{ "Event": { "published": true, "date": "2023-10-14", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-10-14", "timestamp": 1697328181, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "c56b27c4-f7fd-4e5b-ad9e-0c3832c031cb", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "970aba77-6a68-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1697270793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697270793, "uuid": "aef6e7c8-d503-43f1-8f9f-8c1e3112479d", "comment": "Malware payload (Gafgyt)", "value": "90b820263a4b5ff663f1b51dcf1a689a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697270793, "uuid": "8f803772-6980-4f2a-8e52-fb512f837591", "comment": "Malware payload (Gafgyt)", "value": "01052dda9eb332c9ef13be2c65e03b8dfa5847814947fde744e89ebc1a181501", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697270793, "uuid": "9290fb15-70e7-4079-b274-022a4ba3f698", "comment": "Malware payload (Gafgyt)", "value": "e374361e854e4416b081cd537b3ea60070bb7b71", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697270793, "uuid": "804ada7b-4873-4c5e-8408-872f1904758b", "comment": "Malware payload (Gafgyt)", "value": "3eccb7b0596408198b746d65fd1448f76c8f4a4637bca18b7402407f05da4bad388f9b7cb15353d5168dcf29457c78c4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697270793, "uuid": "f7e6a546-8541-4dab-be0e-24ef667fa70e", "value": "T1BEC32845FD829A23C2CA12B7F66E428C372513F8D3EB71039E225F2577CA45B0D67A85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697270793, "uuid": "43c2b71c-a8ee-4539-bb8a-c230768ea7f4", "value": "3072:Byi+V1WxkGr3UDHB+hHj6SDUjRpmkm9wbZnN:Byx1CUHB+hHj6YimkOwRN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697270793, "uuid": "4b554351-bf30-4676-a727-2221d8ae6073", "value": 124588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697270793, "uuid": "ffc24acb-47cf-4279-9858-9aae174eab1a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697270793, "uuid": "c9130cd2-5b7b-4585-94d4-596c1915c89d", "value": "90b820263a4b5ff663f1b51dcf1a689a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "492d9384-6a7c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697279253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697279253, "uuid": "fe0fc6df-bfff-490d-a0db-0c5e792dd62c", "comment": "Malware payload (RedLineStealer)", "value": "2b7bf7662f6eb37fa5c9b9c3472cf16a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697279253, "uuid": "eefe12e7-f00e-4b7f-b631-9e2704ac39eb", "comment": "Malware payload (RedLineStealer)", "value": "0113366d8cbfa59c27d79a4e43096d2aaa77099e44db08bd029fce48bd13b308", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697279253, "uuid": "624e9826-d952-460d-a562-f5c28fc18479", "comment": "Malware payload (RedLineStealer)", "value": "d33fdc941adadbf99d5bdd6eef18646ebbe09913", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697279253, "uuid": "93ab11fe-6c46-467b-bb8e-88037c6b65a4", "comment": "Malware payload (RedLineStealer)", "value": "e8765ac888152d7c08c44353f29d532888db940d1256efae63d8ad96e6dc5f47bf1c44f928e5f248a7efe97255c1f7ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697279253, "uuid": "21dcf4e7-3e80-4a91-8788-22f270ef3cf3", "value": "T13824D776F308551CE87E433DB05C34B09E707C52E1AEE32E45EA7EE9693BB498A144D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697279253, "uuid": "b4ce33fd-2620-45a6-b4b9-f7f0288c813d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697279253, "uuid": "c19f38a5-80e1-46ac-87a9-22ec47a1cbaa", "value": "3072:A0DenRNgcJkem8R3BykVxVju3Wrt/que+k6ARHHeM1T4sX:A0iRNgcJkD8RR7Vx5Lp/c+k6Al+M1T4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697279253, "uuid": "f995aee2-d171-448d-bf2f-fa49242736ad", "value": 226816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697279253, "uuid": "0d93b8f4-8912-4d79-8226-e1ed81559bc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697279253, "uuid": "cba553c4-d0fb-4413-9f40-c11552e5859e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a0b9f57-6a68-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1697270772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697270772, "uuid": "6d57486d-33a2-4608-90c7-05f7ef052de0", "comment": "Malware payload (Mirai)", "value": "b5dd17bbdc7b9217b1b013f2b8299484", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697270772, "uuid": "1160a74b-4493-4327-a022-1e80d3106446", "comment": "Malware payload (Mirai)", "value": "03940b41b350dc4cb3224fa931a8175e1c0553fc90608cb285ec296668731e4b", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697270772, "uuid": "fe4d206f-7ace-4a65-a094-e2b1609891ad", "comment": "Malware payload (Mirai)", "value": "f2fe102a13569496502d8746d1c2d9eede3fa709", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697270772, "uuid": "3b4b1945-e095-4033-adfd-ee92870b5edd", "comment": "Malware payload (Mirai)", "value": "72fd57e39e156f9d882f5c1128711c32d9869b0332f3567ba018ee157928db78a0535a72da50d5d5218f2d6343f76cca", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697270772, "uuid": "4710cda9-ba0a-44fc-9025-eb8b98512d14", "value": "T147F33A07B9C188FDC49AC1744BEEB53AFD31F4AD0238B16B67D4AE226D4DE204E1D954", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697270772, "uuid": "e5d2f1ab-6432-4321-a42c-56a8c9e6198a", "value": "3072:KJyy5+JJsDoE1NvZB8meYYB3lUowb9upg7HSq/jq/ou0aZFk3jwbZnli:KJyy5+JJsDoE1NvTXewJt7D+/tk3jwRc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697270772, "uuid": "42e0ecbb-e40e-49b5-9de0-102737eb0c5d", "value": 162904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697270772, "uuid": "178d83ff-8486-4955-a328-8f8e0c9e8c24", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697270772, "uuid": "dc97a301-a02b-4b2f-b63c-5d99a5cd66e1", "value": "b5dd17bbdc7b9217b1b013f2b8299484", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7bb66ae-6a46-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Glupteba)", "timestamp": 1697256245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697256245, "uuid": "8b3b562b-6866-4e1a-b632-273e17d19b0c", "comment": "Malware payload (Glupteba)", "value": "57d386d0858a5f2150f0b82af4e67de7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697256245, "uuid": "3157505f-af73-4619-a7e0-2614fa8285f7", "comment": "Malware payload (Glupteba)", "value": "03e8ce6519475df85008e4abed555b02150fb60d8afb039b98a3fae433679c4c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697256245, "uuid": "8cc3cd7b-2b3b-478f-9cfe-77c544318a86", "comment": "Malware payload (Glupteba)", "value": "06916048d99a85666a97ddaa08694ec8a4b684b7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697256245, "uuid": "63a1b84b-282a-4e1b-b201-daa7f120c547", "comment": "Malware payload (Glupteba)", "value": "6fabd7fdfeb9fbe0bfe6e0f2a85e70fa86a2d815fec355a8ab5b64249330d0ca785f18978780f7712d67537dbd52db91", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697256245, "uuid": "ac28391f-c433-4209-adb4-19722bfad9fc", "value": "T15B16330351D0BD10EA754B718FAEE2A4BB5CB1388F496BB6224D8E6F54F63B8D523314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697256245, "uuid": "d4710d21-e081-4911-acee-7c82b3149564", "value": "c8ca39682f8a2566a6ffea9ce3c85ff9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697256245, "uuid": "b92ab499-c39f-4ee0-9b93-d4b5f102b6ea", "value": "98304:rOd3sthAcDwT4/1Fur5ufQiZe2wtO6aKZfS4/DEHReGvNi2:rDthnwT4/fw5m14thhAhHRear", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697256245, "uuid": "6555833c-bd38-4f13-92fb-56f4982c0c3b", "value": 4314000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697256245, "uuid": "3dc7b4c9-6fa3-465c-975d-9f21e626dcc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697256245, "uuid": "be0feb28-87f3-436e-9b7c-369015574fb5", "value": "57d386d0858a5f2150f0b82af4e67de7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91693139-6aa2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1697295695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697295695, "uuid": "df237be9-3d68-4b83-b6d2-91df38ca1142", "comment": "Malware payload (Mirai)", "value": "e8c71ceba5eddfd11a4d7093550967db", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697295695, "uuid": "d62df792-a83d-4c55-a3c9-5aa0caa26e81", "comment": "Malware payload (Mirai)", "value": "04030e71fbc7a889db653ab9d8d44807f0b9fb5989e6f0a1259d266c2325c531", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697295695, "uuid": "89bc41fe-7018-49f4-be4e-e6d4d4ea9240", "comment": "Malware payload (Mirai)", "value": "a739c3d191ea4cb7604282a37d7dd346a605b2c2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697295695, "uuid": "7879c51c-f5fa-4d48-8550-40082f4c2571", "comment": "Malware payload (Mirai)", "value": "5b75fccb8a572cc58e5dcc8b89b1ee5d5d5e7a321511c7c9de556deffdfbd66659ce9f46f53e2c9997e2fc9a477294f1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697295695, "uuid": "3c9f2311-aa59-4a91-9475-671d67bb92d6", "value": "T1DF931986BC409A11C6C50777FA2F108E3312679DE2EE7262CD141F647BCA91F0E7B696", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697295695, "uuid": "3eeb433b-3c8a-419e-bfa4-21852cae48c8", "value": "1536:+JnSNBp3SzB+VrXFP5xMb5WR3Nbgv9iCJ70qpdVxZWkAWzoAINiCVthmsot:xNjCzBCTFP5xyQF6YqpXxQzVthms", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697295695, "uuid": "26b90f75-48e1-4310-9f67-4fb33e471e7b", "value": 92752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697295695, "uuid": "5f634915-3fac-4510-b988-52f6d8f35aa7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697295695, "uuid": "c03c2821-9d93-4f68-8bb7-12d003a4a781", "value": "e8c71ceba5eddfd11a4d7093550967db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fe9b1b4-6a32-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697247481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697247481, "uuid": "d090d1a7-008b-4b13-a8a1-fd11bdb10ed2", "comment": "Malware payload (RedLineStealer)", "value": "aabe5284e611bab71c8fcbc6cc4b63d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697247481, "uuid": "57fbe656-2104-4e8d-9e3c-fea9cbff05ff", "comment": "Malware payload (RedLineStealer)", "value": "044cca0605434c6cb48b00cd5ed4439e8a4205b7cf6f5dcaf5eaee57ceecc33d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697247481, "uuid": "e62c1984-fbe6-424c-ab73-2e2e7c6c36cf", "comment": "Malware payload (RedLineStealer)", "value": "e7ef0bcf617240139e0bd14efa38958f9aa6302a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697247481, "uuid": "6f0d132b-332f-475e-ba02-4bc05a35174b", "comment": "Malware payload (RedLineStealer)", "value": "87fc0dbb788e3f0e6f5b6fcc7e2ef6d3e70a3623bbf6e6b07d36211e53313eb2034e63a949fecfa5e7d6578868dae52f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697247481, "uuid": "9527e98d-9406-45f5-b9d0-8d1f50a8341d", "value": "T108752326FAE09036EAF0AB714DFB16532B34BC919C3453BE5E46258F0C7295095B273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697247481, "uuid": "9db1ea7f-656b-41ce-b034-f58706822356", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697247481, "uuid": "9daee60a-0726-441b-a75f-d38c9b116f7e", "value": "49152:YskdP+xwGSqBoZaZgJhIwoaIKKpDXYRJhhpo16Z6:zMOdBo4nwoa12DoRJh86", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697247481, "uuid": "4903a6f1-2984-44f6-acdc-acc80ecb6b49", "value": 1625088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697247481, "uuid": "59fece20-7baa-4280-9ebc-51ca5d1b2873", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697247481, "uuid": "8d0bda2c-6a36-43a6-a5a2-7cdbc857b524", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b511e495-6a68-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1697270844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697270844, "uuid": "1d7bbda5-24eb-49ee-876f-b5300d5cb8fd", "comment": "Malware payload (Mirai)", "value": "47f08b3d3ba9465d17b0ce91137835b1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697270844, "uuid": "00ac253a-3740-4b90-9e89-55bf0a59d785", "comment": "Malware payload (Mirai)", "value": "067389a46605a3a12e8bb6acd0ddabc10258c12ea966fab480684823dd0d202c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697270844, "uuid": "7154991a-24d6-4f0c-a2da-ddffad4e7301", "comment": "Malware payload (Mirai)", "value": "ce136c3f0d6747a6d60ce4d183b66f10193ae249", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697270844, "uuid": "9feab64b-fb9d-4d71-82f0-566860b05ebd", "comment": "Malware payload (Mirai)", "value": "44752a5361b36419dab50da55c0ef18143e89fedbaffececb4a28b09910b89185c6afa8e9ae17a2da149a7b923a934f7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697270844, "uuid": "2f1afe03-f6ff-4b00-b747-d3d491a97855", "value": "T1E8C35CC6F801AEAEF84A93B6445B090D797053C06B63172AA7DB7EE7EC370D46C15D84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697270844, "uuid": "6bf778cc-ae33-4b5f-8be7-c586c306a71e", "value": "3072:pBNjzEIXKPXWrQr4WMsvHd9j1ngRvyOq0dteTBnbe:imK/x0ziHvj2yO7dteJbe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697270844, "uuid": "4d88446b-55fa-491b-9107-7c528a45da17", "value": 129968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697270844, "uuid": "2ea8385f-0400-4a70-9b79-2df706eb755b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697270844, "uuid": "4ce47874-1532-418e-b814-fb5d0791018f", "value": "47f08b3d3ba9465d17b0ce91137835b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaf8b884-6ac3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1697309911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697309911, "uuid": "232a628b-d8f5-4657-9600-76b1ee797131", "comment": "Malware payload (Mirai)", "value": "7d6ad31613cb469e4227c689c7b61c7e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697309911, "uuid": "6210f5ee-711c-42ca-8e7d-6071351ddb59", "comment": "Malware payload (Mirai)", "value": "075e8ca9d1c834dc8e2bc02b3eb88df11a02429e4ae18967b88e4b4f1a560b0c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697309911, "uuid": "8f167112-3e37-439a-8d71-84e5ce1e9a80", "comment": "Malware payload (Mirai)", "value": "505a0f8fc82f8e08bae8ba315df23cc4cd6fa7fa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697309911, "uuid": "ccbec4b3-1b7a-46e1-9b90-49bc7960bc01", "comment": "Malware payload (Mirai)", "value": "8e533f0e6b49b8588701daa76cc76eb4e8b616b0847368a786fccac84155088ee2eb928d33517c3d83410455b0c3fe3a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697309911, "uuid": "6db8202e-a5b8-4e47-a254-b2367ee668d7", "value": "T191235B67CD392E54E268DAB0B0309B3D67A3E56596473BAF1066C2789003ECDF9063F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697309911, "uuid": "6cc62c11-02ce-4c9e-bf30-43c6e1b6c1de", "value": "768:alIQlm2AscZbPfzlsRK44M8azo0vET79CC7/JMflTzoxI:alllK7b+K44MfE0+79CC0T8x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697309911, "uuid": "62896793-74c0-427a-8197-dfa9f3072656", "value": 46368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697309911, "uuid": "91e6129d-8c67-4cb4-9889-88bc1ab0885e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697309911, "uuid": "c1cd6f97-6ff6-46bf-82cd-e66f702ed698", "value": "7d6ad31613cb469e4227c689c7b61c7e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c648545-6ab0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697301565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697301565, "uuid": "d12cb59b-e116-4cd9-bcaa-2633e87d455e", "comment": "Malware payload (RedLineStealer)", "value": "089a5cda8258c1db4a480c9effbbe605", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697301565, "uuid": "e4423eb2-62bf-40bf-9af0-d2b97c2beb4a", "comment": "Malware payload (RedLineStealer)", "value": "07a909ceb7de84d106e86e0a7102a15650c52ba903d087ec5432362a6fe68f3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697301565, "uuid": "03767081-9b40-4051-a1fb-79b2e99f63c9", "comment": "Malware payload (RedLineStealer)", "value": "d429bf366375b0a469305181d94248a40ba9e360", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697301565, "uuid": "a8513d7b-03ef-487a-b6f8-d2aa192b812b", "comment": "Malware payload (RedLineStealer)", "value": "83cdee243fe4035aa136793899d3b3531b4296ca4824d4705f146b3565c06f4b1da70f8bfa6f0957625ece9875a69390", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697301565, "uuid": "723a0c88-8c63-4f3a-bd61-a88f3033198f", "value": "T11C15224BD5E89072E8F52BB094F607971B367CA09E28436727512DAB2CB2BC5D532733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697301565, "uuid": "88c85a7a-b844-44c3-89d3-ecdc179fb0e7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697301565, "uuid": "c652afab-3ed0-48ad-84c2-6eff62a2743a", "value": "12288:tMr+y90mRgn/d9E52CTxGUQ06TgXu721FpRIbSDc0WyChDwe5t7duZQcH7pj6:XyiXEhdV6Tg+mfSM2ZcenduZzd6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697301565, "uuid": "9d653f81-9c3f-4691-86bb-c3cbd8727c9f", "value": 897536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697301565, "uuid": "355f4c1b-fda6-4d36-b80c-67d38ecea405", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697301565, "uuid": "d6b96be9-30d1-4ea5-ba93-20f9c2262e30", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b9d8d1c-6a3c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697251849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697251849, "uuid": "bb1e9e70-539a-4010-8de5-940b77f34297", "comment": "Malware payload (RedLineStealer)", "value": "845383d49ef89b0afe6e2518a9ded6a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697251849, "uuid": "61a04c53-9b9e-4ef2-bc9b-19da57ba0606", "comment": "Malware payload (RedLineStealer)", "value": "088086009b5ad97fb67f348bb0fd23536ab8c804f0fcf0123f63016c944bac70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697251849, "uuid": "de299f82-6ac6-4944-a6bc-e98dae1b6b42", "comment": "Malware payload (RedLineStealer)", "value": "c953eefdaff83f5d29844db1b005395a8d0e9669", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697251849, "uuid": "fb0a3ea0-000c-4003-94de-c0e952fdd3c5", "comment": "Malware payload (RedLineStealer)", "value": "79ecc8cbcc86855280082a77a5e967cd26aeefd93ce39e992c3e0bf355b1bed0dedcc0cad1b8d20c437f9f39dc18d28a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697251849, "uuid": "d086731e-4f0b-462e-a920-5d2b7a4f724a", "value": "T138752396FFE5C535D5A02B7058FB43C31E3ABA910D6987AB7E85C48E44723E409B0B1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697251849, "uuid": "0f6b67b6-794f-4f4f-8bca-216aa6d3d1f8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697251849, "uuid": "96762e96-276d-4b94-8c1a-8b49e0056b71", "value": "49152:5X75FASd1OmBaWfSBGWZgDhcIca2D5Fz/5msZ0tAz3HPlaJeo:N5FASd1OltBbVIcaYrzAsZ0Oz3N8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697251849, "uuid": "3f2f5eb7-f90d-4a36-b6e4-1850f4245966", "value": 1625600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697251849, "uuid": "18bfab20-6e28-42f2-9e3a-2f672db146bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697251849, "uuid": "fdae5d0d-8d3b-4fcc-ace3-99d5fc539042", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c63513ba-6a4c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CobaltStrike)", "timestamp": 1697258847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697258847, "uuid": "d55bc94a-ff7b-4a5e-a3e3-ea081858c0ba", "comment": "Malware payload (CobaltStrike)", "value": "61e4596a05e24c5128f866f4d70659ef", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697258847, "uuid": "d7e631a8-62b0-4285-89f3-14cb674e60e2", "comment": "Malware payload (CobaltStrike)", "value": "0e9f26b9a92ba13916a6e98de924397ec3adc68507a1447a0472d1b4e4d8b2df", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697258847, "uuid": "a4509657-2e92-4a99-b755-ae238bb1b618", "comment": "Malware payload (CobaltStrike)", "value": "a95c0c07d8813ba44399a700337a2327be4c7c70", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697258847, "uuid": "3c1f8420-0ea4-4739-be44-08a3dcf29d0c", "comment": "Malware payload (CobaltStrike)", "value": "c200614a0ae9aa3323f39b20658a55b8f86339e1e58c6789d9f716eb91ce240e0c2e7cde4522df63adb67c2227f04cb8", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697258847, "uuid": "4bc35b50-a38d-42d0-8def-69d93b964b78", "value": "T110E59E96A7A400E4D9B7C138C9569627E7F2F41513B29BCB06A4C6B50F13BE26F3E740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697258847, "uuid": "ec638bb2-74f1-44b3-86af-7f9577aef592", "value": "f9d27338d7905e39968aef1a4c4b80cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697258847, "uuid": "2ae4abcc-ed05-4470-aa90-be0de616711b", "value": "49152:UGtlq24VwASOM4IU6iDRq2h8Ti6fHXryLjsoc9CjC4J8ugJU1mPt0Dv4t:3H+1q5NIj1J8NS1JD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697258847, "uuid": "d1ecb578-847a-492c-9c38-babe0a6a8c2e", "value": 3049984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697258847, "uuid": "3cc6135f-1159-4280-910f-2f2c723ed69e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697258847, "uuid": "451154d7-0bdd-4432-a410-13c547f9446c", "value": "61e4596a05e24c5128f866f4d70659ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b13ebac-6a60-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697267284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697267284, "uuid": "65781e9e-71ef-4d02-ba84-bd9fb5cd035e", "comment": "Malware payload (RedLineStealer)", "value": "9fcf03231947b9f264b90cbf64d4dc2b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697267284, "uuid": "d0f6df21-3f44-4669-ba34-a6af2673f493", "comment": "Malware payload (RedLineStealer)", "value": "0ea90f2f2442f48762033d02ee9f3b0ea3c2e7de7cd0a60cb0e1aedc5e0a60fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697267284, "uuid": "f327d39a-d08b-4482-af05-b777539b5dc9", "comment": "Malware payload (RedLineStealer)", "value": "1b9f938f5daa331942a788e539d1c00ee5e837d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697267284, "uuid": "98d1ffa0-f33a-4335-861d-c229e7dbea9f", "comment": "Malware payload (RedLineStealer)", "value": "2ab73b5046ab994341e5f356e4703dc637377a56c72ff8580511a385a31537fe21330bc192e7b040c5e7c74e0a443d9f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697267284, "uuid": "4f84a9d6-8b96-47f9-b813-bbe50b260cbb", "value": "T17A752326DAD58462E47A273004F652D30F36BDE55C308377BB81D84E09B3BA467B27A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697267284, "uuid": "52056d41-92c8-4b20-8596-3ac8fed74013", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697267284, "uuid": "347d4e13-bde3-4a8b-88f8-f43620e0a631", "value": "49152:rct3NWa6rM9R4w1lGme3ZluZgphxuEaKQFEDhecT2t6WbP:At9WaGaJfwEiuEa9FEIgw6WL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697267284, "uuid": "8bbb460b-e3dc-47d2-843c-122f0bba47a3", "value": 1624576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697267284, "uuid": "7ea6bf47-3493-4ce4-a666-d11d989b4584", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697267284, "uuid": "f14bb831-e2a0-459f-8149-781a414692f3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81f63f86-6a3a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1697251001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697251001, "uuid": "021eb204-9807-4ae8-a754-a2085886bbe2", "comment": "Malware payload (Smoke Loader)", "value": "1f3fbfbc2d8fc3a19129cbbea3bc6ad2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697251001, "uuid": "11da1375-d647-4468-8771-ab1163e2190e", "comment": "Malware payload (Smoke Loader)", "value": "10ee43cf3f520a07cf08c39af0b98286e7e131f4f07baabe494c28b1030e10cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697251001, "uuid": "b6c55a05-33ac-4cb9-9582-177b2b887111", "comment": "Malware payload (Smoke Loader)", "value": "8b3a82175695e9ff6329aedbf15c0d4ade29989a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697251001, "uuid": "ad969b3d-ea3c-4147-bc9c-4ec29651fb67", "comment": "Malware payload (Smoke Loader)", "value": "bd8c78d026ceae8c552d66ab25b14e9677117959ec9c40ca9456cce7fc5c2648a9e2534e2a856fc44a83782a177f5cd2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697251001, "uuid": "c38e17ce-1fe8-4f70-8841-d652bf4d1f6f", "value": "T1BA752326C7E4C833D9605B3048D607631F713E60AE7482F75B86E9598DB36D896F072B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697251001, "uuid": "057a3985-455c-40cd-8b00-75dbdf925d8c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697251001, "uuid": "6589aecc-2409-4584-a838-2978a2c44329", "value": "49152:0qdbVtmQvmU3/gd9h9HZgPhqTaaNfNr6HYpoCVrAS:Xd5tmQvmU3g9hHTTaaBNGk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697251001, "uuid": "f9ac9ecc-dbf6-4931-a40b-7e0a4dff0fe6", "value": 1625600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697251001, "uuid": "e02d415e-6ec7-480c-b33d-24af72a23f06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697251001, "uuid": "c7e42756-8f1e-48cc-bb29-0ac1018039ac", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8e89959-6aa2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1697295734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697295734, "uuid": "511bcd86-681d-4c55-bf9e-37560ff57f67", "comment": "Malware