de07960fe087711", "object_relation": "sha1", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679027024, "uuid": "95d9d3ba-a913-46a8-bf6d-fd51cb4c06f8", "comment": "Malware payload (Chaos)", "value": "fc5af9cc89e1128038000515b147e2e052e165106f5ceb76937830e8400cb3a4caa15bd56df8ef832fd8356ab84cdc22", "object_relation": "sha3-384", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679027024, "uuid": "a579661b-efd8-4512-84d7-15a985efb572", "value": "T1B434CE342EFA502AF1B3EE7D9BE4759A955EB7A33707885D20B1038A0723943DDC153A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679027024, "uuid": "cb228c82-5d20-4460-bb86-298cc3042644", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679027024, "uuid": "d8487622-bd12-4b2f-bddc-9903fd9ee4ad", "value": "3072:NoMYir9nL9z3+wdSe1WcBRjpW5VFMNBDf5qIS/QWqGiUEJhREVUAISsdWBYf7DSc:1r9nLhxhdsVFGEeRJk8nrKfQC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679027024, "uuid": "35881f83-17a0-4b5a-ad98-05a01fd5108f", "value": 244224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679027024, "uuid": "b11e7dbf-81c3-4e08-abc8-5c56b1b146cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679027024, "uuid": "43cbb933-2fec-4d61-a686-a7c5efe6ac54", "value": "2023-03-16_80588ef251b3ebaa3da89fece7dd9743_wannacry", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53d1d38a-c4be-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1679055724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679055724, "uuid": "87020135-1c83-4311-9630-5b338a781359", "comment": "Malware payload (Gafgyt)", "value": "940cbbe829c857744858660dc240b59c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679055724, "uuid": "3a74cdc9-40b4-46bc-a0f0-db1b36f0b3c8", "comment": "Malware payload (Gafgyt)", "value": "f4ad47337fabf2e543f43cdb494ccc9595fb69034359f98077ca6125d24518b8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679055724, "uuid": "729e6bc1-549e-4072-89ec-b2b1283f7976", "comment": "Malware payload (Gafgyt)", "value": "a9e3917499983759f3cc2d62a14377a8cccd271c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679055724, "uuid": "faf5f039-95fb-4757-aca3-48aa385c1068", "comment": "Malware payload (Gafgyt)", "value": "75581552e466007cc6085eb7c402aed886f0d2c665473e197696cc7fb34d616352631eb90e8ed6dd6965e0c41fd65bfa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679055724, "uuid": "a687c49a-6644-4329-9bcc-2d41452208ac", "value": "T106B30692F900DFF2F40AE67604C34B2566B0BF660F536A66B21739A79E721C43867F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679055724, "uuid": "cd337fc6-af98-489e-8109-33b8cf365a6d", "value": "3072:FQWUEK1FSHGfs1QbEE6QyPw0s/avcWVRm2pgYMx3IPtW:FasGfs1QHyP7sSc2Rm2pgYMx3IPtW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679055724, "uuid": "608204c5-4e30-4c53-b29d-66551a9c56e9", "value": 113759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679055724, "uuid": "73efb613-bf79-4ed8-92f6-c11592522901", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679055724, "uuid": "363aabd1-bc2c-4e46-9aae-f8630c0640fe", "value": "940cbbe829c857744858660dc240b59c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98d5e662-c495-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679038231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038231, "uuid": "3a9270f8-fc8c-44a0-aa30-7351876eccca", "comment": "Malware payload (RedLineStealer)", "value": "ae48105cb57be828132aebefd7e6286b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038231, "uuid": "4cfb26f5-d30f-405e-b0c5-e23ffa931330", "comment": "Malware payload (RedLineStealer)", "value": "f54879b358e1de86a6a5b2027a0a2a9e666f6eb9dbba66f8a431d495295ab715", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038231, "uuid": "6dc2b390-3d16-4641-a42f-6a22e2d988cf", "comment": "Malware payload (RedLineStealer)", "value": "f724a279fe0817a0065dcbc15f1b6e4c01e8bed8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679038231, "uuid": "cbb89c7b-12f5-44b2-a3f8-cc6159c86685", "comment": "Malware