payload (Mirai)", "value": "923497e576dd9ae1061d713e3075948d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697295734, "uuid": "dec23604-c15a-47bf-8274-b90513e5dc49", "comment": "Malware payload (Mirai)", "value": "11e8482d50901fca70e20e5c773aeb9a94bc918eb6a9180868fd57d80ab4751f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697295734, "uuid": "3ddd199f-eb9d-44ca-b979-65932ddfd2ea", "comment": "Malware payload (Mirai)", "value": "74e316e174439f713e916effc7ac5b0fd359ef55", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697295734, "uuid": "2a73de91-c6a7-444c-b6cc-29f508c3f663", "comment": "Malware payload (Mirai)", "value": "1861ab431effd80d58c768d8881087ac1663e83dd9b653c39948f4240fa1b9ff53db3510b3a24ae7fd2fd62df76b6aec", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697295734, "uuid": "5f9f16f3-ef85-489a-8639-4f499fa7f170", "value": "T11083F881F8C741F5C417493460ABF33FCA32E57A80719B6DEF999F26DA27602911329D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697295734, "uuid": "55d081fe-5932-4bd6-a69f-59ef69e4c989", "value": "1536:BxdeVSDsgyIuj3QMAwdTsymavw1KfW9zYKYWoHkdoTU2V0t:BXWgRuj3Wwhm/Kf61YWOkoQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697295734, "uuid": "8d14bc31-d2aa-487a-9d36-0b3574859b66", "value": 83696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697295734, "uuid": "a3f35c78-0c15-42e7-970b-a3cabb170ee4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697295734, "uuid": "d2af161b-6a93-4ce6-9319-4ea4ef8e9ac0", "value": "923497e576dd9ae1061d713e3075948d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4427ba6c-6aa6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1697297283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697297283, "uuid": "0e4a12e1-e5de-48dc-be70-3a17a91a8267", "comment": "Malware payload (Amadey)", "value": "5d8d3ba9ca62140c6a55ee3023eae762", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697297283, "uuid": "422ba244-2e17-4139-9508-2dbee1b78088", "comment": "Malware payload (Amadey)", "value": "1280f3b0685a9b93304138a84f844b46e9299e692e39cde9c3aff4f66c0a1171", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697297283, "uuid": "9edeadd8-4c4f-4bb9-80f3-9f72edd3509a", "comment": "Malware payload (Amadey)", "value": "108ba9f4146c692049b75458f2a3867882bccb1e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697297283, "uuid": "037081b9-772f-4f29-aa36-586c5c24143f", "comment": "Malware payload (Amadey)", "value": "e8da6b622590f70e216edf947f2b05dc50da43b588015bf67538433f253b5b004c5355147318ee8a3d163bfa991601e1", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697297283, "uuid": "f67a746a-3a7a-41d8-a36b-bffb4943bcdf", "value": "T11D2522A3B6DC1472D8B853B02CFA12931B367EA1697887AF339A49241CB3591B471367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697297283, "uuid": "b35e94eb-1de8-45d9-a0f5-3f09e4e4e9b6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697297283, "uuid": "6627b07f-83f5-42ad-8a31-3a635bfd28a0", "value": "24576:ay/m6V9OpewrmRtfUHTt4QelnshBMn52Y/:h/P9cmRdUHTtAYMn52", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697297283, "uuid": "8599c3ff-dfc1-43d4-a506-9e181d571d9a", "value": 1004544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697297283, "uuid": "740e7b0f-aff6-4c19-a3e6-b09aa2dc0b10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697297283, "uuid": "aadeedd6-c293-439a-b328-955d46bcbf20", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e08f10bb-6a9e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Cybergate)", "timestamp": 1697294109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697294109, "uuid": "227aa21b-4c16-41e3-86ac-2e98a8e7d9e2", "comment": "Malware payload (Cybergate)", "value": "4d670ac64fae74bd0c53f58673c6d826", "object_relation": "md5", "Tag": [ { "name": "CyberGate", "colour": "#7058BE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697294109, "uuid": "43026f62-8443-4876-8f85-0c8229a6e9c9", "comment": "Malware payload (Cybergate)", "value": "12975bce5682b4d6a0849c73a8924f074e9fc12e9807e1773e3d80656851d1d2", "object_relation": "sha256", "Tag": [ { "name": "CyberGate", "colour": "#7058BE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697294109, "uuid": "900e043e-8b43-41c9-94da-3e97439647a4", "comment": "Malware payload (Cybergate)", "value": "5fcfe71b322f91bc65f58892bb7024d78bb9b43b", "object_relation": "sha1", "Tag": [ { "name": "CyberGate", "colour": "#7058BE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697294109, "uuid": "00dda432-6f51-466d-8393-666056e213a9", "comment": "Malware payload (Cybergate)", "value": "6b1bb0a6569e90d1e0742f6592b77826a1f187b86c14d080e510ceaf94e312fd83a0c64eafa71e6403b111cd420c2144", "object_relation": "sha3-384", "Tag": [ { "name": "CyberGate", "colour": "#7058BE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697294109, "uuid": "43ae2593-5d41-4a12-b921-4e7760c741bc", "value": "T16194F15B6525DF97DFFCB0357C5A8F46132262978EC348421D76E8EAA8EC4C25830E4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697294109, "uuid": "9d1482d5-9832-4426-b904-def51c4e2863", "value": "584fd5eb78a03b8cecd88ef9e4be124a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697294109, "uuid": "0de7c5fa-8798-4b07-8466-1f336c06d447", "value": "6144:WIA2TfeZd+WnuiCrnluCuSD/Tmd6et08DOUlNre2fUOi3Mw4NwoGC0vQhvxeexNh:S2G+WufnQQ/ff8DdNC/Oi3rBvQhUCjV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697294109, "uuid": "dbd0619b-c810-4ec5-8cf2-149cada274e7", "value": 432951, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697294109, "uuid": "dc8a11fd-2190-4e8e-9d05-68e0c6c42d62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697294109, "uuid": "137dc6e8-d572-4c40-bcf0-d94700b41859", "value": "4D670AC64FAE74BD0C53F58673C6D826.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8fe27ac-6aa6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1697297452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697297452, "uuid": "b09a2a4d-5e51-4522-869d-9692ca3fe7fe", "comment": "Malware payload", "value": "ed9c5a278457f74d4cb051de635c1246", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697297452, "uuid": "ccd8e239-2111-4d08-a926-fe3755fa1482", "comment": "Malware payload", "value": "13de3c4b8d11b12439e9ee383fbba3a05a4a85df0bcd04a2e20810a81dd4dc5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697297452, "uuid": "dcdf716b-d48e-4adb-a441-72c7c0a05fbb", "comment": "Malware payload", "value": "71013facb0e4e7876345434389d62ca51f2bcd2b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697297452, "uuid": "674d0c97-d124-457d-9aec-19e959426de0", "comment": "Malware payload", "value": "eb3e5da50e5540e5f2d3c6c3f5bf4d90f956834737a5ba42becbff156f47423c8d5934554a29962d77090004771f40f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697297452, "uuid": "98cd4112-d580-4925-9a11-03a7403751ab", "value": "T175925D23B87088B3C4A745B588A6C9A2E91F556153F1D9071F3C167AEF127C1973B32B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697297452, "uuid": "4edfcef2-d1bf-4c9d-a781-907fff9d8bc7", "value": "384:S7CdzpxV2PuzDcx6iFiqfDlMAPJUJ7AJeNTnZJcbvKlT9bTOM:wCdVvyfx9JfZ5PJUJnZJIs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697297452, "uuid": "848d567a-7bdf-4366-9db7-58c0117029bd", "value": 20001, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697297452, "uuid": "77b09c0b-db9f-4883-9a30-daeb4c735634", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697297452, "uuid": "93162abc-e995-4670-bf74-1da3d71f95c5", "value": "SecuriteInfo.com.W32.GenKryptik.ERHN.tr.1395.4592", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4feb61e3-6a2b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1697244475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697244475, "uuid": "aaceb8ef-a31a-4553-abae-9455d9db178f", "comment": "Malware payload (Mirai)", "value": "f621331783c1d2f65f2a42857fc4aea5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697244475, "uuid": "4336212a-ef88-469a-a577-25653ef4c116", "comment": "Malware payload (Mirai)", "value": "14118093cf16f93a86ff29c5bce11f7ff7f9cc5c7ba20f12e6368c7075915668", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697244475, "uuid": "577e945f-b53e-4a65-a7c4-d8c72c7e9a3f", "comment": "Malware payload (Mirai)", "value": "cb57892abea2dae13c5e18e715c9d60d298f02a3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697244475, "uuid": "8cfdf0a2-7608-4d3a-85a7-d9b45d6e7272", "comment": "Malware payload (Mirai)", "value": "cd1e3cba00e64e37e3f8245df5882824a9528415bef9f24b43766c5a223464ac46ad7dcd721244be406aa1b325b735e5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697244475, "uuid": "729e97fb-42ca-40d5-b2a2-e04a1d6c70d8", "value": "T13B83190AFD519B12C4C221BAFB8F514933136FA8D3FA72029D24AF6157CA99B0F77512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697244475, "uuid": "a8a12556-b787-42f2-86dd-d4fd00e3ea98", "value": "1536:Y1n4c5QX0ZHQCO7WRWtn6oCpEXYgs0XI16EzTAelvyoNib6lathqZtY7C8c+P:uO7v0kXYgs0416ET46lathqzd8c+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697244475, "uuid": "9caecfb5-136c-4c2e-91ee-4e446d7153f1", "value": 88320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697244475, "uuid": "3429660a-cbee-4dce-b11e-ffe58445e60d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697244475, "uuid": "807c16b3-8de8-4302-a353-a069627a964c", "value": "f621331783c1d2f65f2a42857fc4aea5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38c2ba0c-6abd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1697307142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697307142, "uuid": "26766cea-cc78-4eb3-a84d-f08a89a5e226", "comment": "Malware payload (Mirai)", "value": "874ae2ec08d853e5fbe8b0e2358a665c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697307142, "uuid": "88038ed5-33ec-4c34-9e2c-e8f955a21aee", "comment": "Malware payload (Mirai)", "value": "146dc9ecf81e4bdbd92d8e332088a71e145e0ca1dbec0764f2e3d64b2431062d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697307142, "uuid": "e3815474-faac-4815-ac81-9f898e3ef723", "comment": "Malware payload (Mirai)", "value": "e69c59eacac1aea38d02ab99228c48441feba312", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697307142, "uuid": "d7df32f5-6c99-4862-978a-05af64f52741", "comment": "Malware payload (Mirai)", "value": "856cd0c9a29c26699777af88eafb88d0ed03ea0cd20b3ee2c2bb0fed7bb9149f532c03781cf9f54dcf8bdfe13990e7ed", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697307142, "uuid": "0bd596b8-435d-4165-a67d-8fb63cb89a2f", "value": "T161432AD7F800D9BDF80EE73B44734506B231F69605821B3623A7796BED3A2A41863F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697307142, "uuid": "ac17b1fd-4b4d-4477-8118-fc77c47b41d6", "value": "1536:dL1M3tAsSIWuNHH8QQn5gEDwNUhMCuXjsZdS2Wob:dLMPxNHw6pNqMxv2Pb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697307142, "uuid": "0289ee58-e886-40cc-a833-fb90b73b50bc", "value": 57172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697307142, "uuid": "eb1f3eee-69f6-42a0-bf7c-ec214fbc8237", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697307142, "uuid": "10fba1ef-3b49-4f49-90b3-b2810a68d356", "value": "874ae2ec08d853e5fbe8b0e2358a665c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "784ddc51-6ab2-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1697302525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697302525, "uuid": "a8c0af64-68e5-4c3f-b956-d44305385715", "comment": "Malware payload", "value": "c6bbc0f697836b93dafe13c27b53e732", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697302525, "uuid": "8d324bdb-22d3-4fd5-a796-b5e841440a34", "comment": "Malware payload", "value": "14eb912f5fbad3ed025f38a197465593874a8d0d3288e790bfd4740ca4fb52e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697302525, "uuid": "19980afb-8140-4372-afd2-b82f2d332d60", "comment": "Malware payload", "value": "8f9e03fb9b75f6376a76c98c1ab70b91c09e915a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697302525, "uuid": "bb098c89-1638-408b-a58f-0f432b7ddf29", "comment": "Malware payload", "value": "bc2600771fbc73e157be371eb0d1ed40f2eab39be412270a9508ed61191be760924de2c13b0d783bc3ef015380253db9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697302525, "uuid": "f880e9e4-6a09-41e2-9a03-3b39733b5fee", "value": "T1DE378E01F578262DCA9FF774869E233577353C088726FBBB0975E6712C13262AB2D648", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697302525, "uuid": "f69a4060-19bf-4608-a421-f928176b7dc9", "value": "4b1a4a9cdcfa5764a67e65a516bdbe36", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697302525, "uuid": "55ca09fc-bfa1-488d-9bd1-b1d2a321e1c2", "value": "98304:obxusIXXb1dB3Ly3zq2Zk63OMnI7RkEEO+BcLlApOzOlrBVCs7lCKmWSJiqxq0p9:QxusQb1dF1Mn1nOaqHgV1iTT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697302525, "uuid": "29617e1d-da3a-4823-9c66-04c6fd589285", "value": 23990693, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697302525, "uuid": "9c882b44-ee27-4b82-8c98-3d9fe6772ae0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697302525, "uuid": "c7cd96c2-11b8-4f0d-9a6a-00f2f6028a6a", "value": "mscorsvw.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbca5457-6a45-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1697255930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697255930, "uuid": "a2f24fa2-fb2a-48d2-b7d3-bf41633ec7cb", "comment": "Malware payload (AgentTesla)", "value": "be17427d37337c71ac701effd983f143", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697255930, "uuid": "ff1f67f9-5747-4ebf-8f04-34cef5a33a94", "comment": "Malware payload (AgentTesla)", "value": "18d2b8838dac4579e0dad6276b13ee43f4de3e85e61e631403b6e149d03ab197", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697255930, "uuid": "d6d4702b-6cc9-4afd-975b-5e54d9fd64da", "comment": "Malware payload (AgentTesla)", "value": "00978eb4e2325c80bd3bd09b60c5568c4dc6ce16", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697255930, "uuid": "662ff08d-a0c3-4ed8-b7b2-8299e0d3d54e", "comment": "Malware payload (AgentTesla)", "value": "2d9adf931914aed5ff99ad995f275bb1c8c0055a4a2e4f95861bb641bc461964bc0b2bf3cd730a5495c9d7effe7244f4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697255930, "uuid": "65b29ea7-cb61-432a-baf4-d96c40dcfce1", "value": "T1AD35232C0CF809124161E1AEDFD8EA57B2C08CD6664C9D9687C68F995A1393BF09FD3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697255930, "uuid": "c97b1850-4918-41b7-8cf6-64a27b8c7e8e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697255930, "uuid": "6a11dc2e-63e7-4cdc-be78-a885c81b43ee", "value": "12288:iFjm1r/uMqw36u/4xKMAEhp8ALZdStD1WR5/S7dRTc9hvNWRR1yq2:QjebuNk3vrEhBrU65/0QVw/2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697255930, "uuid": "0ebc96b8-a613-4bfd-ac5d-6f130829c6f4", "value": 1113600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697255930, "uuid": "0b9b9432-80a3-495f-bd7c-9299b11515ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697255930, "uuid": "94334721-0930-49f2-a5a6-207e4261661c", "value": "be17427d37337c71ac701effd983f143", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad7d62ba-6ac3-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1697309915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697309915, "uuid": "187f238c-8fd7-4d95-abf5-b698e3ab6e04", "comment": "Malware payload", "value": "5a0d618b0f8ed5b550a811e4b1afdf48", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697309915, "uuid": "ea0c5ab8-7a64-4e6e-bae0-39c3091ea718", "comment": "Malware payload", "value": "1dcbdb53d1b2096126c1515c1078614ca4c05e43674cc57ac6bea182c654afe5", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697309915, "uuid": "f0b20e86-5037-4f17-b8ee-f317efa9635b", "comment": "Malware payload", "value": "c663c59b7983919fc0a240344913410e98c4e49e", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697309915, "uuid": "84201ac4-23d9-41d7-a65f-c0a3abbf9e58", "comment": "Malware payload", "value": "083d65549064ea7b2c490a7fef205f8bb803b58bd8410626d9bc647b09608c624f5ba279be281e9b4c90f7afecd0803f", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697309915, "uuid": "34fc7d1e-6729-41a9-8cd8-692b8f38fb32", "value": "T10784021F62D0387BD4BA83B988E78653E271B8E0175522FF12E5D1F94E631C13672B86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697309915, "uuid": "c5ec47bf-1e05-421a-9b46-76d8dfedff78", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697309915, "uuid": "a054c4c0-6d9d-41f1-97ca-1706ed190bff", "value": "6144:EeR7eammrMaBn+4JtrLN9YJR3Oxm+oZjXapLLPgxiBerXBxzwCYXmfZ3iIfd:EeRtBrMa9+4JdIJRRAP+XrzlYKfd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697309915, "uuid": "a1e78d13-f668-4bce-a765-0e57bdffbda9", "value": 393216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697309915, "uuid": "33a4ccad-d611-49c1-93ff-68311ddd2ea6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697309915, "uuid": "3286c4b4-30a1-4513-8c05-e9ee5f7e119d", "value": "5a0d618b0f8ed5b550a811e4b1afdf48", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "874755e5-6a35-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697248863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697248863, "uuid": "eec718f3-02c4-473f-81b6-4c73b9765987", "comment": "Malware payload (RedLineStealer)", "value": "f77e8d62fb58f3c133c1145d84b43007", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697248863, "uuid": "5a3b7511-7c4b-46bb-bfce-919b0231b024", "comment": "Malware payload (RedLineStealer)", "value": "1e6ea2a57fd8fd47468e17b92f74a6b593a043205fc8485bca5e5f29499adb11", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697248863, "uuid": "2baa9a6a-e66d-48c6-9abb-63abc0b05530", "comment": "Malware payload (RedLineStealer)", "value": "241615906a6dac612fc13b04aa51962d4ca35b50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697248863, "uuid": "d43b89ad-15c2-4166-9a33-52535caaf5b5", "comment": "Malware payload (RedLineStealer)", "value": "1f31d6a99e702a4dcaa2950b5b80a779f134c9eb21bef8bf6e4622d75ad00b5a500f88baded6dccf25d3d29eae5e7a3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697248863, "uuid": "cdce7517-fa7e-429c-acae-bde8a05a16c7", "value": "T17E752346DBDD8073E9B12BB944FB0393533EBDD0593883A76B058C9E18727906471BAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697248863, "uuid": "b724f0cd-cb8b-4134-952c-299d45dd1961", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697248863, "uuid": "e514da24-9109-4d5e-8355-6cdfd3a11d06", "value": "49152:4CKmDrHXItwGOF0TS4nRLyZgMhmxHXlRUTb6VzCjxo9kd:ZtDr3PcRGWxH3lVk+9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697248863, "uuid": "dcf4674a-f426-482c-9288-00556bbb7e3d", "value": 1625088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697248863, "uuid": "718f159e-4fa3-4f4f-8235-b43c756192c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697248863, "uuid": "98db882b-8bfa-48ae-87d3-deb510f1988a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc09a951-6a82-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697282049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697282049, "uuid": "155059a2-9e07-421e-8193-572ba1078f6e", "comment": "Malware payload (RedLineStealer)", "value": "b0c205fa90d7c9e03fdb16cc40f6b2af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697282049, "uuid": "7e36750e-e153-4ef7-941e-83e72c67c493", "comment": "Malware payload (RedLineStealer)", "value": "1fb88c839c5066f88a0686f9fb5a82b229d73b3f8707bf04d029f5810cfabf00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697282049, "uuid": "2b47f63b-1d6d-429b-a0ba-35dfab15d8a2", "comment": "Malware payload (RedLineStealer)", "value": "0773b50f3100834f91c070bd6025f2b7adac7fae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697282049, "uuid": "5c5e25fa-c32b-422f-840d-cb1672a56762", "comment": "Malware payload (RedLineStealer)", "value": "e951508aab4ebaded664dba8150c459d6eb6f6e249a90f070a89e34974b5f22c41591e7f16b4caf9c59f408b68bf3657", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697282049, "uuid": "ab0ee335-a9e0-49cb-b16b-4fe7ddf12c44", "value": "T1F9552347E3E86032CCB037F458F9079726353D729EB89767AB80A9B95833848D57235B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697282049, "uuid": "3fc43e9f-e5d6-40f5-9ed1-03c3ebde8c78", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697282049, "uuid": "ac32bbb9-e4b4-40ab-be75-8d829b797354", "value": "24576:nydLKIJXPI0X/+0LUNCJ+OAzivE0xH3iAxj4Mrv9oftc07DV5oiUZ:ydNJVX/+5pInXCAvyft1/Qi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697282049, "uuid": "a37a5e0e-9b58-49c7-82f6-8f38d997eb09", "value": 1353216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697282049, "uuid": "fbcb6cf7-df3c-4403-b7cc-5cc844a23a32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697282049, "uuid": "90a4ba0e-175e-418e-891f-f667775d9aec", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "714d7275-6a25-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697241954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697241954, "uuid": "d3b3a4ec-111c-48ac-b1c5-d43d7066adc5", "comment": "Malware payload (RedLineStealer)", "value": "0f1bed190cf2815bdf6c466c042a9509", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697241954, "uuid": "7ed7210f-f9ec-4c53-b0ba-f4806b3eb521", "comment": "Malware payload (RedLineStealer)", "value": "203d2805940f449108ad9fa226bdb85ff08acb8c1bf9310cbce59740ec486f50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697241954, "uuid": "86fc11d0-e6ed-4033-afd5-d98213f526cc", "comment": "Malware payload (RedLineStealer)", "value": "ad5d8339145d13caffae1edc23f083f1b4d6a2a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697241954, "uuid": "1cf30254-a855-45bc-be19-5f2e75fc1082", "comment": "Malware payload (RedLineStealer)", "value": "4c098404b936047e18426da48ece7a21c1a1cbb31966d87d9695e32728fbf6d5e548fe597cf2f0be3812087be3c298f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697241954, "uuid": "e7d35423-caac-4e3a-8ab8-87fdbfb05166", "value": "T14E752381EFD54473F570333061F702932B36B84699B887633B86EA1A5DB3A5492317BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697241954, "uuid": "dd439bab-dd6b-4fa4-9172-9533380d2d9e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697241954, "uuid": "efdb37ee-e94f-4e79-b274-8b801f1be349", "value": "49152:rBsSp21y8C+vAK6YZgnhlGsaCqivHN+MPxRmm:6221y8VAKtsGsaovNdxRmm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697241954, "uuid": "9e213cd0-1b78-4059-96cd-7b4fe1e0d8c3", "value": 1625600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697241954, "uuid": "e0bafd5b-c533-494a-83dd-5eb607944494", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697241954, "uuid": "ed633774-bd93-49c2-b38b-e161b6cc36a6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d74abc9-6aa2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1697295715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697295715, "uuid": "bc26c70e-cc3c-401b-b60e-1ccf6702b3f5", "comment": "Malware payload (Mirai)", "value": "b43c0cdd1fa2ad61f41fa3b605822dfa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697295715, "uuid": "48211796-bb42-416c-bba1-e5699f9468fb", "comment": "Malware payload (Mirai)", "value": "2046662f52e574164723b288ff6adc0776acc8d25961065248e29c52855a0e27", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697295715, "uuid": "f6726866-8dd7-4bf9-ada9-a7d5276d842f", "comment": "Malware payload (Mirai)", "value": "6a462cb2324273ec47bbd57878f3dcb4fadef6e0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697295715, "uuid": "1172323c-29a2-4b32-ada1-c4079c77021e", "comment": "Malware payload (Mirai)", "value": "e71306e1f36befa565dffc8b3a9e7abe138ac650ec0c573043384bbb190018ba05fc9831817b5da0530e6fbea0ce15bb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697295715, "uuid": "b91bf213-3c69-493f-b3b1-648bb13dccc7", "value": "T181734BA9B4019EBCF89BD5F981220F0EF42163049A930F27A66BFDD37C630A5DD47946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697295715, "uuid": "ec346ed8-a039-49b2-89d5-772eccccb429", "value": "1536:dwevSqbSjyPul0YqfXaajCRpOUIYgTWTQDtn5pu8CgMQf/:ajyWl0Yq/aajwpKtyGnDZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697295715, "uuid": "eac68ef8-802f-44b5-b4bf-419b64c8e3be", "value": 78240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697295715, "uuid": "c571c206-da8a-4cf8-9eb0-88725e6fd0ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697295715, "uuid": "ebf9b872-db73-4439-ac46-4bbbcf71dca3", "value": "b43c0cdd1fa2ad61f41fa3b605822dfa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51caea59-6a62-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697268100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697268100, "uuid": "a99ca048-d555-4926-847b-ad6933fd0cb0", "comment": "Malware payload (RedLineStealer)", "value": "9c5a1a899cf55339e11acc2ddd5862dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697268100, "uuid": "2b66369b-a76b-40b3-a6c2-2b58af16e231", "comment": "Malware payload (RedLineStealer)", "value": "20bad72510cbe850e7c25dc8d35d3c28a525757db3d44c59a6198c009256ef64", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697268100, "uuid": "d80d3b4b-de2a-412f-bcb0-2f79fe9a7ef1", "comment": "Malware payload (RedLineStealer)", "value": "d2af2ef22ebb9183478e050ca1ca7eea9e9b12e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697268100, "uuid": "84e81842-17e9-446c-b61f-4c9d1adfcb48", "comment": "Malware payload (RedLineStealer)", "value": "a10ccea9e73b5f2cdbfbeac52d61455a5749d02800a51eb46ef751ce8c1fb3b82add035b63ebec419999ca0da00aea3c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697268100, "uuid": "8ce5674c-7257-41a2-92cf-d904b532cfda", "value": "T17E752385AFD540B2F8B877B11AFB436317367CA18D68C3526A96B54B4C7390884F273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697268100, "uuid": "620dd6b8-7273-4ea3-8104-5d64102b39c9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697268100, "uuid": "8ea9dca9-309a-4df6-84f6-07737a74b367", "value": "49152:vW59gPBruFaoZglhMVoa2ZMPHAetCszi+5Yp:k2BuFpJVoaaMPAURz9Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697268100, "uuid": "838c2300-309b-4b4d-844d-5575da7b58c9", "value": 1623552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697268100, "uuid": "1a1f3492-a0c0-473c-82cf-a5f495845999", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697268100, "uuid": "38a08b3a-841e-4b8d-bcfa-335e5ccc3868", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57b0caca-6a2b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1697244488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697244488, "uuid": "fd735c9e-e7ca-4eb3-8a55-1acce4c8a37b", "comment": "Malware payload (Mirai)", "value": "349798a9a95cf5a5ecff986faccf103a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697244488, "uuid": "ded7733a-ad57-461f-858e-bb7cd7c0b842", "comment": "Malware payload (Mirai)", "value": "20dd53730e5938b46f84b3de6780bda96dedf9182ba1bce851b5513397fe81e8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697244488, "uuid": "504c82dc-52ab-4839-bcd9-f32113dc2af4", "comment": "Malware payload (Mirai)", "value": "de5018e5d6adfd24e222a9a1c96e31e9e8c47798", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697244488, "uuid": "60ff137b-338e-446b-88d2-748dc66d374e", "comment": "Malware payload (Mirai)", "value": "f720dba628b7712f24ec14b9b7e578fbf0cbd5582cfb0ef9dffb97acddddfdbf30c7fdd1f57e1f361ccc10ab210da9bd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697244488, "uuid": "ea3d81da-84d2-4d21-8710-7c18b6af17bd", "value": "T11DD2D05DA0FABE87CD9D8C3892BC02A4DBC160C076496A5E1352448CED2469AF4AB77C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697244488, "uuid": "ed662dc6-8adc-44c2-bbbe-fa4445d8dc1f", "value": "768:2Mx/5rJIWSUxgeUNe17R6MsmFQAjbxFFWl:2o5Ox4/1N6MsmFQ6bxg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697244488, "uuid": "be3e5fb8-91e3-4c5f-a983-98b33771afe7", "value": 30540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697244488, "uuid": "028685a3-bfed-4165-88a6-9266065f20b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697244488, "uuid": "dd99df1f-0f57-4092-a3fa-19f539029bcf", "value": "349798a9a95cf5a5ecff986faccf103a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ad5918b-6a47-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1697256546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697256546, "uuid": "d86e4400-5281-4b49-8989-f1dbfe2ab7f3", "comment": "Malware payload (Amadey)", "value": "d334fdbe7080a9e36d94001903199491", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697256546, "uuid": "5b732915-a8ec-497c-aca9-51b46f922454", "comment": "Malware payload (Amadey)", "value": "20f0619336fb27994a740fb37794d83d027646bbf0d826d8b3542f042412a908", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697256546, "uuid": "e0df125d-e60b-455a-812d-88312e7cfe6e", "comment": "Malware payload (Amadey)", "value": "5d10fa7e8de420744a3ad3358428f16e796c3c1a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697256546, "uuid": "2c56e352-6b96-4661-af44-a2a02ed335c5", "comment": "Malware payload (Amadey)", "value": "f6566763eb688b4322fc0f97b461f60c23abf75773e149050b8c4e04baede3dcf2294bd6e8fa475554ca8d5a56c5e962", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697256546, "uuid": "318ff6b8-ae3d-45a4-98fb-c006b092319a", "value": "T1E9221801F7D48272CA7A427638B79786C733F79B58468EEE748C510F3F2698582A32D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697256546, "uuid": "532b7c0b-dea3-40d4-9c03-c29484baa9cd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697256546, "uuid": "93f33d73-e109-41a6-8c38-72794a2ac823", "value": "192:4ctzdkaK/n7bEbIn+qeDFcugX8P6J8stYcFwVc03KY:4y+p7bEbIn+rgX8yJptYcFwVc03K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697256546, "uuid": "e5cf0811-da7d-45e3-8810-3ec3f330afaf", "value": 10752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697256546, "uuid": "f9863267-de70-43c8-9a3c-fa0bc76313df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697256546, "uuid": "83baeebe-07f9-4309-9c16-b801cededc94", "value": "d334fdbe7080a9e36d94001903199491", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6a5ddeb-6ab5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697304025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697304025, "uuid": "9f6ce465-29cb-44bb-b8ef-59a510ded4ac", "comment": "Malware payload (RedLineStealer)", "value": "c299d14b669abcebacdd79684bed971f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697304025, "uuid": "2dd53318-6598-486c-8e69-0530031f0d0f", "comment": "Malware payload (RedLineStealer)", "value": "2107e84b01653f8e78e3160c29406b50f7ee6e589ee98d4163243d9030fd6405", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697304025, "uuid": "d1e4350e-e0b1-4c68-82d1-ff27f3a3e1e0", "comment": "Malware payload (RedLineStealer)", "value": "4dbcb063f5c2f232d305312d18aa9cc231a2e063", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697304025, "uuid": "f25b30fb-5fa6-4130-a799-748236c3b3c9", "comment": "Malware payload (RedLineStealer)", "value": "2cc533b66f6959423c0c1fc0f132c1f13877bcfae500709b309de26d42cd7cf49c7600b4ab5d4b9f37a3b2d9e3b28001", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697304025, "uuid": "8c8572c8-0d9d-417a-a42e-70070107a208", "value": "T1A7152212E3F88462E9B51BB0A8F205830631BDB69C705B2B2389456F5DF39D0E5B2777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697304025, "uuid": "a24b68bd-854e-4f20-8d76-da62933cda71", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697304025, "uuid": "2b691366-a787-41fe-971f-31c572f1cc3b", "value": "24576:3yXSiAPY5FOaElrY59QQhF7LBzsypZGwOzJL:CXpAPY5GlrYThF7qwVAJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697304025, "uuid": "098c948b-231b-4c7f-8da5-fac052311075", "value": 890880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697304025, "uuid": "9fe0efad-50db-497d-99a9-16d61963d3a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697304025, "uuid": "285e61b3-a44c-432e-bc6b-be8d883c91d6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd3a8ad8-6a9a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697292359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697292359, "uuid": "0d98502a-2e77-40b3-8323-da22f37eec51", "comment": "Malware payload (RedLineStealer)", "value": "e588b07033b40d16b3deac16b0eac085", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697292359, "uuid": "8f6b3a6d-b401-4332-8296-d9fbdc0ef1b5", "comment": "Malware payload (RedLineStealer)", "value": "267bb2b7b50a45bb27533ca6f45b6d24e8b5a610aadf587326491ceaccdee1cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697292359, "uuid": "3764bfd9-a3cb-48d2-b65a-bcf78512c06a", "comment": "Malware payload (RedLineStealer)", "value": "7393d742bfb5bc4d352f8c648c1af408ed88d894", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697292359, "uuid": "053bb07a-ebad-45a0-bc6d-68998f424079", "comment": "Malware payload (RedLineStealer)", "value": "48971c4a415b9d18d4f1f00aef85fa1eb4e963813c3c56c02caf8d2baaa1f86adf0fc57655964eba1f24a71bd4d25804", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697292359, "uuid": "4aaa24d2-3f7a-4221-bfbf-2d5ec8dab06f", "value": "T17B743B6AF756C633E0AE377D012B06734B799DF0CF8CBADF21A98296605CE8146C4D46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697292359, "uuid": "39237e6a-7ad1-4be7-b62e-3fb11b7de464", "value": "89b4938a013d6b8954f68c2ef1293c62", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697292359, "uuid": "c32d21df-29c7-4273-a6a3-6f99e557d1c5", "value": "6144:rgJsICnU9Q8rTXhzEURyTYGOEItAfZ39PoJ:rUsICnY6URYItGtPoJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697292359, "uuid": "a10617de-3f5c-4cc3-89bf-51de33431dbe", "value": 347648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697292359, "uuid": "4f500cb4-cd54-40de-970f-9ddac12c5f4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697292359, "uuid": "13c56813-97d9-4912-967e-91aadb30842b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8fe77bf-6a31-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1697247308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697247308, "uuid": "e07f14e6-a1b6-4191-82a0-72d57b6925be", "comment": "Malware payload (Mirai)", "value": "e9487901011241721e387386a49635b6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697247308, "uuid": "c1fbc279-89d8-4270-9fe5-53c1be2270de", "comment": "Malware payload (Mirai)", "value": "2b208bb68e9bf726263bf137a02dbb0b4f7d00dceb39d35f506d64ba1230778a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697247308, "uuid": "fe0752c2-b1dc-4140-9c3d-be52efd8dbec", "comment": "Malware payload (Mirai)", "value": "8b8d280820b1f66bdb9dbe81202d9ccec46aa8a2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697247308, "uuid": "722d1bc9-81be-47ee-b3f6-b705cf24ec00", "comment": "Malware payload (Mirai)", "value": "a383607d6f0f89c0d89351c615bb056fa11096ad5a82c6983b505c49e2e9bc91d850d813934dc0432d727bcf8bdd0c9c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697247308, "uuid": "00d7efc9-580f-4685-baa2-e22c90c74cd4", "value": "T15D63D546B9A09657C5D00F3AB90E134A73335758D3DF63125F296EB49F8BB2F0E2A901", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697247308, "uuid": "23044444-9840-442c-bd6d-a943f2327793", "value": "1536:epnOEOfY4wBMxEHMujjvsFLZIziWYGb4D9SAEbN+x:nlXhGb4D93E4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697247308, "uuid": "e7463666-22e7-41c4-ae0b-fd705f61bfd6", "value": 67262, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697247308, "uuid": "a14a36fa-8d7c-4e1c-89e3-708dd8c48273", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697247308, "uuid": "6ff5a6f6-515f-4032-9da1-5cc5539c7d66", "value": "e9487901011241721e387386a49635b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e29f0cbf-6a85-11ee-a6f9-42010a9c0055", "comment": "Malware payload (TeamBot)", "timestamp": 1697283376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697283376, "uuid": "f107b7b3-d0e6-4ad2-80d3-71b5c166474a", "comment": "Malware payload (TeamBot)", "value": "faac05cdea4067a3a494252ade41282f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697283376, "uuid": "3a606d6c-f2f3-4ac8-8df9-3cf95dc451d9", "comment": "Malware payload (TeamBot)", "value": "2b78d384474b9b3193d37612866def097e37491bfd991e0687b943ca135b18f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697283376, "uuid": "dcd5e291-d138-4e5b-b9b9-2a002f403867", "comment": "Malware payload (TeamBot)", "value": "fa45d05df9e105cf6a1cbe82f2f41f4769012f3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697283376, "uuid": "a70d364f-491f-412d-9b08-06f864439d8b", "comment": "Malware payload (TeamBot)", "value": "0c90d067968604c4f0f605586982739eb05e5e6b561187b5cd115880b864179c4e47451badce08facc3544566813b257", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697283376, "uuid": "4cea07d8-7adf-4028-84d1-f60ac7985b29", "value": "T19E346A4352E0FC60E81647338F1EC6ECF71DB5A1DF496B6622189EAF19B1272D267384", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697283376, "uuid": "ae4522ac-ab8b-40b9-909e-1be7b1edd5d2", "value": "c28395a853011e8d0c47586e839f95a1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697283376, "uuid": "9f258930-5fda-46ab-a2d4-189bc23cb2ad", "value": "3072:UbRrihlVaatigClWkgjWcV0ffoDBrCfa9AL0nkhgYOPme5E9tnwjI6W:YBi0Ai1lZc+noDBr2YwOO39tn6M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697283376, "uuid": "ec0696ad-2ab5-4b72-b34a-dd3d8803a14f", "value": 245248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697283376, "uuid": "4e182a42-f834-4459-b248-31f6d3df9779", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697283376, "uuid": "01b9aee8-d5e3-4dcb-b162-25b0fbfe8681", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "228f45db-6a7f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697280476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697280476, "uuid": "a556633e-aa6b-4fdd-a6db-a0d57b915394", "comment": "Malware payload (RedLineStealer)", "value": "b371f62b12bead7d4f494944a5ed488c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697280476, "uuid": "b40596c5-5350-4d14-bcbd-3a2f1af7a8d2", "comment": "Malware payload (RedLineStealer)", "value": "2cadd024b3ad026c8afd63c4dca871b937b4435453b2b30360b2383664724477", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697280476, "uuid": "9031c454-86e2-41f4-99d8-3284bd3c4f3e", "comment": "Malware payload (RedLineStealer)", "value": "03fea30c2333107f3e75d47bafdc50258ea25c26", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697280476, "uuid": "dc4e2814-a060-4953-abbf-74eae7b00e9b", "comment": "Malware payload (RedLineStealer)", "value": "4b31769972c8d28e0fa84f7d79f8dc30a53c1779837e647a428c7ebfd768f93bad51f0facb3b8589f20b3d3621854e8b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697280476, "uuid": "47f11c16-5b4a-4cc1-944e-b75552da5add", "value": "T171552352EAC99522C8F52B7194FB06D31F39BDA41D24877B23DB58CE48B25C9693033B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697280476, "uuid": "a782ebc4-e22b-4c6e-b4df-bc56d1c13b2b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697280476, "uuid": "9bc2a122-8009-4712-a884-b8da62765114", "value": "24576:1yiGWhyTUnOxQr3E5m3sXUaNJu/ZXJTWkPVqOV0S2Idg:QiG/cOxQbOhJUXBDPI+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697280476, "uuid": "cd7dc032-51bd-4e7e-a077-c62f85f2a830", "value": 1361920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697280476, "uuid": "52a16cdd-21de-498e-ae7c-35a635f8a0d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697280476, "uuid": "b788e85b-d5c1-4ca0-b72b-23ed0adc9ffc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0c94d28-6ac5-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1697310833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697310833, "uuid": "446deb66-30fe-449b-84e4-378da7f7af84", "comment": "Malware payload", "value": "742066e6d7103fa65e2af4db9063db3d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697310833, "uuid": "8e59f2f6-9e33-48c9-9e58-ffdc5066215c", "comment": "Malware payload", "value": "2cd9a6de7cabf360187ad8fc4163e10be7bcf4bbd768f8db635cc57438385352", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697310833, "uuid": "041229ff-e3fd-4b74-b3b0-bdeb5ccb608c", "comment": "Malware payload", "value": "3fe605e0a6260d4442e7b67663624cd6b4525636", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697310833, "uuid": "35bc29a8-24d9-4971-977a-ea9b20d5bad6", "comment": "Malware payload", "value": "12dc8ac5e8d001631a90dc7b1851263ab137953dd5e17bd332f1fa26fd89b468c7b8303eae7bfb2397e76f3c61dafc87", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697310833, "uuid": "36c34e30-195b-41f2-88e9-1ab39e36cf91", "value": "T132F7336D3FDFE84FE58B1F3903F9D22A96ACCB9434485313D6220326B866DC63D85A51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697310833, "uuid": "4ef8c201-9596-437c-997b-de84210a2102", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697310833, "uuid": "782fcf5b-bfe6-4939-b886-bca5de65379a", "value": "1572864:jhF1s9gK1YPHnrgsOu/Yy/KAtkui9bTBBfTzy4:jhF1s6oXyyAtviRPy4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697310833, "uuid": "0c11c16f-48ee-4f72-a572-3ced0092ad8f", "value": 70835906, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697310833, "uuid": "ce9078fa-7ded-47d0-b6d4-34257feebe59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697310833, "uuid": "8308ab0a-be16-44bf-9214-69780bfd232c", "value": "SephioneInstallerx64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2782d97-6a28-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697243325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697243325, "uuid": "020d86d3-0ee4-429c-a2bc-f7b871e2225f", "comment": "Malware payload (RedLineStealer)", "value": "e3300c1120ad06e08dc1f41c8a35dbc7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697243325, "uuid": "02744855-37d9-411a-9b40-0643a71d2f9a", "comment": "Malware payload (RedLineStealer)", "value": "2f0af77f7f418bbc1eabb71187eb62862c74c023854a15e34921d892f7c8c879", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697243325, "uuid": "8cef853c-021b-43df-b091-74f59dc931aa", "comment": "Malware payload (RedLineStealer)", "value": "4e6dfa4f6c7ea604e5e09597c6953bbe532cf00f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697243325, "uuid": "f23510e9-7d3e-4f79-a604-caac22ace4e4", "comment": "Malware payload (RedLineStealer)", "value": "53c326364002f1aaf3132f7cb854d216ef9c6a17a9b074f2b8a3fb131e8fdcc352de31d67624b3a3672f1896434f62b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697243325, "uuid": "f49bbda8-e448-4c04-a015-2977b0c8cc8a", "value": "T1297533519FFD40B7D5B8233018FA03931B363E54DDB882A7365AB209AD7389851B2B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697243325, "uuid": "250bad88-7f94-436f-87a5-fca684f8857a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697243325, "uuid": "fed80564-b0c8-4c8d-a970-fbead3854d3c", "value": "49152:ApdL/ykok7DuUDcEdZgQhTBnaxfRrHvEn1Vqw:+L/2k7jDcMNBna9Rzv01j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697243325, "uuid": "6590a950-0ffb-46d9-b3f1-92fdc8c4503e", "value": 1625088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697243325, "uuid": "9449c681-eb3b-4b20-be54-2e18f21a715e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697243325, "uuid": "0a144e9c-c32a-47a6-827b-201d230e5f3a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80b7bc42-6aa2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1697295667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697295667, "uuid": "0ba017a0-263c-4efe-9519-19e60a13b1b4", "comment": "Malware payload (Mirai)", "value": "b0ae688ae0840dfe1b5eda96686d3c21", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697295667, "uuid": "04a10c55-c6e7-43df-af9b-ab8600cc06ac", "comment": "Malware payload (Mirai)", "value": "2f530f5e77488e352d6ecf1e2df9d8e2869c6d0babf18e1485401e744fbcabbb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697295667, "uuid": "6868a695-cc8c-43c6-9ffd-441de963daa0", "comment": "Malware payload (Mirai)", "value": "fa91d5a506c98acd051a22684c5c0806388cc0f8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697295667, "uuid": "844c3abc-6850-4e81-bea7-c25fbc72a589", "comment": "Malware payload (Mirai)", "value": "cfe6af3f4bfc9fcc61c968cda5fb50d4f93a338ef3752ad5477f476a2eb0b53c1b916bf0ad45a8f09728106c2dd360ec", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697295667, "uuid": "4bd25f2f-09de-407d-a24c-6b172ca585a6", "value": "T192830882BC80E616C7C01677FE6F108E331567D8E1EA72429C255FA07B9E91F0D6B786", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697295667, "uuid": "aa984de7-a9dd-408c-b21d-8eeed4ac292b", "value": "1536:sZCG1zEFBkqLPvdEpBnjBDNzVa9B52T+93D50B8t46/keXEJ2Bd:ACG0BkBndDwB31084okEEJ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697295667, "uuid": "45d4da43-7eb1-409f-abf7-c6f714fc774a", "value": 83044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697295667, "uuid": "2edd1f0d-6808-4850-89d7-6de389e6012d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697295667, "uuid": "22aa00ae-bcf6-422f-8b76-341bb8a3ad66", "value": "b0ae688ae0840dfe1b5eda96686d3c21", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f955b117-6a41-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkGate)", "timestamp": 1697254208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697254208, "uuid": "71b6a241-631b-43e1-bd32-f5d261ef6519", "comment": "Malware payload (DarkGate)", "value": "db89d7e859719779dc58a25849963712", "object_relation": "md5", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697254208, "uuid": "d1560323-53b2-4c8f-ba31-038ec5563b50", "comment": "Malware payload (DarkGate)", "value": "301158ffb44a9824deeec16bdc7dabdc328b9f3ecde0df048741218285d8bcc8", "object_relation": "sha256", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697254208, "uuid": "fc088d3d-766e-442e-abfd-8651d932024c", "comment": "Malware payload (DarkGate)", "value": "5f120fee54043617f16a04c0d93e761305262a56", "object_relation": "sha1", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697254208, "uuid": "55c65ead-4a03-41a1-9ee6-90f96601819f", "comment": "Malware payload (DarkGate)", "value": "e9ef786d3603a46efefa94984ac7e07fd47e13c21d97f564883700593e25ba3a849fffdd345198b5b7cbe504bde552f7", "object_relation": "sha3-384", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697254208, "uuid": "9623b7fd-7052-452c-94cb-24708393117c", "value": "T124846C36F680C437D1721979DC0BD6D9A539FAA02D3825477BE41F4C5A79383AA2B2C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697254208, "uuid": "34b38e79-7837-486d-b9b5-0fec36da0664", "value": "de470b5f6a496fb10c388881c2108f60", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697254208, "uuid": "7fc7f2aa-a6d2-49b3-89f4-36211d7b2477", "value": "12288:/0bF9CWd/TzbogrPDrnqF5E6CU/GavoH:/S9CWdrogrbrnjRUpg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697254208, "uuid": "56a66991-04dc-41a5-9fe5-a934026f9b65", "value": 396288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697254208, "uuid": "ee4f1050-1e6b-4a48-880b-15c5e74ae5b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697254208, "uuid": "971883cd-e76e-4f90-84ac-b9b401f275ef", "value": "0fa2144d196ea8b6146c87a1360ee4c095eacc87de432f77aa392e0d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99a9f0b3-6aa2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1697295709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697295709, "uuid": "7fffed13-9c62-43e7-bcca-60df5a778208", "comment": "Malware payload (Mirai)", "value": "0d8e46b5ce0120a4ec8692e956cf39e7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697295709, "uuid": "3a0b974f-bfc8-4556-85a8-77ef73d57c32", "comment": "Malware payload (Mirai)", "value": "3030e253b00e9fce26f159e654c93c0f7accd2826875caaad8faa1b5ad984277", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697295709, "uuid": "bedb6844-a53a-4331-95fa-46d81efecf07", "comment": "Malware payload (Mirai)", "value": "cff2f24831c30c566885e8d740e314bde20cfa7c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697295709, "uuid": "ff038594-315c-4f8a-97e4-012cfe52e451", "comment": "Malware payload (Mirai)", "value": "dcf6c87afb6d7b4e5e706b033b0cbf9515b293789fe1d7902f2716d0c21c833a0b12fb6617983b7e9c967367d32e2b58", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697295709, "uuid": "a2f64bf7-e69c-4b9e-90d8-36557fade962", "value": "T10CB3830A7F600EF7ECABDC374ADA2749249D141A21997F75BD34D818F24A24F19E78B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697295709, "uuid": "0647c627-c938-4ba8-b3ac-5bd02d05a497", "value": "1536:nbRemFZYH7D+jr8Cnmhs5ViW1GNbmEKbSxp8NMzxZKfACZu:nlemFZYH7D+jNnpF1GA0zx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697295709, "uuid": "b726cbb3-5e9b-4d68-991c-5ae1b463ab6a", "value": 108704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697295709, "uuid": "c2144f26-4aad-4174-b51a-5c7dfddc648e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697295709, "uuid": "3dbbf4af-1d97-4700-8491-0fc609ea0753", "value": "0d8e46b5ce0120a4ec8692e956cf39e7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07f73554-6a8c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697286015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697286015, "uuid": "947b921a-8629-4aa8-9b6a-16f5eebace2c", "comment": "Malware payload (RedLineStealer)", "value": "adaae381b9d9de6b56d9d9942dfaa914", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697286015, "uuid": "ef6680db-3ffb-43fb-b055-b4e78b66070f", "comment": "Malware payload (RedLineStealer)", "value": "3450e367237e846ce32104f17a583779c9ce7a638757687154172d91035ab15a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697286015, "uuid": "224114f3-4fb5-4c66-b849-1fef510a6c53", "comment": "Malware payload (RedLineStealer)", "value": "9faecfbfcca9b59f67aaaf1a198673f3cccef7bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697286015, "uuid": "9c4b0c55-8ee7-4292-b99d-d9d637db8743", "comment": "Malware payload (RedLineStealer)", "value": "a3e184c5aee8e4a336f022a1555a8f54db476e1db0977711ffa0b8ef8fb8d85270222798843c8bb76706799812435206", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697286015, "uuid": "dfc0e5b9-4d17-406a-91cf-8396a27f429a", "value": "T1B1552351FBE82133D8751BB168FB02932E31BDA06D79839635964D4E0EB1AC0AD76337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697286015, "uuid": "3c18cbd4-cae7-43b9-8085-b59da50beb6e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697286015, "uuid": "275489ab-b01c-49ca-9da6-395f1eb6073f", "value": "24576:TyZpXG+HoZXDTn95KMzI4QjzElQqy1xnfKWVHJOVS2RWnT:mPX7o9T9FE4Q0nQH7oWn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697286015, "uuid": "8e2661b0-bf04-4dfd-a330-2ba72d1e20a5", "value": 1354240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697286015, "uuid": "fc6905c7-7ef5-4e1a-bd8a-940f849d5133", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697286015, "uuid": "68487a20-92d6-40ef-9f8c-b7bc6fd82250", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bb1ac87-6aa9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697298665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697298665, "uuid": "a6c7f3b5-c69f-493c-a08d-233742f16bf8", "comment": "Malware payload (RedLineStealer)", "value": "638d3c6afddf072a03d4c4c4bdc7f7d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697298665, "uuid": "f64ac779-e658-4e35-accd-89cac8609009", "comment": "Malware payload (RedLineStealer)", "value": "347f0e9c3b75ed07fe583c1977aee33329700ab45f88d514f77672575a6162e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697298665, "uuid": "83be4dce-8889-4634-a264-56d82826ee62", "comment": "Malware payload (RedLineStealer)", "value": "8c41aba564c10ac4e57b9a0143994d82e9b52d71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697298665, "uuid": "1f90b33c-972a-4bc4-ad64-a2c709e4a410", "comment": "Malware payload (RedLineStealer)", "value": "9f0f38431bd71c2b780dcae175b5437d226af99e8128deb733a393d51770d6494ee80f2476abe0ccf07493f626718ca9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697298665, "uuid": "54130a43-d799-4d85-a29a-34828fc4fd33", "value": "T180252212F7F99872D8FA27B018F606D30B37BDA51D3886A72345A4694837680D477B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697298665, "uuid": "12dce2ac-a6fe-4fe0-9bff-736ab8dd84fe", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697298665, "uuid": "8990175e-a2a3-4ee2-bd93-62e435667e3d", "value": "12288:nMrYy90cQQiSS6sqwf3tn1PAV8U66aRqjGuRhyPpOb52njRAsNM4/rKbNR2lnFw3:3yXpwf9Nw8UjpRd52jrKO6pVciL1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697298665, "uuid": "8f3d192e-e924-4438-83db-4e28b173af2a", "value": 1003520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697298665, "uuid": "bc13deb5-466f-4cf4-92da-4ff108f1d41a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697298665, "uuid": "2e6c1640-5707-4158-a93c-6715e01294d1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6e707c7-6aad-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697300536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697300536, "uuid": "e13e0d6a-15e7-451b-bb78-056def3d6509", "comment": "Malware payload (RedLineStealer)", "value": "0cda0995e2b18bc7c96cc685427f097a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697300536, "uuid": "3e41de79-e437-4d79-bc78-36de361fe9e6", "comment": "Malware payload (RedLineStealer)", "value": "3566f3d8f60af880aeda5db541d2ae963868362daaaf85f14f7f802a7362e99a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697300536, "uuid": "5ea4f462-91bc-4f0f-985d-03471c020b46", "comment": "Malware payload (RedLineStealer)", "value": "d682fa34cfdeb8cfcd9d97037fb971bdeffa9f37", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697300536, "uuid": "9de92b23-0c9f-480a-a3ea-1b22f58b55d5", "comment": "Malware payload (RedLineStealer)", "value": "7530311a0448cc0ed2acd4a57790d9964fd0d13effddbcce31a267f74859996c19f2bbc49b253e3e53f841a007026727", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697300536, "uuid": "70247dfd-ed83-4594-87ce-1a864ecb48f4", "value": "T16D152302B7E84522E4F95B705CFA13C31B32BC719D3882AE5B4B694E5CA3590A571B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697300536, "uuid": "6dd1feda-1091-4279-8505-a05d6aa043ff", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697300536, "uuid": "c479d753-bbae-49b7-a4be-0778644bddcb", "value": "12288:gMr3y90+iiQzX0pH7YwDwo7kt1Ave7PqbFcmLADetFONS0PmEWIwkVQwOmX9m3:Hyxi7zkd7YwhwvAG7PcS5MOHmiftOmw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697300536, "uuid": "99f7f82e-7ddb-44d7-966e-01185ca3b933", "value": 898560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697300536, "uuid": "69a59285-19d3-467f-8a92-37b019034a52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697300536, "uuid": "2585848e-5e7f-4ecd-ac92-9153936fd69c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25d0bed5-6ace-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1697314412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697314412, "uuid": "d895a64f-cee3-4cc7-9f12-f33e2682095d", "comment": "Malware payload", "value": "625de7c3b4b9477edec367e6a396b47f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697314412, "uuid": "3bd5e1c4-105c-43d9-ad8a-3fdbce146e64", "comment": "Malware payload", "value": "3571f83071dbb55832d9cdc24d8430bb51acee1ad196b35ba34257ba0c7f5634", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697314412, "uuid": "e508971a-6cbe-4a39-9ea4-33adf348b45c", "comment": "Malware payload", "value": "02cc73a95d43a4940876d65b57f71569762c5c0a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697314412, "uuid": "80799c06-eef4-4a78-bbd4-aa02cdada715", "comment": "Malware payload", "value": "3b1c15f5e853bb80a89b6ce73682651353f32f677507ecb402be7102a488d43173beb28237b70fca8524f400e5148e44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697314412, "uuid": "7d083fde-747f-4550-a2d0-70e8854d4d58", "value": "T105152216F7E44172C8B62770ACFB03832E31BC615D74837A2789ED9E1CB2A80697575B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697314412, "uuid": "c8e6ee51-a573-47a0-814b-9d8419f53f2e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697314412, "uuid": "3179b7a4-9f9c-4ed0-9744-4a55dd059152", "value": "12288:NMr7y90otXn2vxLMAzu6HjSOE06fxhsGmz3P3tOL1+ZEmY6Bngt2C+EUcZZKZ:SybXUOAzuJOE0IsGmz3PULYCOBrCxfU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697314412, "uuid": "fdfe0e29-9c7e-47e8-b23b-71eab978cb7f", "value": 894976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697314412, "uuid": "011821ba-1f05-418f-ac93-b2247d4a44d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697314412, "uuid": "ca775f1c-2248-4bf8-8038-a9f7e2d4dc4f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea737b5c-6ae8-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697325909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697325909, "uuid": "3260a006-7d4c-4158-9fed-5fa511a476af", "comment": "Malware payload (RedLineStealer)", "value": "0d6c04a14bed92587bd8b955aed3ba11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697325909, "uuid": "29663dd7-6194-4267-8316-f09d2ba950dd", "comment": "Malware payload (RedLineStealer)", "value": "370df3afac35eb147c87badde2a78c9600c702a32b0922b202c800843342a212", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697325909, "uuid": "3aa2aa84-1e87-438a-ba33-4487ee26d617", "comment": "Malware payload (RedLineStealer)", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697325909, "uuid": "8741fb90-f9d2-4769-9ad1-d251f1469ca3", "comment": "Malware payload (RedLineStealer)", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697325909, "uuid": "655d725d-1b41-4d3e-97aa-e8f5cbb1d143", "value": 917504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697325909, "uuid": "a6dd47a2-a357-4f0b-90f0-d5d3b102599c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697325909, "uuid": "b232d225-4f98-421c-8b7d-0cef66236725", "value": "0d6c04a14bed92587bd8b955aed3ba11.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b71e5edf-6a55-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697262687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697262687, "uuid": "3f7d337c-496b-47d7-aab2-d924ad94917a", "comment": "Malware payload (RedLineStealer)", "value": "90309a224a627e85b0adf140389ac3bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697262687, "uuid": "c905480e-ff35-4a31-ae57-3fec6ac2c9fd", "comment": "Malware payload (RedLineStealer)", "value": "399f3c221f992955bc825bfd2b40bb320efe775801b7ac6f0fcb6a2a4dc2eb93", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697262687, "uuid": "f47f0fb6-c2d7-4b3c-b56b-3b1f36c8d1ac", "comment": "Malware payload (RedLineStealer)", "value": "e71ec4ae6e6b904a404dda2a693e30fb9a5031e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697262687, "uuid": "4ca3d21c-3fde-47fc-8d92-59c0285ae00d", "comment": "Malware payload (RedLineStealer)", "value": "5dadf9cf804dff3711b5b1b6e1196301a5c159f1ec62530b6957196d7e6d781cef80ca0f8e035fc0019c7895a16bd14c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697262687, "uuid": "43c41ddc-986b-49d3-af8f-cc80a0084390", "value": "T1D6459D2279C541B5EDE750BA43ACB939851ED8A1131122CF0AFB17FFE714AC17A3648E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697262687, "uuid": "ae2a3653-ee56-4844-947c-d9ea1ef3c249", "value": "9b0aa150c770a62666d246af48611e04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697262687, "uuid": "6294ab2c-6053-443c-a5be-efe118e6730d", "value": "12288:O43UZkZFXpsxk7UOtPHQ2eH3HP0xfp5+Loc/YPcQiqut8lZBRe71KkKnKEcFMZ6j:Agpsxk7UOtPHd/xx5X0Wf9tTZ6tlW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697262687, "uuid": "cbb2ae7e-b892-453a-b68f-5846dedf6459", "value": 1225728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697262687, "uuid": "028d7a18-0088-49e9-843c-8c3154f40ec6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697262687, "uuid": "4be264ee-aa9a-4609-99d9-f9cc34b51605", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ff85b97-6ad9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1697319341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697319341, "uuid": "20beb684-cc53-4315-a07a-f2032b0cf902", "comment": "Malware payload (Smoke Loader)", "value": "2dbb58de384e320b5d0e4c4536096ce8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697319341, "uuid": "af2ea308-a691-4fe9-82d9-43db0dbaac2f", "comment": "Malware payload (Smoke Loader)", "value": "3aec0ad346af22c0b4de3b6ac3a5f685eb2be4be5d250e79b3c6fc0d188766d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697319341, "uuid": "f0f24489-6935-4a12-86bb-3b7bad85dff5", "comment": "Malware payload (Smoke Loader)", "value": "eeea2055cc885e2ba89f15cd0304fc35698e2998", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697319341, "uuid": "8e176a31-cc3d-423b-91e8-e0f09b4f4abd", "comment": "Malware payload (Smoke Loader)", "value": "4450c51007a734d3a7e2ae354300868523886ccc08694ec34c194add49d2936f8303c261f68a88a3225310082402cf44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697319341, "uuid": "03e656bb-b5c4-4ac4-807c-4fde5a245c4d", "value": "T189346B9392E0BC61E91647378F1ECAECBB1DF560EF5967DA12184E2F0A711B2D263311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697319341, "uuid": "4e6f80b0-ffd2-4b6f-88a3-1eac5ce469b5", "value": "ac884caf40631ad7d38fc4bdd9ec1343", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697319341, "uuid": "aa49da22-ef72-4e59-9cb8-d93045829699", "value": "3072:2LLLaADrQczp8Qcr+4nHYIvwEaZyIZykAzz5Du+O497d7Q3pK:2jaAIcqQY44wrZokAxu+O4H5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697319341, "uuid": "8736a8fa-d2e4-4f5e-972d-870fbdec0c8c", "value": 242688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697319341, "uuid": "c738c8c8-5c0c-4797-9cfe-aa7e1099ece2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697319341, "uuid": "4417ff78-bfac-496a-9612-6f45d18d6dbd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1126930-6a91-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1697288554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697288554, "uuid": "cbadb8da-ee27-4367-957d-7369c1272524", "comment": "Malware payload (Smoke Loader)", "value": "5ca130b7a27b1dd95a64d086d6bf5590", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697288554, "uuid": "36622882-aeae-441b-97a4-aeee2aeff53e", "comment": "Malware payload (Smoke Loader)", "value": "3d2aad86f093b74a8a803ee3f4a67afe26d3d0fbe2c738a5fce7829c377ac6fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697288554, "uuid": "5fab67dd-a150-48bb-bcf1-c5e0b8b3bfe9", "comment": "Malware payload (Smoke Loader)", "value": "3acc6e4c382bb4551e9f8ff7c009bb9ae84ef805", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697288554, "uuid": "dc3fe8d9-58b7-4645-936d-13c4bf830950", "comment": "Malware payload (Smoke Loader)", "value": "cca6e75222088acfb159f958e3bcda6a310dda84efe1c33c93f324d99b160d0bf6a0ffea6439bd9658f1b2e9084a4973", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697288554, "uuid": "e941a523-9030-471e-abee-1021a379d805", "value": "T1C255232197EC5843D9F257F209FA46D70D323DA29E24826737469E560EB2BC49E3133B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697288554, "uuid": "8063bac3-e4e4-480a-91e9-cc10492fb1e5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697288554, "uuid": "2c05691f-9181-4308-9153-123b0ee9621e", "value": "24576:kykGv7UhkvU0HZ020sJczOmCpIJ2PWyiOyDPHmIAp1EtnG3:zkGIhCU05HXWlEIJ2KpPHm7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697288554, "uuid": "c046f6b6-a044-42f9-a3e8-5bd340833045", "value": 1352704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697288554, "uuid": "25470067-822c-450d-9553-4066fd74cd88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697288554, "uuid": "e7712b1a-4e80-45c4-a562-c385a3bcab99", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04ddf9af-6acb-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1697313068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697313068, "uuid": "4a87f246-9764-4c29-a78c-df2bf12df93f", "comment": "Malware payload", "value": "9809bb3b00ac26f590970442a4a11cf1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697313068, "uuid": "23668cfa-6abb-4ff4-8ef4-1dd9b5516105", "comment": "Malware payload", "value": "3e137b1ad61588380e1e68695288dfcfcd5e14479dcbe2db84ae043410ba8131", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697313068, "uuid": "4e67c378-4964-4c73-9d95-6454cdd46379", "comment": "Malware payload", "value": "98cac02b8440e190a542468b9455b944c3870c1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697313068, "uuid": "4f138ace-36b7-4f43-a2bf-ad73eb709d00", "comment": "Malware payload", "value": "205b06b50238762ccff678ba43776b2d4f317396271a66d3b67d3ca649001ebb56ef6106ad8e9db71e7764b5ee36b682", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697313068, "uuid": "7eb91f5b-8f82-44d2-b81f-b5447b352b4a", "value": "T1BC152302AEE98522ED722771ACF307D30A323D41697A47BB3301B89B1D72A54D97177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697313068, "uuid": "200fd411-e71a-4405-8208-b889168f7714", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697313068, "uuid": "e2e0c5cb-765a-4ec6-8336-1fb9c3f76e14", "value": "12288:vMrTy90MPPEM/z05CDttASadU444g0L10UBDvp0Ew4PH2x+UopRwglfkp2Cif7VA:YyzYkiq4RZvKEw4N+gtk4CijVUywW/K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697313068, "uuid": "481d6569-d791-41fc-87a4-93a2257f2540", "value": 898048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697313068, "uuid": "24fd2a75-b16e-4f29-8d09-76f8d26e52fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697313068, "uuid": "bdeb1ff6-3d0f-47f0-936e-18ed164a4f9e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbc84cfb-6aa1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697295444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697295444, "uuid": "542de30a-9f6d-44cd-8e90-b5a6dc1bca43", "comment": "Malware payload (RedLineStealer)", "value": "850a7808a989a305041ddfae66bdc862", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697295444, "uuid": "e3784d79-9064-4319-a43c-c312da0f1aef", "comment": "Malware payload (RedLineStealer)", "value": "3f61b1490dccdd36a2307b6376b6b682b988815bbd7ac5805315ff2f7f6aa649", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697295444, "uuid": "2071982e-fddc-4a6c-bca6-d745d4091a7c", "comment": "Malware payload (RedLineStealer)", "value": "530b1d0c84aab26ba14c9c2083716072b3c19ce2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697295444, "uuid": "6f653b69-56a2-4f2a-95c7-024a8e2efb94", "comment": "Malware payload (RedLineStealer)", "value": "c478c66fbad310e4689e2c14703889ee29752b0ef1bcdecfe814f428daf2e09503afa67794dfd9374a4df1fe11eb3f41", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697295444, "uuid": "de2f054d-93b3-4d51-8408-146a77814f1d", "value": "T1152523016AC94967E9B66F3018FA02D30E367D266D34472F13A5F8179DB3288B97533B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697295444, "uuid": "6b88837a-34dc-4556-9068-b826f040d9ac", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697295444, "uuid": "23889d25-0874-447b-99da-00e0a0c5c9b7", "value": "24576:lyEJ7NopOVjSRW6fNF95NNWXRy+3Ht3QfV0l:AELVVj8/95s3Ht2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697295444, "uuid": "80360157-f740-41df-8a25-b65663b1e638", "value": 1006080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697295444, "uuid": "142a1a8f-27dd-4c4a-9ce8-a22b920e8ad7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697295444, "uuid": "ddeac9c3-1a18-41f3-af58-325f31681075", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8b39241-6aeb-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697327194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697327194, "uuid": "e8f86bf2-c56d-4cc8-876f-270bab467b74", "comment": "Malware payload", "value": "28a8d7f8b63c92d479ddaec607b70be2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697327194, "uuid": "5ff5f99e-99bc-4203-8671-1f6b1e0fbb4b", "comment": "Malware payload", "value": "4023d96589970420857763ffa1f1fd0eb79668344e095f9e81f851e479e776cc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697327194, "uuid": "efcf03ba-f4d0-4b2e-b26a-089e1275c7b2", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697327194, "uuid": "a983177a-7e83-427c-8493-b84491dababa", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697327194, "uuid": "27398e5d-7423-450a-88e3-0f5164418182", "value": 506880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697327194, "uuid": "1f1ed46a-5261-468b-b9ca-09b11d0f7d74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697327194, "uuid": "592e2d44-bbe3-4172-8bdc-8acc12fabed5", "value": "1106\u3010\u770b\u76f4\u64ad\u3011\u79d2\u770b\u7535\u89c6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86188876-6a68-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1697270765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697270765, "uuid": "649fa2c3-4bf7-4b82-a626-7d90324f07b7", "comment": "Malware payload (Gafgyt)", "value": "5e713c7e49bc207d87e7f12ead9ef720", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697270765, "uuid": "9e17410f-c59e-48c2-a93f-94ab988b1318", "comment": "Malware payload (Gafgyt)", "value": "40bf31cae934a6d3643e41ec1b03dfce3041418b145830529fb9579de83ba7f7", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697270765, "uuid": "68ed677b-cd06-4a09-ac46-bb726a19c765", "comment": "Malware payload (Gafgyt)", "value": "cb1c42c1e42e5bca0dd9ab75b4b7ef24baed8838", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697270765, "uuid": "041bc68b-3fbd-40cf-8fa1-70fd7df50a5e", "comment": "Malware payload (Gafgyt)", "value": "703d3aeb403b5b7b0bced7cd6a9c6d7ff9b292878641966a2054c76dfb246bb2aa82bbcd6fd8f97048bc7e251862a6d6", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697270765, "uuid": "a94af05d-10b5-4f17-964a-cc257f8c03fe", "value": "T162C35B46B6C188FDC09AD1780AEEB037F861F0FD526CB56727C0BE261C4EDA14F29A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697270765, "uuid": "0d3425ee-c48c-44be-9974-fe4752df4bdd", "value": "3072:CR7sDpvZSZV6w2BHXLhfXKZNVNfnNnTRwbZnp:87sDpvZSZVBG7h/iXN5TRwRp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697270765, "uuid": "cd451fac-08ed-4454-8ff2-03e465ba80bd", "value": 121528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697270765, "uuid": "cac8e351-844e-43e9-ac5c-f3591b4a47da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697270765, "uuid": "823f4777-bb89-4986-90b3-2461d8048fa8", "value": "5e713c7e49bc207d87e7f12ead9ef720", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d56dcc3-6a9d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1697293487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697293487, "uuid": "6546c8cd-c7fe-4dab-931c-95aa1fcc9c77", "comment": "Malware payload (Smoke Loader)", "value": "badd11522179090a9bfc5e0c34dff327", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697293487, "uuid": "6f355e07-0fa9-4237-9b7c-432602242c8d", "comment": "Malware payload (Smoke Loader)", "value": "4122a3d42c2871f6e518a2556d0fca95e9b529064711d0fb265472b5aae8843f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697293487, "uuid": "10a3eb6a-23c6-46f3-9aa7-59daf1bd722f", "comment": "Malware payload (Smoke Loader)", "value": "38d3af9f564652d665b0367663a78d07aa0a9718", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697293487, "uuid": "1432c39a-455d-4442-b92e-9b38514b4ee6", "comment": "Malware payload (Smoke Loader)", "value": "2cb63d66c01858ce3134f59411d786348da64ecfd9cea25dd38e889514676e8bb1143fd762d8922e4f24cff77b00ff57", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697293487, "uuid": "8d8acacf-ca6a-4b5b-9fa3-cd88c34601f3", "value": "T161552352EAE8C533C8B427B41CF307430E327C924F20C746679E599A1972AD1BA7837B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697293487, "uuid": "ac135ea5-5b03-4ebb-8834-3dc3a5605d3a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697293487, "uuid": "cfa03726-be60-452a-90d5-6094f78e1d54", "value": "24576:5yPP4313+RH6KRAGgiPVIJfbP9fPhXYWB7pyNzimwiRWk:sY+RPAJs6tbPFPdYWPUikRW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697293487, "uuid": "a64e0595-9fab-48e7-b791-56f744161e0a", "value": 1354752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697293487, "uuid": "7071471f-8a3d-48e2-9ae1-fa49e795fac4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697293487, "uuid": "06522fa3-7244-4809-8c91-bdf5640f6985", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8db30caf-6aa2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1697295688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697295688, "uuid": "1ddd2d80-1a0a-4ab4-9773-bec0783ccf53", "comment": "Malware payload (Mirai)", "value": "447d522776912911a557f5af53d256a6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697295688, "uuid": "fe33d045-4623-4308-92ba-946b9dbe6d34", "comment": "Malware payload (Mirai)", "value": "4150d73a360b6d23ccbfe95d085192f9ba57276f79e50c9057041604c237e388", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697295688, "uuid": "7ab2234e-022a-4bd0-a645-18ad2bf2ef20", "comment": "Malware payload (Mirai)", "value": "4e45d99f9be982bd5430c4b73e7f9438855b92f1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697295688, "uuid": "4deeadbe-d479-4ea8-a231-88bbda76ab5a", "comment": "Malware payload (Mirai)", "value": "18fc973b6d7d83fb71b286cd09f97f438cc434c3ea2fc1800ae47fefe4a3d8aaf4936eff54b2daed7dd1d90613f77c55", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697295688, "uuid": "92b37485-3a1f-47af-ad38-98a79f1f7381", "value": "T1E2738DB6D1685DB4C1044A7476A8E9B44B036504A2B33FF1CA828F695407EFCF61ABF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697295688, "uuid": "a35b905c-60b1-4d93-a779-dc0634355e2b", "value": "1536:m/OPr5CaNWu7hsiCUaESQUkvUInwAeC7/z:marUf0yh+SxYZnwAe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697295688, "uuid": "e3185c7d-7fb2-4aa3-b1e4-7000187583e6", "value": 