payload (RedLineStealer)", "value": "7bdf1543731df5ffac3d45abc07f8a125745e37c55909b59c1f5210c9bde22768fb48d3d1e448b0a2add12137b1d1a8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038231, "uuid": "07a9d3dd-d112-4ce8-b716-ac85f869fd38", "value": "T191048D1393A57C60F5664B718E2EC1F47A1FB4138E79AF6B23189A2F18701B2C56F712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038231, "uuid": "f4b10300-eb8e-4be4-83f7-49c5136179e5", "value": "4b2faf5e2157c756cf2fd31d6cfd3d44", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038231, "uuid": "e7108a71-515b-447a-aed8-360230962195", "value": "3072:KMu8A5sIJeY7MucAFc7Da6jIneSkJuHwjH5cvxPim/hVCPdJB:a8AaET87DaIIeTJoqgxP3/hIVJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679038231, "uuid": "64513cfa-57fe-4a3d-95d9-84ab4142c739", "value": 178688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679038231, "uuid": "d9b4e0a4-5ab6-4484-9a94-91899559bff6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679038231, "uuid": "e4ef1476-a704-42fd-bf58-bd1e2b84edcd", "value": "ae48105cb57be828132aebefd7e6286b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bad6863-c4f6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679079736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079736, "uuid": "6f7c507b-a96a-4449-ae36-9a4fe5589e1e", "comment": "Malware payload (Smoke Loader)", "value": "195abb468e546fbaa66ec219c4ceb298", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079736, "uuid": "919a7928-6c52-4e48-b6fe-eaab89fec68f", "comment": "Malware payload (Smoke Loader)", "value": "f556ab5cb7ef703c3584b538c8056657fedea624cfcc262295bca3b0dd8c839a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079736, "uuid": "96812d2a-b6ba-44fb-a088-92511499892f", "comment": "Malware payload (Smoke Loader)", "value": "3f465d9d286b9f687b2e80a751a7746b3de0a2ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679079736, "uuid": "304777ab-7509-4f16-b094-40703cd13b1a", "comment": "Malware payload (Smoke Loader)", "value": "0449f73c2af1c2977dcd4114974a97d69a425bdc9d47a76f9945ea592e240f1a2b7b3418d56c744d94b68deeaf0223ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079736, "uuid": "1e3a4356-bb74-43b9-b01d-e22b7fcba448", "value": "T13A54195392A17C49E9278B729E1FC2E8771DF6518F89777932189E2F04B21B2C163F90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079736, "uuid": "8fb541d2-bccd-406d-a4dc-1d72d0750fed", "value": "6e76b494f1a9946f83b6b72033f310be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079736, "uuid": "29f22719-8538-4b69-8a43-ba971f79f89d", "value": "3072:I0FeLgHLtyGI6veJP+CbIMT0B16RCmO87jm/Q3YiqI4y7itmpVuMR:d6gHLt7Iqg2C8MwB16smbTfug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679079736, "uuid": "adf8310a-bc29-457f-b576-b55f18078acc", "value": 303616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679079736, "uuid": "5c073c27-bc9d-402a-a5d2-009ea37aebea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679079736, "uuid": "20e54b3d-dc88-42b2-bf63-a4e19a545aa7", "value": "195abb468e546fbaa66ec219c4ceb298.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38624c92-c4ba-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679053960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679053960, "uuid": "706e748d-1378-4d3e-8f87-2052cacea5e3", "comment": "Malware payload", "value": "27eadcb9f04343ba902a7931f2405818", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "firewall-gateway-net", "colour": "#3FF98C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679053960, "uuid": "8bd8fc1e-9738-44ee-9c62-2e1b4334d7d8", "comment": "Malware payload", "value": "f5a15fe5b539876ed5696e5172a5251d5d3b8a73ca0f5fe1522958fb315094c7", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "firewall-gateway-net", "colour": "#3FF98C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679053960, "uuid": "258f168b-8e8e-4038-8a5d-404f0e7c1430", "comment": "Malware