74852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697295688, "uuid": "f5918cba-9d4a-47db-9157-1e2a2b65664c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697295688, "uuid": "a59e5c39-6cb3-44cc-80c8-6b6c131aaaf2", "value": "447d522776912911a557f5af53d256a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1652696-6aa2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1697295722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697295722, "uuid": "36305062-b6aa-449e-9c8b-3071ddbf3f58", "comment": "Malware payload (Mirai)", "value": "69f8f68f9c61663d63d992e3db332c6b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697295722, "uuid": "db10f884-c4d4-431f-9ce9-534a4fe5d55a", "comment": "Malware payload (Mirai)", "value": "429d14134aebb0ce449d25bdf3d2afaf650229aaf1008fd76e8140c4729eda39", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697295722, "uuid": "ca826dc1-35be-437c-afed-817692a4142e", "comment": "Malware payload (Mirai)", "value": "e765dd64bb473cee5240e94578080eda10c583d0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697295722, "uuid": "3094b392-d461-48f8-8442-13298901a3ec", "comment": "Malware payload (Mirai)", "value": "6ce55ece91784a3940307ec420133b1dd62b4de9b27f1a6c2fcd04172ea8fe10feaf5bac40dffe501e7a0c58ec6d36b6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697295722, "uuid": "0d43a6a2-cce9-4045-b5de-fca294749513", "value": "T10A735DC8A5C3F9F0EC040A783077AB71AD77F53B6179DE9BE7E96523A841602910229D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697295722, "uuid": "8ac23301-4d6a-4f5e-ab1a-bf563d3dd7f1", "value": "1536:oJCMny54LiYugKbKz78/2nW6r/G81XpQkE18HbZNWPSy1bzE1Oyb/4V0tum:oBnyqLiljiw/2nDr+81XpQ/CHbOcNj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697295722, "uuid": "7c9b4d41-3ef5-47ef-b969-0b7b240df093", "value": 74512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697295722, "uuid": "1a50f36d-d208-4f69-8912-f69383b22d7d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697295722, "uuid": "443677cd-9e78-4afd-bbe5-54cb39d7c597", "value": "69f8f68f9c61663d63d992e3db332c6b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4138e0e-6a8e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1697287190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697287190, "uuid": "d087fcdd-dbc6-4712-8b4c-8a9192234c3b", "comment": "Malware payload (Smoke Loader)", "value": "4c6200f456daf14003e3e75091c242f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697287190, "uuid": "2fbd49f8-d5d6-436b-a3cf-c4d9eeb8c722", "comment": "Malware payload (Smoke Loader)", "value": "43632086b2729fd2fc4256ffddb1030fa0287a45bb27a8c89f3e607e99e03aea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697287190, "uuid": "aa35f583-ca81-4d1e-a91a-582059fbe6d3", "comment": "Malware payload (Smoke Loader)", "value": "199c807b97db41dfb8c2f8004a97699a35abc924", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697287190, "uuid": "215bbd18-323d-43fb-9688-ca70ad636d44", "comment": "Malware payload (Smoke Loader)", "value": "807f93a1740a5613d2d244c84a5ae001351394e088ae3fdd4ff68b02a9b272206027fba6d5a0acac65f021411cfd0696", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697287190, "uuid": "263679e1-6e98-4665-b687-5f9adeb2969a", "value": "T199552342FBD81972EAEA57709CF703D31E32BD728B7C075B279699580C629E09630727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697287190, "uuid": "4f91e0e5-4120-42dd-8146-22320708085d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697287190, "uuid": "922c6d20-cfe9-492e-81fb-086e5d7aad12", "value": "24576:QyBOrr9CRSB81nqUVsS8QTA8eX8l83NpQ+t1zYS3H4XO1NP:XBOv9eSB81nt9TeP3ISzYS3Y+1N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697287190, "uuid": "dae484d5-9832-4a11-8ac4-449376650f33", "value": 1352192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697287190, "uuid": "1bda8edb-ee52-4928-a1ec-9b767314c430", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697287190, "uuid": "db547b51-2f38-47a0-91ab-a85a747f4056", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bb0183e-6ae1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1697322743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697322743, "uuid": "752ce9a3-590f-4c70-90b6-befba7c2aa7b", "comment": "Malware payload (Amadey)", "value": "075290eb9ca1ae0621b88458c6ced84a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697322743, "uuid": "243324c0-9c4c-4b0e-95fd-029a7f205134", "comment": "Malware payload (Amadey)", "value": "43f0a52ef8cb607408de462ccb9bb10f8e94df9aeefea05f84276eba99bc216d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697322743, "uuid": "344bd21c-d7ad-468b-bc5b-6acf1dcdac40", "comment": "Malware payload (Amadey)", "value": "24e59d01ade44529e86589c72fde2f24f7432ce1", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697322743, "uuid": "5775a0d2-b1dd-4d7e-89cf-d94a0ca7ffa1", "comment": "Malware payload (Amadey)", "value": "19be20f98aa8c8e5d232211dcc6454ac5a5d32b55d0edac0cf999c8468e829da7ee5e6f545ca3e3bba10f389c2787798", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697322743, "uuid": "3554503b-9b4d-415e-b588-67c04716f2cc", "value": "T1A7152303ABDC4573C9B63B7098F502E70A36BED29DB4839B2251199F0CB26C56A31777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697322743, "uuid": "077d9faf-244b-475e-8a03-8e5736a8ae0b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697322743, "uuid": "21db3c03-071a-400e-86b8-c37163e05eab", "value": "24576:xyIkl6pDd67kjncQmiJKxIkWBp7NqzVJ:kIkl6pDY7kjcbiJKOv7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697322743, "uuid": "62d6b05a-a9c8-4099-a0f2-f52c8c26f520", "value": 898560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697322743, "uuid": "cb1900dc-65b6-489e-9574-7992cd8f4d69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697322743, "uuid": "79542336-514a-457f-8e9c-b6000559d0c5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5d44f46-6a68-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1697270818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697270818, "uuid": "ab213bc3-a9f1-4188-9828-a8b92a332c2b", "comment": "Malware payload (Gafgyt)", "value": "767955cd8c84f84a21a2d169798af171", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697270818, "uuid": "03760fad-5352-404d-a93b-523491048002", "comment": "Malware payload (Gafgyt)", "value": "444bc3fe4c590fa0f70693a15ebd5778270b6e4a9386cd32e694f1a998a54ad0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697270818, "uuid": "795e9f63-a36e-42a7-812e-3956c617c993", "comment": "Malware payload (Gafgyt)", "value": "166ce1aeb6ecc781bbd5c8151129e467cf35437f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697270818, "uuid": "891b853c-e0d3-4e42-8a60-ee9d52545492", "comment": "Malware payload (Gafgyt)", "value": "f93bd913456a6da65cb55ab4a9579a87381dab242aa5d5dad346cb4bb7c5579e8e1c2397f66f335067df4f9f1459b57f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697270818, "uuid": "c4f60578-5a94-4632-a5cb-bda7265c6da9", "value": "T172C33B25BA361D27C0C4A5B722F70725B2F343CA22B8C55D7EB20D5EEF642406297AF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697270818, "uuid": "5c62da89-f9a4-4de2-9b51-8959d5641a4a", "value": "1536:3ImSKIw4af2iBqV9q7+UN10toQpYMlIYhY0dogZ4cVIoR4ELBzfyZBLev5T30lMw:Y3zvqzkBmGd0l8d7QYlbNwbZn2OP9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697270818, "uuid": "439190d7-f4cb-45b2-ae9d-a42e107ef249", "value": 125444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697270818, "uuid": "633dad09-763f-45a7-8a64-088173a3720e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697270818, "uuid": "63019df0-95a4-4866-b14a-d8c32ced9d2d", "value": "767955cd8c84f84a21a2d169798af171", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6dbe8eb-6aaf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1697301422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697301422, "uuid": "7c30df00-f2a7-47e0-9fc9-45c71b7fd1c0", "comment": "Malware payload (Mirai)", "value": "3a547d8e7221ea8431d747b0ba37a66e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697301422, "uuid": "61ad242d-9e74-42de-b8af-032f057d3977", "comment": "Malware payload (Mirai)", "value": "44bfb973b25a38d4bbaadbfae9a67414471dc4722b0d84ce62a7ed24bed5b717", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697301422, "uuid": "67be833e-5b8e-4563-a438-110dcbcf8962", "comment": "Malware payload (Mirai)", "value": "17e8321a4d3539b9c8fc9e3004120dedce069385", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697301422, "uuid": "4c59d1f5-5d80-44c5-836b-a685564f3b74", "comment": "Malware payload (Mirai)", "value": "eaa43c24f2170abe8fd1832e79869e15ec1e1f644cbab53587ca9ec132743176c18670cb30a46e157fd3757859b44cd4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697301422, "uuid": "6ad93d39-2bd8-4249-a67e-01e36961713c", "value": "T103333A8A64112E6DE9DB5CB981664F0ACE541210B093171BB3BBFEC339333A4FE66549", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697301422, "uuid": "1fa37191-d34f-4219-b5ef-4d6c53cc5724", "value": "768:oaXTrofl4ghoueg2me2nPQCHEM/ArPwqLWHm2T6oxol7gSu9+f1prtkO40eViM:oaKdhoRg2mew4ChAVLD57gSyg1pRr7M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697301422, "uuid": "e1c90086-1048-4199-87a2-2f3bd0e9a197", "value": 52820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697301422, "uuid": "7022ddee-d561-40a7-b195-5f70cd522877", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697301422, "uuid": "cdabbfe2-23c0-4b3c-b517-6f62c967e044", "value": "3a547d8e7221ea8431d747b0ba37a66e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12e65ddf-6a72-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697274867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697274867, "uuid": "6716f566-d795-4cd4-8c47-a0d330f29625", "comment": "Malware payload (RedLineStealer)", "value": "ea67ea7b5fdbd80c69d9ab73ecb17c55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697274867, "uuid": "c2c836b0-3b8b-4d53-badc-d0d4301bb6a5", "comment": "Malware payload (RedLineStealer)", "value": "467166f371775ca6da6a789326f6fc4501f4f76f4311fabd5e509574f13cf48d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697274867, "uuid": "8c850c9e-ed36-4184-a141-53a0342effe0", "comment": "Malware payload (RedLineStealer)", "value": "0e12ea15b50e9938d4612ecf2bced153323fb617", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697274867, "uuid": "c176140b-45c6-4a41-abf4-aa6ead708082", "comment": "Malware payload (RedLineStealer)", "value": "3e377e9d9eef81cc266599527edcdb9306340a1d4046bb91b008de3ce788a07b0b7988082e60ffa0d18ea827e746ccb6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697274867, "uuid": "805009d3-0962-4333-be6b-06caaece6a8a", "value": "T1F5345B5362D0BC61E82687738F1EC6ECFB5DF961EE486B9622185F2F1971172E263310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697274867, "uuid": "d0abbc5a-0704-42c5-9fb8-40e943325676", "value": "7e12c3437927282853f4831206fd4e89", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697274867, "uuid": "7bbead78-1d17-4e29-8a19-a6607f56714a", "value": "3072:Azhq34Ie3E/Tihf5C1kI/wAem3Sx4IVzdtE8LZ5jKtGJvxc:cw4E/Tu5WkK1NCx4qdt1zKt6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697274867, "uuid": "4bec7eb5-df32-4d43-8eaf-4cce1bd6174c", "value": 246272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697274867, "uuid": "89d1449f-aa06-447b-946c-b82118933972", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697274867, "uuid": "7e8b4d97-f2b3-4298-9cd8-5c8ada16414f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d92eb021-6aa7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1697297963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697297963, "uuid": "3a91ec7e-3850-4d46-93a0-ed5c8e3b3f25", "comment": "Malware payload (Smoke Loader)", "value": "e62b7c1370114bc133561914ccf30efd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697297963, "uuid": "9a8baef0-59ed-4cae-9150-d6c010f9f39d", "comment": "Malware payload (Smoke Loader)", "value": "4829c79709a464c0a10d17053c6916df5a0f1f500ebb10af230e35d548ea3265", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697297963, "uuid": "48cb17d8-84b9-41b0-859f-0d2595facc70", "comment": "Malware payload (Smoke Loader)", "value": "3b64265e70adedc23ef033488b164a9e02e38d54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697297963, "uuid": "51352847-374c-44f2-be2f-63d474aa883e", "comment": "Malware payload (Smoke Loader)", "value": "dbb4e4067e2f6d304552ac8778aa5ed81748c6781a558888ae5b86572418af59c8cd08f52d6130852c34642634aae540", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697297963, "uuid": "e204a967-275e-4194-98f6-b95770f438e2", "value": "T17B25234BBFEA8473D8F4137518FA12C3133ABCF16AB847EB2359A9586C72554583133A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697297963, "uuid": "0e57d620-4251-4cc5-80a9-a30f9768ddfa", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697297963, "uuid": "42ad14fa-3d2b-4e70-a4d6-b8fdb1a35eb9", "value": "24576:oyi6QdftypHLF6csV3SAiJ4SGFyRl25fiFVybhwbNVMaJ0Y/Z+:v+1OR65VQJzGYFVybuJVuO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697297963, "uuid": "7847a9b5-eaff-4469-bc9f-dc68c18d24db", "value": 1002496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697297963, "uuid": "899f6694-88f3-4b64-a999-3db808188ca3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697297963, "uuid": "e48c9a8f-73bf-4a83-965e-8e76d09d21bf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "207dbabf-6a27-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1697242677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697242677, "uuid": "218197a6-88af-4c88-a45e-0d80ff9aa2c3", "comment": "Malware payload (Smoke Loader)", "value": "dabb6ed1fe1ee72e02a9500880b78a34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697242677, "uuid": "7f2caa89-3ea3-4b36-bd63-306e6d6a2100", "comment": "Malware payload (Smoke Loader)", "value": "4fd6e003303ec966683881181049eb2f4c57bcf0163b7f9910a97543799c6344", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697242677, "uuid": "acb59b0f-9c43-47e4-bdb6-24a05e2d91b4", "comment": "Malware payload (Smoke Loader)", "value": "604a67d95c54dc4f474cebd7d68ca8a36309ff31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697242677, "uuid": "124b004a-7491-413e-be61-0f9332b357a9", "comment": "Malware payload (Smoke Loader)", "value": "a95f7c36d552f99e78d59eb7c7ca47bf3a74efb9590a603945be0c35e9837310c3791378c0e02660396f0967882930e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697242677, "uuid": "a5813b8c-f17b-4589-8545-566558bcd5d9", "value": "T1917523A7ABD4D4A3E6A12B7044FB03430B397CA599B44317AB15B92B4C337C89071B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697242677, "uuid": "b80c0cad-8954-43ce-92d0-8b68c3d128af", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697242677, "uuid": "56bafd48-2109-49ec-80fd-997ccaa513b5", "value": "49152:o2YBU6/a0jjiS4Zg/h3Tc5FnIbJvcOUWD5H:9SUa/jiRQTcLIbJz9H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697242677, "uuid": "258b947a-eade-4839-bac7-064b1c9a8c8f", "value": 1626112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697242677, "uuid": "e2de5379-b377-41d3-8c80-3353d27db084", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697242677, "uuid": "0dab56c7-89cb-4e0c-adca-1364ee67fa9b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fba9ce8-6ad4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697317006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697317006, "uuid": "80525029-ffe3-433a-bd22-fae429132d8f", "comment": "Malware payload (RedLineStealer)", "value": "8fa356e3db2661777f140f01e9ff9b15", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697317006, "uuid": "0f41cc6c-307c-467c-97fd-2020ac6de320", "comment": "Malware payload (RedLineStealer)", "value": "500692f70b781dbb61cd087236db31a07a265c713d04925ee62d2ecd3e22cf3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697317006, "uuid": "9101c327-8537-429c-bfa0-80d3c47854a0", "comment": "Malware payload (RedLineStealer)", "value": "9d3f5f6d02c5bd848e3595640c4d051a0ec6583c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697317006, "uuid": "36f64b34-ab5f-44ad-9471-38c51f6ce568", "comment": "Malware payload (RedLineStealer)", "value": "553c164ace73c6ccea7ca227d297200faecf51eb5e4c35aa4630e532444da32afb5dab49fd3113240135a93f70b7b01f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697317006, "uuid": "299822bb-d18c-4dfc-b266-93047343e45a", "value": "T1A9152387E7C49032DDB667702CFB03D35A36BC558DB0836B3A91252E1DB2690987636F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697317006, "uuid": "b5c4c64a-a585-4830-8d23-1edca3687ce4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697317006, "uuid": "bf2b4357-d289-44f1-bc1d-6e585c2b13b1", "value": "24576:oydhJP71FIWKEGN4gKmnfpub1iAhCQChoCB:vtP77RKKQkbMAF3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697317006, "uuid": "ec5e2c73-41a8-4f45-920a-033b4aca616f", "value": 894976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697317006, "uuid": "5cac8087-833e-46fc-a48c-cedb6194efb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697317006, "uuid": "11193624-ba38-463d-b7d7-e0e6affaeb1e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91974a32-6a36-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1697249309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697249309, "uuid": "23513617-5842-436b-8d64-2313db3af3a4", "comment": "Malware payload", "value": "1040b010d6b41f61297b3a00cebffcd4", "object_relation": "md5", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697249309, "uuid": "a85d507b-3d78-4e7f-8160-e7203830aad8", "comment": "Malware payload", "value": "500e47c16f5eb83699e1837a2125a1b7f9c0352eef354c19ef919563e9ae71aa", "object_relation": "sha256", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697249309, "uuid": "4f4029b2-e993-4cdd-9983-b908aff1fe0e", "comment": "Malware payload", "value": "206167f8be56ec36f3a60c9412b47240f57155cd", "object_relation": "sha1", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697249309, "uuid": "361d942d-91da-493f-b88f-7c3c04f5592d", "comment": "Malware payload", "value": "fe484dff16a8c6026a54db04bd42be4339190599a878571f7a0d0d5a98ad1b29c349003003272dbee256abbc943dd6c6", "object_relation": "sha3-384", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697249309, "uuid": "f636a24b-edea-4de9-bf70-2e63f965fd50", "value": "T1B122AC52FD0B8E74E056DE8A2D07A0D2C9320402FA44A5D4BB9CF7CD978F72994FE660", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697249309, "uuid": "af0d4279-d0a6-44e8-8f15-e08c1b5a0309", "value": "192:fpPMu0Cp4EmpXUHg4KR/oNQsKTUm1LF3K7w:fp0zE0ig4KR/aQsKwmv3K7w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697249309, "uuid": "aaea90b7-7ac0-413c-90ce-77456b721a91", "value": 10032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697249309, "uuid": "54134e82-ea3b-47dc-b2df-3b19717fb91a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697249309, "uuid": "6288e0d1-8c1b-46e5-9225-a6f834ee2d10", "value": "5c633ac0c18192e78c4ec6d04db62ce26864915906a32bcd8daf62c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6325bff8-6ad6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697317951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697317951, "uuid": "e5eec4bd-00d0-4d43-b1f9-2587dbbe1a6c", "comment": "Malware payload (RedLineStealer)", "value": "3ac3f16a15488adc812a749edfaaaa6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697317951, "uuid": "be3557a1-b10d-4634-8ea3-1ddf056ebb61", "comment": "Malware payload (RedLineStealer)", "value": "52c861ca4790016074d833e47107a6c24e07663d569e6eb6ce955c3ec67aabef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697317951, "uuid": "08866e49-3503-4590-ba1e-4b821d5ab8be", "comment": "Malware payload (RedLineStealer)", "value": "b0575aae34a5aea1776f7b92679cdaca18803945", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697317951, "uuid": "1c95b244-cd19-467d-b900-04362096ac8e", "comment": "Malware payload (RedLineStealer)", "value": "e396422b7386d8165709425dca601323dd2a6d9093e8b4626bcc165880102c85543c45d2c656bb631f757948e14b1e99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697317951, "uuid": "8e4dd848-c047-49bb-a096-a9054c401781", "value": "T160152342A7D48072DCB05B7025FB02931F35BC929EB9075A6B57DA4B1C722C4B936B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697317951, "uuid": "72811835-e29f-417a-af12-0e053505cbcd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697317951, "uuid": "0d2de13e-a342-43ee-a08f-e4bf9dcbafe2", "value": "24576:5yo8u/fJzZgbtvTZxpur58REe3+mRKfa:sPK9Kbtbgr59e32", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697317951, "uuid": "40eac8fd-4a05-47cd-9626-4fb807f72110", "value": 898560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697317951, "uuid": "a96c1fbd-efae-478c-9a0f-94e6f7bb435b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697317951, "uuid": "f9a904f3-a29d-4890-9c23-a508d09ce281", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41ed0107-6a49-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697257336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697257336, "uuid": "b32557cb-f74b-4e9a-a484-1f890bc9f56f", "comment": "Malware payload (RedLineStealer)", "value": "ec2eb30e73f9bb07265ee947ec511d04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697257336, "uuid": "3a5210f6-f729-433c-bff5-5904ab7bd48e", "comment": "Malware payload (RedLineStealer)", "value": "545ec6bd8cf55de8c2881a4a95dcc1939bf65d1d1b5679a0c8548fa2f7db86a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697257336, "uuid": "97c802e1-b6ff-466d-a17b-c98f12e98a21", "comment": "Malware payload (RedLineStealer)", "value": "216459801142c44ae5b58bf20d573804db0ab4e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697257336, "uuid": "adc8e169-b8ae-4e70-9656-d40a07a7e4e9", "comment": "Malware payload (RedLineStealer)", "value": "8b3e4cc4da3a2ab14cc5bfac0640c53bf32e9557c6b478f82027a071ad614fd1be564c8a99b98a1bdd4ace13cdb500ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697257336, "uuid": "a0afd1ca-1603-4e16-97f3-2d3d5dd59678", "value": "T1437523939FD08827EAE0533055FB02830E7D3DAA153886663522B45E1CB2BD5DAF2777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697257336, "uuid": "8186249b-444d-48c8-b527-29704392c1a3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697257336, "uuid": "ca5a21e1-7f8a-4028-bb51-137c3e0298d0", "value": "49152:WELCg1eP384JZgjh9gVaJc67PSduux4IvquULvq:hH438kmgVam67PTueI9UL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697257336, "uuid": "b7149b18-dd77-4bcc-846b-db7cdad5213b", "value": 1622528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697257336, "uuid": "096c0b3e-06fa-4c45-9169-b38751cc9c69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697257336, "uuid": "09e54088-112e-4f97-b9bd-b8e41b9381d3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38aeae54-6a50-11ee-a6f9-42010a9c0055", "comment": "Malware payload (VectorStealer)", "timestamp": 1697260327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697260327, "uuid": "80dcaf65-decc-4a90-8d95-664b7a46d753", "comment": "Malware payload (VectorStealer)", "value": "0106014afb9f7f1caab44f645b243c0d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697260327, "uuid": "1fda9251-7f0e-476b-bfba-dbdc7a1c13bf", "comment": "Malware payload (VectorStealer)", "value": "548bb305a618d8078dd6154a1946f3c72541baa4726f469798a2cf02d13188cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697260327, "uuid": "de33568e-a257-44e5-83ea-91ab5316bcb3", "comment": "Malware payload (VectorStealer)", "value": "5d3ea987f7172e04c8fa739c407e34c5f0ba9be2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697260327, "uuid": "9bdd6444-656e-4491-8536-e00f3cfeeccb", "comment": "Malware payload (VectorStealer)", "value": "3bd82e8c1051f45917f7ce9fa18c883ab057c39f2bfba9a7b44e8ce1553a9915c0041438056b9fb8abb5cb7fa96ad942", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697260327, "uuid": "1dc2b044-dd63-445f-a60d-d67f4f14ef88", "value": "T16D05015C23487A6ECF7E9238ECB92D54E774A0B65243D72722C264FA2E85783DE041D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697260327, "uuid": "952e2074-ca9c-4ca4-bf14-f09f32fdc098", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697260327, "uuid": "acfd2d52-3765-4438-b573-21e2f8f7f815", "value": "12288:bQKy58JfruorRzLsTzOuN6F7ZY6S7g/m7PHZ/HWos36kMhRr4+Im3s8a1XP9SVP:Mp5+Rz6OuN6nLSgg/pWoF1f3rad8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697260327, "uuid": "d2d9bba5-d2c0-4a01-95a5-76cc7ea57909", "value": 846848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697260327, "uuid": "2eaa11ff-f935-4607-8b6b-60e25f45877b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697260327, "uuid": "3650d21b-05fe-4eb2-8e67-3b8092b3b7b7", "value": "c1ced09cc58739a92333fa04f1f0e660cbd83a3b9ed936dcc3ef8981803521fa_payload.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f48b1a91-6aaf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1697301444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697301444, "uuid": "d0481b2c-85c3-4cd8-9953-906996484900", "comment": "Malware payload (Mirai)", "value": "23cf4f835b0f63a82b266783a03f176c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697301444, "uuid": "52fee22f-c35f-4439-94c4-9bce9726ac22", "comment": "Malware payload (Mirai)", "value": "54b81d42c6c4fde7a6f90792fac193b3bdc11acb56b69b979f5e2c40b2366bac", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697301444, "uuid": "44fee776-154a-407b-80e7-d88f8b91c6e4", "comment": "Malware payload (Mirai)", "value": "f7823239851d9be9223ce7ff41921b35bde1cc5d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697301444, "uuid": "a1e46403-100b-4157-866f-428782ddbe8e", "comment": "Malware payload (Mirai)", "value": "9aab236db37418c7d6dbc033ed7989955e86b1aa6e3f894d35695a549c292fe8e9d3d32ce1a418b70c227fe43f9204f5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697301444, "uuid": "3a72ccac-1333-4610-91b0-53fef899e104", "value": "T197F2D0224327D532CDB5DABB993182E4152B47F4B5BF30A867A0C6DD9CC1F02D5FA14A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697301444, "uuid": "9b03a8d0-fa14-4411-957f-02adcfa7a2ba", "value": "768:XYVgAxkU1RHz5poClGL1aMnXha7WBNoWhSxHju9q3UELCf:XYyAxdRH9zILLBBrodjTL0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697301444, "uuid": "d704324f-9b5b-4c86-85a5-bc99980ae3fa", "value": 34476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697301444, "uuid": "155084a7-d1eb-477e-91c6-a76be74d0e9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697301444, "uuid": "45f087cd-5184-4867-9413-a63045519314", "value": "23cf4f835b0f63a82b266783a03f176c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9aa1a8a-6a68-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1697270825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697270825, "uuid": "91a7b844-0c41-4d8c-b5d7-f987af6aa54d", "comment": "Malware payload (Gafgyt)", "value": "822fb9800b7940001d2a54c4251dd88c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697270825, "uuid": "048c0dd5-01d5-49b7-8e53-6d4bb1a3f934", "comment": "Malware payload (Gafgyt)", "value": "55dd2810b53ea8812e1d5feba724d90780bb250b3ecf8348c971f2371b8878cc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697270825, "uuid": "2b673419-ee6f-465d-8b52-d2125ad4ee8d", "comment": "Malware payload (Gafgyt)", "value": "0bbf14134f3e214df3213cb6306009fcb082cd1b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697270825, "uuid": "058cd676-9772-4b73-91bf-dedfb28da719", "comment": "Malware payload (Gafgyt)", "value": "fbe7a2889d37996d63f66082808e1aa20d5e80c83e8e872c9959623480f8b7575db6702ab2c37867886261d2fb657979", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697270825, "uuid": "fa29d6d7-eac5-448b-996f-3b7a184ec69a", "value": "T19D242A46EA414B13C0D727BAF69F42453333A79493E773069928AFB43F8679E4E63601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697270825, "uuid": "539c0e20-28d8-4f4c-af28-c6efe3e4bbc9", "value": "6144:NkJs+nV6/0/F1xanP0qV4V2q/wRVi/G5QM/R9/BK:NN+nk0/F1xanP0qV4wz5l/f/c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697270825, "uuid": "1d27936b-c3a1-49bd-9488-eebffec33b6d", "value": 212534, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697270825, "uuid": "3e2b8f0b-b2ba-4e19-b26a-d1fc14ecc41e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697270825, "uuid": "d692241f-c031-4a0e-b2fa-67cfb6d284b5", "value": "822fb9800b7940001d2a54c4251dd88c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dd55ad9-6a5a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1697264577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697264577, "uuid": "f19ffe50-85f8-4759-8ccb-077181c08204", "comment": "Malware payload (Mirai)", "value": "b0b12cff9df5723eac72c6310b1feaa6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697264577, "uuid": "775cfa89-e198-43eb-88f5-a83e68fd3ae8", "comment": "Malware payload (Mirai)", "value": "59676f77e68a5a9e658d61a52d022e2bb2e079b281959df027865078d6939da2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697264577, "uuid": "9cfb2f2d-c406-41b5-8d4f-8d9d990dc815", "comment": "Malware payload (Mirai)", "value": "c0494f3868706bd5d4c6058b680b7b1fec66bece", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697264577, "uuid": "acffa67a-a479-42b4-ad0e-42542af527c8", "comment": "Malware payload (Mirai)", "value": "78ce3d9ecb1e9102de09f5f0fbae4827631a277b2e627eb4e2c805a25628ca69859b666b57e1d2c536bb070c134dc7aa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697264577, "uuid": "6d0001bf-24d4-4870-9dfa-85973b02c562", "value": "T16F734CD9A8025D2CFD5FE6BE94220F09E920631557D30F2BA69AFCD3AD731549E02DC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697264577, "uuid": "23bedca4-1b6d-4477-a926-6315dd32c75e", "value": "1536:uPbm6ylp6SibLETDMwqwGas7LDvKlQdC8st:uTm6y+6MZwnHlyC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697264577, "uuid": "b8dacf5a-ea5c-4741-957d-c5ce1f77cf5f", "value": 78820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697264577, "uuid": "ee847b87-c15c-4497-b689-4dd9e84af6bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697264577, "uuid": "1251e735-cb39-4312-bfba-0a7aa838d31a", "value": "b0b12cff9df5723eac72c6310b1feaa6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b307eba-6a56-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697263016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697263016, "uuid": "cd5a65f5-70a6-456f-a4c4-b885cf4b79ed", "comment": "Malware payload (RedLineStealer)", "value": "7704bc24c8546db50b7861407ec881f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697263016, "uuid": "3d06ec1f-db07-477a-978c-b65cd7f761ab", "comment": "Malware payload (RedLineStealer)", "value": "5988eae1c8a74d8e4db9c02145f56e39f8de305452065b767157f162d1017984", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697263016, "uuid": "9572de80-4c29-4899-b344-5cf84e75665c", "comment": "Malware payload (RedLineStealer)", "value": "f9cd676edf59303a755ca698b58405adbdf01bda", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697263016, "uuid": "796d57f0-0a52-461e-9924-60cfb27b952e", "comment": "Malware payload (RedLineStealer)", "value": "f9e4e9774953255847711d8080b5cdc8b911aa8a9af1ae10bb3edc002445f0f98ad7079d112e5b68cfecef72a0dfb48b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697263016, "uuid": "806a16e4-db24-4ac3-b938-510344d2c0c2", "value": "T1C175235667C5D873D4A5973008F702430F397C929828C777BB45A82A4A73AF1A6B07FB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697263016, "uuid": "7c8774ca-8414-4a07-a6ac-83e7dd859be9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697263016, "uuid": "124b6610-a698-4603-8ad0-d75b709fa377", "value": "49152:PzU0LZzJzLQpyTyU58HIuZgnhVpV5t3LhorR7bXZ4FTT:IafPJ58H1+pV5ZLhoRz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697263016, "uuid": "b32bfbb0-dbe6-4ae2-9b26-ae4ffb5bdf5a", "value": 1619968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697263016, "uuid": "5ab351ff-4ecd-497d-b2bf-9c9127a894ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697263016, "uuid": "2956d570-6e6e-4e4a-aeb1-bf45834f79a0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad6ae563-6a68-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1697270831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697270831, "uuid": "28b8d1b3-20a8-437d-a3b0-99882d76a78f", "comment": "Malware payload (Mirai)", "value": "6dff176cc253b431809bf691145a4780", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697270831, "uuid": "8b627ce9-da11-4170-80a6-8f1b79aa0d4c", "comment": "Malware payload (Mirai)", "value": "5a1eb8014bedf7f9cd81a2083340afa8e83af5c8a824424345bb0f816a79a6e8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697270831, "uuid": "d1d0d997-a039-479c-92ae-e89a04740b38", "comment": "Malware payload (Mirai)", "value": "faa4b5123e4857927a25fc31b138b984947f5892", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697270831, "uuid": "a6edf043-5339-4394-8b1d-058c30f2625c", "comment": "Malware payload (Mirai)", "value": "168fdac51666092e11566f99f43254bd85a5e575376f65a3a11c19968074090bc536bb44056ecbea85397bc9a6149e62", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697270831, "uuid": "7342655d-5b68-4d73-86ce-d602231ac901", "value": "T1E914D70ABB510FBBDCABCD3706E9170539CCA44722A57B363674D528F54A60B49E3CB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697270831, "uuid": "1753c685-a8dd-41ac-8cd0-4f5d32e26d57", "value": "3072:mQnYTCLTN67PEOEZAicF4crp8ST4pu2cnwbZnH4:mKYTCLTwPWAVF4cFn4prewRH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697270831, "uuid": "219c2175-7d07-4269-a4a2-e84d6a9db4ea", "value": 206928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697270831, "uuid": "5b682bb2-9c4a-4228-9fbe-46927a6d5265", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697270831, "uuid": "637cc252-89fb-42b1-9fc5-0201dc474d87", "value": "6dff176cc253b431809bf691145a4780", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "201c221a-6aaa-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1697298941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697298941, "uuid": "5d04d9be-9388-4fad-a8d4-cb6da0558dda", "comment": "Malware payload", "value": "af14aa1dcabfb7ffc139e5d98fbe6ef2", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697298941, "uuid": "4a489a78-ff34-421d-ba25-80bfd8d99b3d", "comment": "Malware payload", "value": "5a30b2bf1f6bbc8180f520653f0262c3d46e73c9ab2e5541b90425d0747da0dc", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697298941, "uuid": "b262d3b5-f7d2-4afb-ac9e-e60d336783f4", "comment": "Malware payload", "value": "dd58540f9c29b3e1b332492a45218a66d31c3a9b", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697298941, "uuid": "3a7efc2a-714c-44f4-84ca-9d4e82c4aa9c", "comment": "Malware payload", "value": "ed1e6e4bf81824acec63da4f1f49fc68dc7ca537314715fb0010776d0781daa60c38f15c3d74b6d6745b6956170cf0d9", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697298941, "uuid": "a898d4c5-2105-4ff3-be1d-c935be0934e4", "value": "T1C293F1F99A6AE5C9C44187F5AD4E32D7C7CEE0E7492822FA387D9197782C894F0005F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697298941, "uuid": "830ce0be-9fac-4300-a5ae-a5e72d3828fb", "value": "1536:RAhtLPgM5P9dqw21OtuLnitEWfuTQr3M7MbUVXCRY5gy71tFjfHCBCqJ/Bjb7qK:RAPdPf21QXDAQr3M7MiSRYa2b/EdJb7B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697298941, "uuid": "35f8be38-0700-421d-a001-bd58d6c98752", "value": 91354, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697298941, "uuid": "18949ee7-feeb-4136-bd9a-9bd33de6b3f0", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697298941, "uuid": "a2c8b748-1a46-47e6-9227-edb786f73500", "value": "Receipt-13785.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a97715d-6a38-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1697249942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697249942, "uuid": "b3875309-a48e-44d7-8e10-f4cde1ce3333", "comment": "Malware payload (Amadey)", "value": "d5c86795046002fb15fe6cd2c8fd7698", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697249942, "uuid": "776425e6-a1c0-485d-a231-c114cf13aaae", "comment": "Malware payload (Amadey)", "value": "5c2004af8f84cc545d90c9884494ca8ab1e192220639b723dcf9cca70b91cb13", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697249942, "uuid": "58fabbd5-8355-4af4-91b4-91b693e45778", "comment": "Malware payload (Amadey)", "value": "ec2a3f1821aa8501a0f337285caf337d378959c6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697249942, "uuid": "2dc76add-645e-44a1-9096-4fe67b975368", "comment": "Malware payload (Amadey)", "value": "0bcac98189bf212ba54114b549e02ea2600edf44433258bae834a6e91461a76b0be07a422f0fde65bf0aeeaa748b00ba", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697249942, "uuid": "3abeed11-41d5-4762-b096-a19331937d6b", "value": "T159752307ABC58035D6E53B3019FA03630E3A7D64987412BB7A05E94A98736D0F6F4B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697249942, "uuid": "8992f54e-3929-468f-8c13-0ac29bc794c5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697249942, "uuid": "c03cd761-f541-4727-9898-1967808b2fd2", "value": "49152:LpIwgFVexsgfVvZgQhwEmaVxfNOlxt9Wx9Ff:I7BgfrYEmarsrtaL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697249942, "uuid": "9c046afd-e93e-4c44-bfde-2b50eb319476", "value": 1623040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697249942, "uuid": "eccb34ae-081f-434b-bfcf-0a2a6781bf3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697249942, "uuid": "0ee7b965-3b59-43c9-a583-527eb49ad108", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac216384-6a86-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697283714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697283714, "uuid": "3ca7427c-2c94-4a85-ab32-fd6e30abc70a", "comment": "Malware payload (RedLineStealer)", "value": "084397b3fda7a1add6115c8c276d5ba9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697283714, "uuid": "b85ce42c-38cd-4fce-89d5-5351c74b0a57", "comment": "Malware payload (RedLineStealer)", "value": "5cfc70eb0d78afd1c25e54c80c0591350a308c88840dcef69728019de31cc2a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697283714, "uuid": "5158672f-7c93-44e6-b690-006a7b8d1713", "comment": "Malware payload (RedLineStealer)", "value": "aa204f39833bd1c9a202bcfce89896001672d8dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697283714, "uuid": "67e85df3-c72f-4879-8dfc-a68c8449534d", "comment": "Malware payload (RedLineStealer)", "value": "8cb78e34838c961ad8199d7b4760552bdeb3b967ada83cc5b03307cf4157610acd36169da6edf5dd74cb8a2a0534598f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697283714, "uuid": "1f5ec69b-fc3e-43d1-99b9-823d5bf7bd1b", "value": "T112552352ABE81035E0F91B3144B717DB1E3A3C629D785A3F2753862E09B15D4B8B633B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697283714, "uuid": "0f6fe479-5222-4077-8b2d-daef1f26a0ff", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697283714, "uuid": "d9c63cae-52d1-4edb-b59a-940e057854c0", "value": "24576:lyD0XfwNfk46616PnYMtbH/qURyr/NRvaknecbcxMyCPtfRbS8:AD0XAM466Sf5QFpasQxh+f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697283714, "uuid": "52946193-a08a-43cd-8657-7d432431d392", "value": 1361920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697283714, "uuid": "8ab43495-ab1b-4a1f-9022-e99261a39d9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697283714, "uuid": "de928277-ab73-4ae0-9458-ef7ba0d37e33", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdc3122c-6adf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697322076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697322076, "uuid": "37be4cdb-a89e-48f7-86f8-2f8400786159", "comment": "Malware payload (RedLineStealer)", "value": "4c74858ebd2a0bc5380998ea302e70a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697322076, "uuid": "c313600a-5d3a-4c7e-809a-a5113931c37e", "comment": "Malware payload (RedLineStealer)", "value": "5eba876e2c06939105568a18a5c9f91efd4160da2b4122ad75fc064fe71c6b7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697322076, "uuid": "e4312e41-b843-4bdb-91bc-410bf27bce0e", "comment": "Malware payload (RedLineStealer)", "value": "66e253d7889c0f14a6f7acb2c9a008f70b672565", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697322076, "uuid": "a5458ec6-2880-463f-b442-42951810b761", "comment": "Malware payload (RedLineStealer)", "value": "3e94b5c5a99f20db2679559f3760f5996675c3831e760de9c824e55443471b4b35a6f399ae18c7582a4541d652b42956", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697322076, "uuid": "07e766cc-822f-46d5-9e0d-9380ba216155", "value": "T19A152216A7D8A5B2ED7017B095F016534F36BC416D781BAF27D0A8AF4DB2AC4A831337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697322076, "uuid": "c3e8d8d6-d83e-4faa-a1ed-3abae229cb43", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697322076, "uuid": "cfb20e35-c70d-4a9c-bedc-ce968da6e90a", "value": "12288:DMrXy907jpc6sZ6zQfriWoAJjfFifnJcnAE70uOcjrosoBW4n7zUm8sKi9W0S:4y4SV5LoGjfsRcn50uLjroe47zUm8s0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697322076, "uuid": "8e92896a-f736-46bf-863e-4d00f5e0f98b", "value": 898048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697322076, "uuid": "53ea9853-9437-4f7b-85c9-3a95c9be5938", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697322076, "uuid": "9ebe1017-afcf-4427-b4df-71490fad8fa3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91182e8d-6a3f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1697253174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697253174, "uuid": "e908bccf-5184-4c41-b33a-6e1fedee527b", "comment": "Malware payload (Smoke Loader)", "value": "3ed17c1ae0d4a13c878a4189097a327a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697253174, "uuid": "ecc0bf10-b212-41d9-9066-0a9b17a0709c", "comment": "Malware payload (Smoke Loader)", "value": "5fad7cf1dc6fb3147d4d6ded314ea5305a472348ebb8ed9ebf3d01cc4d50f83e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697253174, "uuid": "dc84a84a-891f-4a78-bbb2-d2422bbd3cf4", "comment": "Malware payload (Smoke Loader)", "value": "d4f97c34f1fa4493a9ed1697b3d8fedf290b5f11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697253174, "uuid": "2c0cf2e0-7783-42ff-b825-ce508c56e92c", "comment": "Malware payload (Smoke Loader)", "value": "6d9e67b5eaa143f3f3fb0da4599108c25ff52b04aa16acd1c99d526e0a326ce6f13f161f9b6f882bcff472121b8f84df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697253174, "uuid": "7e12b22f-2a83-4d6b-8db7-d894834aef2f", "value": "T1B3752315D6E4C9A3D5A42BB048F213931F32BCE58C76475B6B0A984D8A337E8D472B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697253174, "uuid": "9adab1a0-8832-4d35-b04b-bebaaca88af8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697253174, "uuid": "1c993247-1a6a-426e-9f74-e48f68157c20", "value": "49152:Y6uIEYSU/YvFpV4Zg2hZERaCO7DpnaGm/QXoi:hHup+3ERaz7DpNm4r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697253174, "uuid": "5bd9afa6-6c95-4a1b-9945-1a63ca2e0c33", "value": 1627136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697253174, "uuid": "971bed54-5ff4-47e6-9e73-4862eeafd013", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697253174, "uuid": "1d378bb1-8b06-405a-8c79-49310d0e61b2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4663ef0b-6aca-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697312749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697312749, "uuid": "27703cdc-715b-4bf2-803e-c4c7fc644b2f", "comment": "Malware payload (RedLineStealer)", "value": "e185c5dd5842c1f510b3d170ca7fbd35", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697312749, "uuid": "7b1d1504-f6de-49bb-8076-7faea6451981", "comment": "Malware payload (RedLineStealer)", "value": "5fe52859c007a52ec996e33b1910ccbc6f6bb498d6ca5747053d2174909cb38b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697312749, "uuid": "9c31d1d6-76f4-4223-81b9-7a016843ad1d", "comment": "Malware payload (RedLineStealer)", "value": "f4fc679b178e2efd58ce3cfb508a6991102eabb8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697312749, "uuid": "36b9b8ed-691a-4775-b032-0eb5e3da6e07", "comment": "Malware payload (RedLineStealer)", "value": "90c4d194bdffb6f958ad4ce4b2e57cc4ec59ededf500b9b1bc32fe908542ed1e7eaa5e9bd10186d4d44804a2d1892ceb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697312749, "uuid": "10742a8b-e2f9-4038-9099-9a2e1dfdf4c4", "value": "T125744A0CE8CBE33BC9D14F7AF101EB19276EE9611560B66B23150EB514D0886D7C7EAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697312749, "uuid": "1d29046f-a7aa-4f2e-ae25-cbd3db99b048", "value": "89b4938a013d6b8954f68c2ef1293c62", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697312749, "uuid": "e9de346c-4184-4278-876d-6d6c4215afa2", "value": "6144:gEJsICnU9Q8gq5Lrr+uUwTcKPcEhlXsYF6VDy4ghkoK+ABJ5qKEeRMfIt7KdzPoJ:gosICnoDUwTcKPcEhlcYIVDy4ukp+ABT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697312749, "uuid": "f08bd77a-b603-4ff1-8ec5-9d3cf4c48843", "value": 347648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697312749, "uuid": "fabae39b-d32f-49fa-888e-efc3bd86dcba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697312749, "uuid": "f3ffa302-6c43-47f5-b89e-3bb961c35f8c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60679afb-6a54-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1697262112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697262112, "uuid": "3d5dcd55-074e-4fb9-8e68-f70197d9c3d6", "comment": "Malware payload (Mirai)", "value": "d44ca1aee5eb89fc18938b90f109a39d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697262112, "uuid": "faff51cd-9132-4455-9f4e-193e795985c1", "comment": "Malware payload (Mirai)", "value": "61c7c75beaacf65851eb120755c57b7b6be0f7e491086d15d2b5aa1ba8d26799", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697262112, "uuid": "1fe54c93-3eb9-464e-90f9-d730ced4f793", "comment": "Malware payload (Mirai)", "value": "03b3685f892bfe8a446d4d8cc55a9034b5c363c4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697262112, "uuid": "d5ee2402-d405-44f2-9010-44acf56a75ea", "comment": "Malware payload (Mirai)", "value": "f8edb971adef20eff5574272a5d1764e42ae9fed1b3f9a085e7f21f03d2d7b416a0d9a958e104d053da5bff9f2ae61da", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697262112, "uuid": "97f9156c-b0a5-4eda-932c-a64ff5c3d344", "value": "T10B53E9627C926A2AC5E063BAF6BE518D332167B8D1DF3217CC212B057BC551F0DA7B81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697262112, "uuid": "0c283b71-a5a8-4b55-ade5-b16f1789e508", "value": "1536:omHfUXVywKHMIeVOeKSs2KlkaLFgiZu6Kjoh+tTnS:omHfUl1IFM6KEhqT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697262112, "uuid": "51c5a32d-8442-430e-8ef4-e220142a3096", "value": 62700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697262112, "uuid": "68e8f929-eee8-46e1-96ba-36d0784f4f70", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697262112, "uuid": "3360e6e5-d8e0-4e82-85f1-0ad3a894d84d", "value": "d44ca1aee5eb89fc18938b90f109a39d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0888f604-6add-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1697320805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697320805, "uuid": "48eaa250-b4a2-4f1b-a9e0-44816dfe0e12", "comment": "Malware payload", "value": "68e51c0d1c6769bb75644e8a77a1925c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697320805, "uuid": "3fad6907-5c1f-4d50-a234-373e9c706124", "comment": "Malware payload", "value": "62d36dc3d70fd337b92eda440c9662f969b892514a8b695d6ff42c4cff2ad59d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697320805, "uuid": "69fe4dba-a775-4db7-ad40-283575c2e5f2", "comment": "Malware payload", "value": "a24f0c71a45f5b1c7f6ed33c87637b09907fc822", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697320805, "uuid": "a53eeced-04a7-46c5-847a-4e356bdfc807", "comment": "Malware payload", "value": "379b0af201f7162d849cfd18dffa19bc594bc28141a6191fc478a90447dd40ad30d9a5e08d60e027cdce2a23ca4883d9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697320805, "uuid": "2cb38945-eeb3-4275-9431-d72127fc81de", "value": "T19043F12C1D4B52E7FB1B8D7516E8D3C53F730924918B94C2BA12E786CA72CADB84D5D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697320805, "uuid": "5d265e91-4001-48ce-9b53-e4f10eb1ac8b", "value": "1536:XtldyCyWd/L67wfTlvD/rhFnqiZAGd8YguVqYY:XtlkCyWBOwfTVxZBdBVqYY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697320805, "uuid": "6a94d831-bbaf-49a8-9be8-2a91104424aa", "value": 57164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697320805, "uuid": "65da06eb-8f9d-4bbf-b1f4-2a7db5803193", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697320805, "uuid": "8f20d5bf-69cc-482c-9f98-f923acaa2de5", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33e58658-6abd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1697307134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697307134, "uuid": "20f54738-8e5f-4d5b-aae4-92761e961d67", "comment": "Malware payload (Mirai)", "value": "c657850d91691818824213ee917b1caf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697307134, "uuid": "ca469a20-d326-4ec5-83d4-a9a12277c889", "comment": "Malware payload (Mirai)", "value": "6377de38fdcbbaa55d90a629d10f0966027267849e81da5e335b1a6f42166849", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697307134, "uuid": "4dba2357-8540-47b9-a8c6-3509959bc143", "comment": "Malware payload (Mirai)", "value": "024fb00056a8c7ec7cc15b8bf4818b60a842f202", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697307134, "uuid": "2c56fb80-2ebb-487b-b864-11148b6dcdd8", "comment": "Malware payload (Mirai)", "value": "9aef1fdffaaf6036b7e2173b0a692ef62ad767c10c1a20cff921f347171b4fcca5362ab4b7601a15d28141cc1be23f2c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697307134, "uuid": "c0727e02-2496-4004-b9bc-841cb75132ca", "value": "T13573C70AAF609EF7E85FDD3305E9870134CDA85762A83B3A3274C62CFA5A54745E3C94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697307134, "uuid": "b111e6de-d26c-46ed-b794-981c039100ce", "value": "1536:KoN6WJ7A7hR68pIp+gwZZEzQ0p+tMvC/D:KoD7W6yIpLwZNt/D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697307134, "uuid": "7a5c858b-2f5a-4513-80fe-bfa7cb653d59", "value": 79256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697307134, "uuid": "02efb62d-131e-43b8-b636-d404666c2bee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697307134, "uuid": "6d8fe7fa-f1ba-4ff1-8bd2-9dab1b952594", "value": "c657850d91691818824213ee917b1caf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd4bfcad-6aaa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1697299204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697299204, "uuid": "80537836-1e4a-4183-a452-5e5a01866de1", "comment": "Malware payload (Mirai)", "value": "d83aa4213855b8fdc2bed5e03195f817", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697299204, "uuid": "5375bb19-8f3b-4e56-b60b-9236689d8cce", "comment": "Malware payload (Mirai)", "value": "639c02c718f82e70075b37d5078577d5562c5cb90fa58d0b347e63a342d7d201", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697299204, "uuid": "75b2a32c-3361-4f19-8f98-50e213857abb", "comment": "Malware payload (Mirai)", "value": "37057d606dcbdcbabff0ab7142d8de4d638c530c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697299204, "uuid": "d81447f7-ea31-4608-b9c5-fb6036743ff6", "comment": "Malware payload (Mirai)", "value": "f204581d065e2e4da934f9954de60092b6ef9e51e91ddf48b8461bb09367fa94fdda8ee74d8483a58db6e0e5366f1f99", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697299204, "uuid": "561aa4d5-db6a-407e-8574-e45780e58b6b", "value": "T18ED2E0AD1300177AC96A90FD176607A43CB94F3190D3DEAA62C1FAC6ED404F47A636C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697299204, "uuid": "cc8fd45f-cfc6-4b6c-9eb0-66e976aea510", "value": "768:NyvYLznDEB2iC+sDqC6NtxsfzxPnNsGbAX4JgGlzDpbuR1Jc:IYnnDEBI+smATfDVJuq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697299204, "uuid": "9dd45b38-9e82-4561-86cc-f433b6875a62", "value": 30840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697299204, "uuid": "2116bd17-a546-4d5e-9e4b-ad78cd733a89", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697299204, "uuid": "71ff7034-40f1-4bf0-a07b-f74a6ad270b4", "value": "xd.