payload", "value": "0dce339662162d08c72ce7e4ad8ebb818ce821fa", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "firewall-gateway-net", "colour": "#3FF98C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679053960, "uuid": "f2414089-87b5-44db-90ca-5e44e27530fd", "comment": "Malware payload", "value": "bbd6811412209f55f1a3e1acd931adf77c74c291393e4d7981f7fe8b1f97aeb99af565b472533ff874848a16f4f342a7", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "firewall-gateway-net", "colour": "#3FF98C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679053960, "uuid": "20d1d90f-f023-4c11-ac2c-00d94093ef09", "value": "T15F33379ADDB68ED047500F6E16633E63CA3E3A4844BE85588FF75D0C43682D2992F727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679053960, "uuid": "9f91eddb-623e-4462-b94e-22ae22f5d8eb", "value": "1536:0L5Jy27rRSlpx7rRSLPHxpx7rRSLdxpx7rRS9AqoWwpx7rRSVXKwiAxpx7rRSVXc:a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679053960, "uuid": "d9ef601e-0a08-4533-ab40-a6d85cddb01b", "value": 52261, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679053960, "uuid": "b64c3c6f-6540-45ff-a6c6-de3bf818b97b", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679053960, "uuid": "7352b38b-abad-4bed-82f8-aa3fa8733b18", "value": "AMD112204.pdf.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6767127a-c4a5-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679045020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045020, "uuid": "7e56f560-f1c2-4050-9e89-b70a264618cd", "comment": "Malware payload (AgentTesla)", "value": "a983dd23ea30dc4c94881bf5e3a2fbdc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045020, "uuid": "82834690-739f-4c5b-9a61-c65df940c6bf", "comment": "Malware payload (AgentTesla)", "value": "f5d87682a45a92cc4dbea8ef788846df4492501ffea1ef1da4fbe7372ee5f44d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045020, "uuid": "bf77a25b-bcb0-4ba0-a09b-8775dd6c51d2", "comment": "Malware payload (AgentTesla)", "value": "7345aeef2a379727c9d0d5d4d83880f943a2b101", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679045020, "uuid": "3be93524-7dfd-4610-a8f2-23c7726e10f8", "comment": "Malware payload (AgentTesla)", "value": "da00762b407f7fe305a78e7bf830025488bbe731982b36932663f32d6d1f082b468045697b2c82b151c5966e15b73218", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045020, "uuid": "b95ff0c1-8ba4-4be9-accb-c0c6289138ae", "value": "T1CF05028EE6B4582EE51D0AB6A4932454637556237FC2DB0BACC850DE2F237EFD4609C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045020, "uuid": "60943061-f5e0-4c14-ab21-d2a17d4b62a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045020, "uuid": "a8f81efe-205a-4d8e-90eb-89f0069908c7", "value": "12288:gE4sQwoLkO6fAkflhth006PNF/ss+FG5oWknid2IKZjigx98kBnuC8dLvFzPQ:gsQwcKnU06PNFUs+a94Xx99BDOzPQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679045020, "uuid": "9c734c5b-a649-4b0d-b29a-27902cd8e138", "value": 819712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679045020, "uuid": "2aa9f38e-f97d-425a-943b-e089a0b53bcd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679045020, "uuid": "90eb0acc-5983-4639-9433-2cd9a5c37ecb", "value": "a983dd23ea30dc4c94881bf5e3a2fbdc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "567e1270-c4d9-11ed-88f6-42010a9c006e", "comment": "Malware payload (LaplasClipper)", "timestamp": 1679067325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679067325, "uuid": "c5da4285-3ac4-4fb1-abc3-060cd5a40e55", "comment": "Malware payload (LaplasClipper)", "value": "12358cc9592b4794a0fd578a9c27af31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679067325, "uuid": "1b675cb3-c719-4c8f-9031-770c32710e62", "comment": "Malware payload (LaplasClipper)", "value": "f610f0b058b6dcd9afb90f2861251606dca490db7001d66e252bb704fcc551c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679067325, "uuid": "cca2984d-5d01-4a11-a1bd-7b30eda5b011", "comment": "Malware payload (LaplasClipper)", "value": "050e5d65a1460c0363e8316d5b75b4e13374d7a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#