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7839dcf7-6aa2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1697295652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697295652, "uuid": "cc785eea-9e2d-42b3-9a5e-946fbc778c74", "comment": "Malware payload (Mirai)", "value": "2225a0318e4f205d0ff40feb28f9fa14", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697295652, "uuid": "ddf6e996-db67-4822-9f83-e88b1cab07f9", "comment": "Malware payload (Mirai)", "value": "64471ce18b6095c357b18bb59ece110939c4fcd0c584e6cfc1cba0be3c7ed9d9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697295652, "uuid": "81fbe352-955c-42e6-ade2-565039a695f0", "comment": "Malware payload (Mirai)", "value": "18ac9df82b861870b01ccb6ee5db09fd280da4f0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697295652, "uuid": "4e42b222-dce6-4857-b173-d230f6f1efb2", "comment": "Malware payload (Mirai)", "value": "1da761e38aec0122a9e0e23d5b9c2a5bbfaea7b3d46f3b71726f42b170a996ced5b6eeb4a3b89aa0972d73e9a88fd803", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697295652, "uuid": "11cbb2a5-d7ad-43f7-99ff-8a781507969c", "value": "T109835C46E687F9F0DC4205B8216BFB31D937A8323220DFF7E7C4BA57A999641905326C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697295652, "uuid": "90528498-5602-4097-8755-fe77a85885fe", "value": "1536:aHHDEczfY45I6NfF4NhM4XcB3854amcQYd361SD7zY2CiB0t:IDE4YO7FccBQcED7zc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697295652, "uuid": "c1d4a444-63f8-49c0-a65c-8b3df385e4e6", "value": 82520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697295652, "uuid": "d4738d47-a068-47bd-a1cb-a82c7c9cbd85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697295652, "uuid": "732c0e1f-8396-4137-928b-ceef93520442", "value": "2225a0318e4f205d0ff40feb28f9fa14", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "448f65bb-6a6e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1697273232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697273232, "uuid": "8a3b3e9c-f61f-49a9-9576-7e8b15daddcd", "comment": "Malware payload (Amadey)", "value": "dd909f90f5770aca67bd931ec61af1d7", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697273232, "uuid": "4b1f6c19-9df1-43c7-a72d-95304d9b1169", "comment": "Malware payload (Amadey)", "value": "66ff9ca1d5173b511398385d792ff2b20a121b7efec96b64447a4bbbd4d23a9f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697273232, "uuid": "7a0aa3ff-6ccd-4258-95dc-0048a1731884", "comment": "Malware payload (Amadey)", "value": "f604aab79113a2447be6960ace3db2b5989d87b4", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697273232, "uuid": "5d0ce743-1895-4e32-84a4-9c9cab0a572b", "comment": "Malware payload (Amadey)", "value": "7c2541335163757497c906a6a79b146df36fdf38c71f262cb47e2b32f1208b37ac158d9372a742ef0cd720fed87bfd1c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697273232, "uuid": "630829f6-f410-4dec-a912-5fdca2c34f1d", "value": "T1B3752387FBC4C831E7A6A7304CF703634F397E418968836A7B06E61A4DB395861B5367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697273232, "uuid": "9a7b7c51-727e-47a3-ab21-87cbfbc7a08f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697273232, "uuid": "f99d36b0-4f69-48eb-a5a7-2c7af35c84e0", "value": "49152:yRQI0HEYz8yYLBf/PZgjhrqdai+gvFZydI3lmF:dN8bBfJcqdadg/yeU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697273232, "uuid": "d70d9c36-61a0-49bf-b528-d151949d7c6b", "value": 1625088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697273232, "uuid": "2405caf7-943e-4159-9672-6f6656334c2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697273232, "uuid": "93424778-0b12-4887-a896-cf70b6dd189c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f2c04a0-6a39-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1697250594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697250594, "uuid": "48024713-048d-4742-8c1a-29fde153f67c", "comment": "Malware payload (Mirai)", "value": "1ae26d4273ba1b7645b3ea5a3174e60c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697250594, "uuid": "3f91ecc3-ba01-45ad-832f-889ed81435de", "comment": "Malware payload (Mirai)", "value": "674b7b0065541f6ad19e8f7548a3bc262977161d6a0f336765453d733e9337dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697250594, "uuid": "bb1c59f4-c909-4f68-be6e-d66dbbcd8cb1", "comment": "Malware payload (Mirai)", "value": "e0689e490ab94ecf0d61778980ea7614fbd76657", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697250594, "uuid": "a09078a5-f3d1-4df2-baa8-fcb4d288202b", "comment": "Malware payload (Mirai)", "value": "e5abcdc8cf5602b83f8d7ffa487af9f5071c44eeee58271ce5cd7fe5b10ba11b88136d8423560d6628de0a6d4db8e1ce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697250594, "uuid": "bb12c14a-45d4-4782-aa99-2817eac3ce0e", "value": "T1A3D2E1DA4A16127EFD7ED8F6C9D663E11D640A82F0A28CD73457E952CD80974B813AE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697250594, "uuid": "65aa6e6c-7911-4a7c-b528-3be80ebaacc6", "value": "768:5FqhCAkWQ04Blne1p1FZQwnm+l8RFBHZJgGlzDpbuR1J9:5shzk/rUdQwnm+l83BHLVJuP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697250594, "uuid": "dfbe26c0-2c82-4477-b397-3514d575b90a", "value": 29436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697250594, "uuid": "e05eebb6-0648-4962-8068-328410b45861", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697250594, "uuid": "c944c18f-748d-49aa-9165-33818f130061", "value": "SecuriteInfo.com.Linux.Siggen.9999.26459.25409", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "524d8da5-6a2b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1697244479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697244479, "uuid": "3b984639-9164-41d9-8f8e-a8343e4addeb", "comment": "Malware payload (Mirai)", "value": "d24640520ebab38ec499d68dec4fb2ca", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697244479, "uuid": "ef54437a-fdd9-42a1-a78a-7ac572c23b36", "comment": "Malware payload (Mirai)", "value": "67749b8abfd9a6d3ebd022e9108d8f85568c903623287aaafbc3c8b6c037767a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697244479, "uuid": "cd62ef44-fcc1-4a38-838d-9cc2b814647a", "comment": "Malware payload (Mirai)", "value": "8e26d50febdedfbb1c274d29713eea5f9cdb02d4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697244479, "uuid": "4e005ed3-c9a1-41aa-8b04-cfb3acaf3aae", "comment": "Malware payload (Mirai)", "value": "79ff84313d6728850be3c0c26a3f752734ecfadece5f5fcbb97dd7985e4d2c56ea0ba967fcc4c90566887b71361ee481", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697244479, "uuid": "7732ac45-8f44-4543-a0b6-7989716a83c0", "value": "T141C2D0F9F18447F5CA6A857A8C0D81C2EFB24F375B9BCD401443E3012A7785F2598AB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697244479, "uuid": "152485fb-76b0-4535-9009-c0e2057a8297", "value": "768:GTGnf0XlOr6efGDVscY0S+fpVTC04uVcqgw09L:70gLfGyrb+fpw04u+qgw09L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697244479, "uuid": "8f7301a4-be85-497e-99ed-0458cb0d2f54", "value": 26672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697244479, "uuid": "f0de1fb8-9d2e-4953-9307-db0d8f2fd59e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697244479, "uuid": "ce6ddfa3-bd44-4908-9eba-53102bdb304e", "value": "d24640520ebab38ec499d68dec4fb2ca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72857bb6-6aba-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1697305951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697305951, "uuid": "8abf5574-3ab4-4fb1-a77b-2adba9539bc4", "comment": "Malware payload", "value": "db52b552bb6ced60c6fb091d42292289", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697305951, "uuid": "a9f51eb6-f0a2-41db-aa29-54460c732c15", "comment": "Malware payload", "value": "6791de0b9f3c9f408a013c9abe6006ca7e05256961d6ba6419dd25583cec594a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697305951, "uuid": "f8b257c8-dc12-4724-9b66-dc0ee20b5864", "comment": "Malware payload", "value": "f3f3d2028700731426608d844f73729594522c9a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697305951, "uuid": "8bc92044-11af-4c8e-9fa5-7fb0bdffdafe", "comment": "Malware payload", "value": "ee90cdd0bb7ab1627720754389b93f355f458684c7a56138907673934e95936275cdf3deabb217efc68b466575329930", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697305951, "uuid": "6eb23998-9dea-496e-a842-a1354c1351b4", "value": "T14E019E56CC00C48E533056BBBD62B03DC98AF41DDEE1EC64F5EB14B60CD4B664876916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697305951, "uuid": "5478bc24-3003-42cf-ba54-3aae81e5d9f9", "value": "12:qTE0sF56ME26VBVaGuaXiMIg3DZ0lDfiCnVe1NCTG7faKj2a:0E0sr6FRrVaGaMr3DGmUVqNCC75j2a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697305951, "uuid": "aa6f740e-80c7-4cf0-a051-06791fa2641e", "value": 675, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697305951, "uuid": "3f28d175-7667-495e-9af1-80e1e610666d", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697305951, "uuid": "67b01708-54c9-493d-a9ac-4afcb1ac75fc", "value": "NATO.sys", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93234682-6a51-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697260908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697260908, "uuid": "8cdb59bb-2520-4cf4-8092-28d206ac4d23", "comment": "Malware payload (RedLineStealer)", "value": "314a76e1919ae95f9b5d383957420280", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697260908, "uuid": "6c3f967b-ede5-4f09-bc6a-03870904495f", "comment": "Malware payload (RedLineStealer)", "value": "6872b2aa64a3ac330c7a065f53de1e4899eb1a6d6ee2607a297b0100295b6bcd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697260908, "uuid": "9d6eea48-449c-41b7-948b-0fdfd4f572fc", "comment": "Malware payload (RedLineStealer)", "value": "0f5a1f8286af45ef25b855381f4be0057739a004", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697260908, "uuid": "30c7e02c-b746-42b1-8be7-383a820d53b2", "comment": "Malware payload (RedLineStealer)", "value": "18cb17705e76e2a8d642aa4b2dfa254854ab514407fe6e19ea0c58fcc228858684a012e6242c4ebbe0138f18e10955f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697260908, "uuid": "e7f86b04-413b-440d-a637-f960def21d76", "value": "T1607523A2EBD48973DAA05B7508FB06631F33FC658DB84B7E69065A185CF3244E1B131A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697260908, "uuid": "0d998e2b-a911-4304-8df0-1bef60fb873c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697260908, "uuid": "03616afc-c9ae-4399-b8cd-1cccd14e6db0", "value": "49152:opGQUJIjI1dktjKNuIXeuhgZgMhbGra/RaBT82K2VHsZF:yGEALXeu2vGrake2VHgF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697260908, "uuid": "026188cf-e878-4a7b-a848-edba09952860", "value": 1625088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697260908, "uuid": "c046e453-f73e-4738-911a-324f486f216c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697260908, "uuid": "79636b9d-a255-40ee-b21c-67c6399ec200", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd3fb77e-6aaa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1697299204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697299204, "uuid": "760b5e84-71af-4a41-b94a-a43847823ddb", "comment": "Malware payload (Mirai)", "value": "f828e7ce47f855f5b427b66826bb30c5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697299204, "uuid": "d5912359-f703-4996-acbb-5bb0d82fb485", "comment": "Malware payload (Mirai)", "value": "6b48e477108225c0a2541613de56f791524a08427239055e13742519cc691c29", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697299204, "uuid": "2b62b63e-3996-4bea-9f27-9f4d6712378b", "comment": "Malware payload (Mirai)", "value": "714ed84ec89ee8fb322fb95245192c6608cdfcf8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697299204, "uuid": "8c62d0ef-b221-4952-a48e-2ef237410373", "comment": "Malware payload (Mirai)", "value": "886f774ea6b8bf3580867c5a0eb8055a99ed1f38f7dc1161523d52da84dd373706baf545cd7ef17888d5599164806a56", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697299204, "uuid": "cd226633-0fc8-4e33-bc32-c657226ec5bc", "value": "T1C733F155B0047425CA303637FC2611D3BF4A17FAC6D23437066943E4A8EA4A37AF6CE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697299204, "uuid": "6e399049-164b-4040-916e-fd4884ae237c", "value": "768:wMte5B4PACtw/YcmRIe18D9q63TxZQbSORe7Su2QJnKE79TLryPA9q3UELbOs8q8:wM84ISRX63dZQbS5rzZELIVmWjd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697299204, "uuid": "ab584cfc-1332-42da-83ea-2acb694b32bb", "value": 53620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697299204, "uuid": "bd5177ae-4070-44ea-99a8-9f95174258e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697299204, "uuid": "ab01e0ee-f45e-4efa-a4c6-a0c3e211ebf4", "value": "xd.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a97f33d1-6a37-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AsyncRAT)", "timestamp": 1697249779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697249779, "uuid": "e899bc1d-680b-4218-8896-f73754cbf7cc", "comment": "Malware payload (AsyncRAT)", "value": "70404d4fc57d9f7c83f4975a06fe7594", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697249779, "uuid": "9c430848-23e2-42a7-81da-ce3ac619c92e", "comment": "Malware payload (AsyncRAT)", "value": "6bd3a9be98f3e06d4cefbc574149bd6f80e1bd96b6ac7131349313c2c9c19fae", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697249779, "uuid": "7455e4a4-a53d-4569-9850-ee4f289f4a3d", "comment": "Malware payload (AsyncRAT)", "value": "34ac8cca7d00653f6cdaa95b759c92d79593c467", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697249779, "uuid": "f8f0cf1e-3ba0-4bde-af7d-c694e3f07888", "comment": "Malware payload (AsyncRAT)", "value": "6e24899395785b88dd333b2f60f7f974c53ca2cbafb8a85db6f45b3f4977c3473ebf28744fbaefeffcaf95969edf5b2a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697249779, "uuid": "4b8d93e1-2520-4fb8-9e75-4d6a972b5926", "value": "T1FE6308053BF9802AF3BE8F7469F6658446F9F4AF2912D55D1CC910CE0632B829941FBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697249779, "uuid": "1d689dec-0169-4fa5-afc1-589b0f9de374", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697249779, "uuid": "b369c815-b466-4d78-b62d-ccf96bdfca48", "value": "1536:/2wukvF1ak9gcKu5UYFPeD28xex45bv9i6ZVe+1SrPlTGhx:/2dkvF1ak9Ku5UYFPeD28wx6bv9dH1Su", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697249779, "uuid": "8c670d41-040c-4492-9405-ea95b36d5ba3", "value": 67584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697249779, "uuid": "ad6f34e9-7a8b-4e28-a077-6788a89f3533", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697249779, "uuid": "3392867a-08ea-4d02-a0e0-15aec38b538e", "value": "Stub.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70e863f7-6a6b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697272018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697272018, "uuid": "aa0ce454-9e9f-44bf-a497-24136b5e7911", "comment": "Malware payload (RedLineStealer)", "value": "4050f5f3840b5ec7442dc59797de9c69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697272018, "uuid": "4e40da36-2bc5-491b-b032-e2709035a9ec", "comment": "Malware payload (RedLineStealer)", "value": "6d5a44654a3a29dca2e70806e50074cd92437e69b2fe7e28ea710727b6c0baa7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697272018, "uuid": "f01cddac-582a-4f20-b166-32db8493c22b", "comment": "Malware payload (RedLineStealer)", "value": "773e8078ef47a9a2ff13af0c9914f8d2c8b03a9d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697272018, "uuid": "00817c3e-116e-4d36-b4f9-78ecae24e106", "comment": "Malware payload (RedLineStealer)", "value": "f82ce37eada5555f16af564aa3e8cbdcf38b267dd5db20603ecd47e8fb7fe8efcc052f3bf69b88447a54c04051630937", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697272018, "uuid": "688a9997-6030-48e8-a174-b5a0618f139e", "value": "T14B752301EBD58872E5A46B3188FE02530F397ED299B483BB5B00F8550D73A90A67677F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697272018, "uuid": "99d2f32c-c834-439c-b750-ada07c8cede9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697272018, "uuid": "9595a6ed-83e3-4ea6-ad3f-eb2fa4749eb5", "value": "49152:Os/uU1Q/fLnE5YNZg7hVshaK0MICb+10qQ/j66VDL+5:iUirE54GshaCbD6IS5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697272018, "uuid": "31034abf-19d1-4cfc-9765-9edd278f60fb", "value": 1625088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697272018, "uuid": "1608e5fe-635a-4081-a6ee-f2b4c1abc504", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697272018, "uuid": "df42f44f-6022-474a-b622-1831dd07e986", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92e81de4-6ae8-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697325762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697325762, "uuid": "25f3155f-4162-4bb8-956f-3252e4543e66", "comment": "Malware payload", "value": "29ce1ca0a639c5500e693451cfafcc56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697325762, "uuid": "28e93bdc-8ba1-4cb5-b4cc-2bbd386cba7a", "comment": "Malware payload", "value": "6fbe5dbf861f1d8462e335e010d3a5cb165234f7b6f675cc0a5a54c763535848", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697325762, "uuid": "e4989192-f181-4641-8c6d-09d9d520b4af", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697325762, "uuid": "20fc4080-c920-476f-a08c-39378d9467b9", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697325762, "uuid": "d35cf56e-8f22-42d2-9f20-d32d3c623e3b", "value": 899072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697325762, "uuid": "34b93548-d7c6-4b73-98b6-44d2f79dcb13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697325762, "uuid": "d9b82cc7-2002-435d-bd4f-7b32bba20d5f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8539c05-6a7a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CoinMiner)", "timestamp": 1697278634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697278634, "uuid": "eabda62f-b1c7-40b1-9ee2-1e92b8cecb51", "comment": "Malware payload (CoinMiner)", "value": "df280925e135481b26e921dd1221e359", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697278634, "uuid": "16978590-54bc-4291-9f55-bef5dcaf4ca9", "comment": "Malware payload (CoinMiner)", "value": "710a3e1beda67e1c543ba04423bfb0ba643815582310c0b3d03d03e071c894b8", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697278634, "uuid": "69f8d6b7-07e3-49cc-926c-b9099fe6593b", "comment": "Malware payload (CoinMiner)", "value": "877737c142fdcc03c33e20d4f17c48a741373c9e", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697278634, "uuid": "70d40d5d-fc7c-4b83-9475-5867556f1610", "comment": "Malware payload (CoinMiner)", "value": "46ee8065af3f0f2e45b937aecfb52d348189ebe830c8c970035bb5b6f6303fd4046ffd8e66fdd1581e513c3ae53774d1", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697278634, "uuid": "116bc751-548a-479e-873a-150c2a6264d1", "value": "T1AD46E1421A7AB6DBC1A39D38DAD32E4C307555B80A595BAE3480CCDB562CBD064C3BFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697278634, "uuid": "f6949105-6ab2-489a-a28b-552d80011fc6", "value": "cfc2f6e0ad47e701959f21a8d2a686e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697278634, "uuid": "3218f4af-7440-4b92-8193-aee6b4fdfecc", "value": "98304:Po/+yDDRT0Vzalb9K8K+ZR+wc6cw5FTEsDNJZe6w43eK:A/+yHxlb9K8K+rYq9NJZeD43eK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697278634, "uuid": "1915815b-4bea-46e9-aac9-385eb8b9d57d", "value": 5494552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697278634, "uuid": "ea26f1af-2ebd-4a0c-8526-b6cdbf50e005", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697278634, "uuid": "7cd5b23f-6d30-424c-8c79-b365e95629ff", "value": "df280925e135481b26e921dd1221e359", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62d99def-6aa0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697294758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697294758, "uuid": "b9b36b10-e1fc-426f-a144-7fe899ec82b2", "comment": "Malware payload (RedLineStealer)", "value": "cf2430a9d39d79ce1241009783fd7a6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697294758, "uuid": "9f7a8531-78b4-4952-8ea8-02a8af483ba9", "comment": "Malware payload (RedLineStealer)", "value": "715fc5bc735ea20bc439af30c2fa0072ac9f900b747c3911abf953db81ca09ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697294758, "uuid": "f13d1ff5-917f-4ef0-886a-835aa0edadfd", "comment": "Malware payload (RedLineStealer)", "value": "ac97350ad1089248ba476fdcd781b7ab6bd6ef1c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697294758, "uuid": "32e2a7b6-8ecd-4378-8348-c61573c6e5a5", "comment": "Malware payload (RedLineStealer)", "value": "5c4848837b1e033f959dc45ff94edb111eddbcb3f255a31b95e618ebc4a2bd674aa70cbb87cf2c174b10a5660e59fd38", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697294758, "uuid": "a0ff7db6-875e-4853-8efb-3f68b2ad8911", "value": "T18E252343EBDA80B2E4B01B741CFE13431F773DA26EB8418F579E989998B3180757A356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697294758, "uuid": "8d1982ba-d39a-4136-963a-77f6d2b77667", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697294758, "uuid": "9b258276-31b0-4b09-9669-8744ad86da71", "value": "24576:8yImVBIvtduAirZGZNg7e0mNUXKHgOnAtd2VA9M7kykGsMN+R:rI66vdisN6ftkgkAj2VAHGj8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697294758, "uuid": "68421caf-04b4-4a88-9a6a-1ce1a318c6b5", "value": 1006080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697294758, "uuid": "052ca216-63ec-4406-af85-5c1f0fd3eff1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697294758, "uuid": "2eb7f7f8-c8f6-438e-b2f0-909120782eb3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2232d3b-6a68-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1697270812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697270812, "uuid": "03569d2b-220e-4958-bb45-e8c6e6ec1783", "comment": "Malware payload (Mirai)", "value": "b90b32a7fed98457013cc874474a7582", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697270812, "uuid": "3ba577a4-a92f-48dc-a54c-612f06286421", "comment": "Malware payload (Mirai)", "value": "71d3ead7195dfd875ecbb29ab66aa75b0633a0e55a875b7cf3fe664e710deb86", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697270812, "uuid": "5718060e-3eeb-43db-9397-d552af55ed06", "comment": "Malware payload (Mirai)", "value": "a3b2b6cdbf5263f01a3c2bd1f07edd5a610d53fc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697270812, "uuid": "96309691-c5a1-4a7d-b299-d158e679d2ab", "comment": "Malware payload (Mirai)", "value": "aaa70471eee395da036d4e161e0f2d2ad87b2eb2e708aa93ce314f89af3661410bb125ec93d7fe2d51fe0284ec9a43f6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697270812, "uuid": "d07d3bc2-904f-4edc-98cd-22516d80a097", "value": "T199E33A06730C0E47D1672EB03A3F57E0A3EFAA8121E4F644255FAB9A9271E371485EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697270812, "uuid": "e8886c05-5d3f-494c-b408-f8fff9ce5b2a", "value": "1536:nq/zrulkJXIVxkET/ChMGkid3xE84RBmshBDkmOlevAZhnpyV+EhLlqPNSc/wbZS:eIAET/CVP3xIhBAmiZIjc/wbZnSV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697270812, "uuid": "0a8f45c3-6d13-4fb2-8dad-e34e189b8912", "value": 156252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697270812, "uuid": "a85e0052-01ef-4544-b115-35953bdb0a57", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697270812, "uuid": "67bcc894-f9cb-49d5-b372-1eee39d74fcf", "value": "b90b32a7fed98457013cc874474a7582", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "556b8ad0-6a2b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1697244484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697244484, "uuid": "9804a862-230b-4c11-a810-a582dbf58069", "comment": "Malware payload (Mirai)", "value": "a07f4bce440fed3c8215141ad34afa87", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697244484, "uuid": "c899b78c-dddb-47fc-8e3c-b9b27e8cc199", "comment": "Malware payload (Mirai)", "value": "7513063e9a335b628385a1355b26e4a657bedd331876f2482472cd461ce0c2ac", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697244484, "uuid": "7159524c-bd4f-4462-9ab6-92b4a05081f9", "comment": "Malware payload (Mirai)", "value": "a032ffd67502564690fe0bb8bd46a416cc6a8ce2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697244484, "uuid": "976c2f5e-1312-4973-ae40-96f8c1aee854", "comment": "Malware payload (Mirai)", "value": "a6c5e94f67b929790bda10de6f01b43da188d2f6b42ff2aa6b1a149c3450a5bd82c0cd42d38f3c508e943e142e053b54", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697244484, "uuid": "bc993a6c-7139-4a48-8f33-0f804d928c1d", "value": "T102B2E070489A2270C1F15D3CE5BCC2CB729A0AF892F5A4575738D229E9C9243A73F6CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697244484, "uuid": "d9e34139-5000-4865-a616-7a2612dd8049", "value": "384:X8iENsUjQDTsg/LEChdZz6lu1rJi/mq2Xgf88MkQRoSpKjZu4JEhymdGUop5hXa:X8lQDYgYubza6YuFDkQRoyyxJEs3UozU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697244484, "uuid": "6a35fc7c-03d4-4a85-a27f-93a0bb838e52", "value": 24220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697244484, "uuid": "163c7d1a-33ae-4641-9e16-a9e61d1f052d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697244484, "uuid": "f1c0eaaf-dd01-497e-99d1-0c94de8b0e2a", "value": "a07f4bce440fed3c8215141ad34afa87", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7302f229-6aaf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (TeamBot)", "timestamp": 1697301227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697301227, "uuid": "ed4b1aca-67ba-41f9-b162-a5b350cd772a", "comment": "Malware payload (TeamBot)", "value": "6ea06d3e97986c035c377223cefe0fb1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697301227, "uuid": "477e9a60-c0ff-4a87-936c-21c47032ae9e", "comment": "Malware payload (TeamBot)", "value": "76ab9dacb5fbbce3d4021b4d46622d96d0599af96440989a61c8fe555a3cac33", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697301227, "uuid": "c681368b-b6fc-4db3-92d0-68291d11a327", "comment": "Malware payload (TeamBot)", "value": "6ac00da44291aed5832338b2d1792567a7d12924", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697301227, "uuid": "e5f15490-fa31-46ba-b359-f46946381016", "comment": "Malware payload (TeamBot)", "value": "9e1d08f847d8de9d3893e7a984d2af25befe149befb72cae8b499d4282ca79d3b854f4ec1d1d1dc55c09edf20ac712ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697301227, "uuid": "3b748e24-a42a-429c-a5c5-5b44cb1e74b7", "value": "T168345A5352E0FC62D81647738F1EEAFCB71DB561EF486B1622189E2F19B12B2D263314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697301227, "uuid": "a32c8ccc-5a28-4d67-831b-1876948b6321", "value": "f521864df4943f912ba65d6169a61f62", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697301227, "uuid": "f4414dba-337f-41a0-a4c0-96552a260f99", "value": "3072:LxBU2lzBjWBuBz10fW2VEiJ9hvC+1Qd26d8kGrf3IT5bAtSDoqRu:PU2NBSBuBzyvrvP1Q4E8kYY5AtSDP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697301227, "uuid": "9904e8ee-566f-49af-bf7e-8c14a85def30", "value": 246272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697301227, "uuid": "67587393-cd3e-49b2-aada-e79d4e5fa473", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697301227, "uuid": "683d1ed1-1df6-4338-a710-2ecb3fc046c3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9150e5ef-6a68-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1697270784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697270784, "uuid": "e73cfea3-0e02-4a54-8ebb-f5653fc85ced", "comment": "Malware payload (Gafgyt)", "value": "9257ca50ba4493b1fc370a16002980f0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697270784, "uuid": "977a9a5e-99bf-4af3-8cc8-3fc2c32d3819", "comment": "Malware payload (Gafgyt)", "value": "76bdfe5e5b1a195f440fd90ca0aa6d5b901b0b25089ac4c8cc1c61f17da9af78", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697270784, "uuid": "6e2e3cc3-f966-4bd4-afaf-ea87ccadb24b", "comment": "Malware payload (Gafgyt)", "value": "ba036b36b14ea1a230db930e868049050bea30ee", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697270784, "uuid": "3010fd7e-af5a-4378-ac8c-76d86ca4d35e", "comment": "Malware payload (Gafgyt)", "value": "0098133da5824640ef5ae50991d429b035285ca2f874d1ceb394e0516d2b6f919b147da5e57a1c44d970688301cf64e5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697270784, "uuid": "5d338605-5950-4fe1-a412-258069840f59", "value": "T10FB3AD62E4062D64C252417061F98EB43727A9C4C1971DF672B2C6BEC047DABF63CBB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697270784, "uuid": "ed9db8c6-ecf8-47c1-b0de-6b173a0665b5", "value": "3072:JEPMUFXQoAXIbNb8lUZv9/U8AvtwbZnN:JEZXQoAXIn928AlwRN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697270784, "uuid": "57fcb426-d7a6-4b73-b0cd-f853aff59dcf", "value": 112356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697270784, "uuid": "e40b22b3-0db5-4523-8544-7ca57298ca5d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697270784, "uuid": "305da1a7-642e-42c8-b1ba-536575dc7ab4", "value": "9257ca50ba4493b1fc370a16002980f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5e605be-6a5b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697265262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697265262, "uuid": "55b9c351-8221-4088-b170-de5e424f9c59", "comment": "Malware payload (RedLineStealer)", "value": "2ccf6b23f11851c28e8bd668eb85034d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697265262, "uuid": "4b40d92e-8c85-468e-803c-30c8c4910512", "comment": "Malware payload (RedLineStealer)", "value": "78857eef6bcca50d92448f6f41226e9ef59c5c7ab60e1b42b8c5fa4446e73db6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697265262, "uuid": "7fd86e49-9d4e-4b3f-9e6f-5ff565381579", "comment": "Malware payload (RedLineStealer)", "value": "5f7b4f019e1402cc787bb6399c054e179bed8c4f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697265262, "uuid": "93f38f56-3536-48f7-94c6-697101dae86e", "comment": "Malware payload (RedLineStealer)", "value": "cb17e1f1997f3bf3bb09878340f6a67d582cab485ffc79755f06731663ef3e8dfb876709e72e967fa6ffe3b7239ec3aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697265262, "uuid": "3d2e7028-025b-417c-9768-ae57b868901e", "value": "T1A7753322D7C48463E1B15B7058FF63630F367AB16A2842165F42BA1E4E33698E17377B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697265262, "uuid": "c8b05d35-c1a8-4e54-b8eb-e3a680001190", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697265262, "uuid": "653605e8-2ce8-4896-b719-0c410aff8f23", "value": "49152:smWXRlTb5qTh5uQ6yxCZgChr0SVNzRTamB+tjq6dlCjv:4/gT6yYj0oXtsFJl0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697265262, "uuid": "7bf73778-82b5-45c3-b5f3-cdac04215ca7", "value": 1624576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697265262, "uuid": "b1787418-67f2-4e80-91d9-4e7ff9fae8ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697265262, "uuid": "d3afb915-90a7-4c21-94ac-f0ebd83a2c24", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19013965-6ab2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697302365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697302365, "uuid": "8569ea46-7169-40f6-9f38-1e3e86811392", "comment": "Malware payload (RedLineStealer)", "value": "3c6dfeb91fe9ba36037da83bff7bb12f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697302365, "uuid": "d69b38aa-40dc-442d-8d7d-af536d7ee478", "comment": "Malware payload (RedLineStealer)", "value": "7941e3ad78b3fee9fcf4f17f43845c5ad33a1803b41576832c85327386416e05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697302365, "uuid": "0a3a3e9b-1b9f-439e-95d0-6cfd1e898418", "comment": "Malware payload (RedLineStealer)", "value": "6194931caded26128418a5cfeaafd61d00bf7384", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697302365, "uuid": "5daac66d-9208-4dec-afb8-df118895a826", "comment": "Malware payload (RedLineStealer)", "value": "a75bc4cbc313b3970d23e2545c0c634fb72455a1b85a8d0cf767b1a111398d453d71e23e6fba3f46c361ab076e24a45b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697302365, "uuid": "9b3dd31e-992d-454e-a939-71431ac96fef", "value": "T1B8152347BBDC4862E9EA173028F753E31E35BC605CB4A3663744488E18F2AD0A67577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697302365, "uuid": "b7ded4f1-729c-485f-b45a-7a79916cbcf8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697302365, "uuid": "7532aaf7-53e6-48c4-83d6-d0b05e517ae2", "value": "12288:TMrTy90xFA1FFN6G06DnCYdYkNjwyFlcQRpyYu66mooPBlZHRZcboMJkX1MXKaNg:wy8ufWMYk5Fl3pyjGPBzRm8x1rzVJ6A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697302365, "uuid": "6e752707-ee84-4442-8658-e1587deb9ae3", "value": 900096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697302365, "uuid": "da43775b-9672-4a22-afba-484dcf2b7428", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697302365, "uuid": "9559fddd-efa9-4c45-9edd-05f9065aecf1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b13893e0-6a68-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1697270837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697270837, "uuid": "9f6e9156-8a45-4796-b43d-ec78030ef0c3", "comment": "Malware payload (Mirai)", "value": "5e73637404c055f6320e9bd8b3d7ea24", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697270837, "uuid": "32931220-cb11-42af-8f94-c1997f22a763", "comment": "Malware payload (Mirai)", "value": "7975f889ab108b2b4b40fc596f84fddfe89109d427856babd1ef195a1f8bcfc9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697270837, "uuid": "85d2cf35-98c5-43e9-b502-96cb82d26631", "comment": "Malware payload (Mirai)", "value": "8b72cb86b5bb1ea39d31d3a513a0176c807fb0ca", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697270837, "uuid": "178d5db7-1eb4-4e3b-bf61-9ea07e2f97da", "comment": "Malware payload (Mirai)", "value": "67b5a1e4c1a626d8bb8e34a91a3c0c4f1fc2ab7101a70aad1965c9dee454fd83d975e4d0a64208fcb1ebcb1d2981a55f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697270837, "uuid": "2d89ec0b-4f50-48ca-b49c-08e26d3c89a3", "value": "T165E31945B8415E23C6D712BBFB5E428D372A17E8D3EE72078D216F21378A85B0E77642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697270837, "uuid": "ecf48c96-9132-4bcc-ab57-25f68fa619d6", "value": "3072:eq3ulpk9tBBMZ4tITJKXL1xQbfgi5qswbZnNw:eqWAXSZ4tOJKXv64i5DwRN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697270837, "uuid": "e1d73ce8-6beb-4898-b9ce-0de97cc64106", "value": 155872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697270837, "uuid": "a8125b56-f1b0-4d00-b8aa-b04fc92b470e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697270837, "uuid": "f9e7bf7c-0274-4f2b-97c5-7a31505cd752", "value": "5e73637404c055f6320e9bd8b3d7ea24", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81d23219-6abc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697306835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697306835, "uuid": "6d7705c1-80b9-46cd-9b58-416f99fe238d", "comment": "Malware payload (RedLineStealer)", "value": "e58ca095a56f58c380d9331e2310d1f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697306835, "uuid": "23ce3ff4-8b22-4423-a5a0-0188b37be1f9", "comment": "Malware payload (RedLineStealer)", "value": "7a5123e6567a7d3389544141839d60714b49e078037c683fdd3a8f8211bff9ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697306835, "uuid": "7144481d-0b61-4b07-b2a6-6a11a98a7c6f", "comment": "Malware payload (RedLineStealer)", "value": "a5796072a9f788195e0fbc849c60366ca5e6e37f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697306835, "uuid": "c135be69-38ff-4b4d-917f-3b80ec757799", "comment": "Malware payload (RedLineStealer)", "value": "b0d798e3a1a51956a2cf9200805f8b6e3eb51ab22ba1380def7a626d116e6dc0739ff37e9f514b75d4d9337e026b91e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697306835, "uuid": "14a0400b-eff1-4b7a-827a-c83faa73c490", "value": "T164152307F6ED01B2DDB11BB018F703932B39BDA15DB847AB2A01554E0973BA4687637B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697306835, "uuid": "38d6011e-a35e-4bba-954a-87feb7dae5b0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697306835, "uuid": "fe88c5c3-0465-4730-82f7-55c5745f83a0", "value": "24576:0yZ0QcCRwmoHKxdwT+ZnykJbJd4C/OOeIOO9:DZ0QczNHKxs+9ykEIOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697306835, "uuid": "5be30c20-18df-43fc-9267-3c854f5d45ae", "value": 898048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697306835, "uuid": "c0ec2995-7033-4354-ac8f-a60ca050b2e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697306835, "uuid": "d0ad3203-1441-4228-a9d1-be36c0b4f285", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8efbda7d-6a9b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1697292684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697292684, "uuid": "343b6d4e-b54e-49c4-8633-4b5b475a9e16", "comment": "Malware payload (Amadey)", "value": "61246a20e44537341e796cc63da4c607", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697292684, "uuid": "47fbf851-aa70-444b-a11e-cadbd3bb8796", "comment": "Malware payload (Amadey)", "value": "7abc2b85b35d89e7f09362709e4bb1cf79a3b9c787851a8950743dd726eac84a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697292684, "uuid": "0bc5a25c-5f72-4f43-ab90-404aebef96fc", "comment": "Malware payload (Amadey)", "value": "a5d2303b0008d55bee5daddf4b5f919755d26a66", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697292684, "uuid": "b58633bf-8edc-4f3e-8672-2e24a0c75e3a", "comment": "Malware payload (Amadey)", "value": "83963a58896166e98085cc0642e6c8a25b6ff903d4da41068b2ab2479a1c10f14d2468b377d114f70ea703e825841904", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697292684, "uuid": "f6e98186-86b5-48fe-b28d-526917efb797", "value": "T1595523A2BEC819B1D4B0277455F706D30F35BDB24A74539B67426A0A09B35E0B73A33B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697292684, "uuid": "b2357b51-ed6c-402f-ba99-54489a17a952", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697292684, "uuid": "00a71899-9418-499f-8bc0-c8a84318c57c", "value": "24576:pygAWzWOC3D7y3qFzwRv3QBFUYD3W3gzDYTimZxc5IJaEl3v7KGq:czWzqvy392UF3oui8c5Wv7KG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697292684, "uuid": "8a405e44-d993-408e-97d3-0aa6a0faa814", "value": 1352192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697292684, "uuid": "1fd8d2b7-9426-4e37-828c-0ffff6812404", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697292684, "uuid": "a7ff624e-ddd0-465d-9e6f-ee6dbfff3e58", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e8dd7df-6a68-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1697270806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697270806, "uuid": "3a943f0e-f919-4f96-9786-f9004b2dd598", "comment": "Malware payload (Mirai)", "value": "ed8ebd029ccba85b88354fa65275f69f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697270806, "uuid": "36eb60d8-a21f-48a0-9259-7f2440e29e2c", "comment": "Malware payload (Mirai)", "value": "7c50c2b1e948e6fd76ebb0e8493931373aa3fa61c5e1d78514ae1ac4922c5861", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697270806, "uuid": "7a0c4b5b-7e58-4786-86cb-b83af947715c", "comment": "Malware payload (Mirai)", "value": "7db546399e7dee1faf89ef00bebcff96f4ed5957", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697270806, "uuid": "4ce7bde2-91c5-4169-b54c-8269fdabd4dd", "comment": "Malware payload (Mirai)", "value": "b271f324b699289583add9a46959306e548a547fdb8e41eed02a1c1b789cbb5735e0abd7968352ab0b819f6af45357fc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697270806, "uuid": "1a26fae3-974a-45ea-8c3c-d82e3e0a5865", "value": "T16EF339CBF800DDBDF80BE33B44530819B170B7D224925B376297796BEC3A1991967E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697270806, "uuid": "a8ea19a8-aaa0-461e-90e3-422666d306ba", "value": "3072:6LqIhIroPLuHifTOgJKDt3zIB4J7vBcwZvjaYVKjbiELKqc4y5mVmDUfeTBnbw:yTuH9hDIB4J7JcCjaLL1y5RDseJbw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697270806, "uuid": "30a2edbe-9223-499e-b553-d28ddb557123", "value": 171712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697270806, "uuid": "7740db88-1d0a-4c71-9b9d-d4288c506ab2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697270806, "uuid": "5d20f7b3-d6df-46df-ab2b-418d6989173c", "value": "ed8ebd029ccba85b88354fa65275f69f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63dac2ce-6ada-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1697319670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697319670, "uuid": "e012ed66-8c4f-40a3-ad1e-4949d1f69729", "comment": "Malware payload", "value": "39d62f3b573b4da42041ce2d1f5a59a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697319670, "uuid": "f28df7fd-d27f-4aa1-b4a5-1d804d231c37", "comment": "Malware payload", "value": "7dde509f3fc326c337e247005264c2a2eb768b1832207b8a64577a10677168a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697319670, "uuid": "d8b8322f-f279-4345-9f45-42cea3fdac79", "comment": "Malware payload", "value": "5df9874a704e943573f8f0cc4c2993d0e1c2d99a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697319670, "uuid": "a1b213b9-7040-4a93-bd2a-3ad665790ad5", "comment": "Malware payload", "value": "5ca4ca7e1d204b77c4de9e1c7d640869cb8291b4ef4adf3427bb00909b4611652c048dead61e81652fa3f8d4d00adca5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697319670, "uuid": "55bbc1ff-5f23-45b9-8e76-9deb2c2b87f2", "value": "T1771523029BE495B3D9B063B058F702C30A39BCB29D38532B37915CAE4E725D5A53772B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697319670, "uuid": "b76e282b-6808-45c2-ac46-e4945b24edd3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697319670, "uuid": "df340d81-6898-4855-b8d8-4cd6ddd074ed", "value": "12288:GMr7y90Raz//Qbr1clDgdFVKluiaALqXlZRfWRFEKJvR04QxsEkPoVKHKdpjktgg:9yea3Y/fOC3fqFs4Qain7IgzBq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697319670, "uuid": "f03c884b-ac1b-4c91-9a3c-3df2d6e3c2c1", "value": 897536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697319670, "uuid": "a74639b8-aacd-4e08-a47a-06380c3a5872", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697319670, "uuid": "9989e7df-f43e-4553-b8a4-059d7aa5c81e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "154dc94f-6a5a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1697264563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697264563, "uuid": "65759933-0e44-4800-a7cd-200e77b2133b", "comment": "Malware payload (Mirai)", "value": "7e43088c4386d1c589e6a4abed0d7112", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697264563, "uuid": "aed042c4-7853-4716-a1c8-295f38eea763", "comment": "Malware payload (Mirai)", "value": "7debb0e5884231b6132730d1407a1ba8381e1eabaf0235e83ca827396ad0bde7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697264563, "uuid": "78c9869b-c9b7-4ede-91c8-3f312ebb1a20", "comment": "Malware payload (Mirai)", "value": "0b83752057970f816a0a49f6354ec902a3d6c2e6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697264563, "uuid": "f022d5fa-aaae-418d-be21-c25eb13977d2", "comment": "Malware payload (Mirai)", "value": "b2a6caaef6270df2d26c2ce781e301322fa8db1787b6887d2527f539b1f5cf27bb867f348336486b5ecaed64fbc31c92", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697264563, "uuid": "9598d16a-6235-41e5-8444-85e8adb7eb9d", "value": "T12283F79278C29A16C6E423BBFA7E018D332567A8D2DF32179C212F1577C981F0DB7691", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697264563, "uuid": "44632f1e-713c-4f50-8afe-aa2046e7b6fd", "value": "1536:ssCvlPf6NDyL9Jb0+pHXlzPhha0xT8dUn6ahWNrHxKW5XnHM357jC:ssCvlPCuTxCUn1hi4Wm3x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697264563, "uuid": "4b26e573-07ea-42f5-835b-3e844ac7b8f2", "value": 82940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697264563, "uuid": "da8ce9c1-42f9-4c24-9f50-c7809af1e943", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697264563, "uuid": "80f451e7-dffb-4c8c-acdb-dc6075790cac", "value": "7e43088c4386d1c589e6a4abed0d7112", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d8bd6e6-6ae5-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1697324464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697324464, "uuid": "0cba65a8-5123-4d88-8d89-d84d0b4b591b", "comment": "Malware payload", "value": "c2d31e681c4b22fdfce3f1cc2e67887c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697324464, "uuid": "ff8e98c1-d155-4a5f-b950-a8bb8f6ae7ef", "comment": "Malware payload", "value": "7e0a0c8635c12574b95baf0f159bdbe91f5f8a971c043ea1869f7dab8270f95e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697324464, "uuid": "b7ba76de-5dac-481f-bb10-1f398ec4cbb5", "comment": "Malware payload", "value": "6cbed4d2db88dcdda51d5334954832b0de0726e5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697324464, "uuid": "4207825f-bda6-4556-b7ca-d1d7b9d5c7bf", "comment": "Malware payload", "value": "92d0895da54c0c626989e61a3e5d7c93c77d32e88c0787909aaad0eb80bc5e6ea9535ee488d5f23a81815729edcecf68", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697324464, "uuid": "4704048e-af93-455a-99fc-894cb1ba7790", "value": "T149173384EBD41602F28EBA7970FF431C5A76A3AF545953E3BBB2B0589EE79340950343", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697324464, "uuid": "ae1e6899-7ed5-467e-b07b-597bd9b69cae", "value": "393216:YNk7kcsRy6GzjHijbucaIh62nw5A84kg7ZRV/E4K1xAE/DX4sQ1yBU:CkocsrijCjtmi8w63xAuUOBU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697324464, "uuid": "a47da49e-2179-4b6a-b47a-eac06df70154", "value": 19394520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697324464, "uuid": "c4ea9a9a-002e-4ffd-862f-740961d675e9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697324464, "uuid": "5b38e398-fc53-48bf-b54d-2aa27a65ceb6", "value": "Cuttlebone-1.0.4-win.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2609611e-6a5a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1697264591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697264591, "uuid": "c73517fd-9a6b-4910-929f-970edf61f5d9", "comment": "Malware payload (Mirai)", "value": "744ac77e01d0c9435409ad763f149ae6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697264591, "uuid": "58caa0c6-64cc-4e55-b1da-c79884316b0c", "comment": "Malware payload (Mirai)", "value": "7fbb48c63c4f37f04051c93c9fafe0d79fd50e22635aa40bcf6c3c9cd9d2ede1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697264591, "uuid": "2dab5d9e-2f5d-41e0-93e5-cdf574636d1d", "comment": "Malware payload (Mirai)", "value": "b6d07e3e913fec147741e7b57e2a6269c4d45e9a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697264591, "uuid": "4e0263a4-0ace-47fb-9fdd-fb06327a47bb", "comment": "Malware payload (Mirai)", "value": "268bd9f952fe7d4bc6c71374afcad9347dff6c223494060560fd8d0c1597933bb0ce7ab9c60caf70b3fd531b0ed79e2a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697264591, "uuid": "e4251b9e-4012-4436-beec-44c62633ecf2", "value": "T141634AC4A593E8F0DD1507B53177EB334A77F536211AEAC7D3B8A923BC82A41940B29D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697264591, "uuid": "c4dd8425-caf0-4e95-a06a-e8238e7bf1f2", "value": "1536:m4uQwyBcqv117K/Mn9O/kbfvxk2N5rFfEftaNGqjHaS5wPrT8y5x73QC:mBRk13jbfvxk2N5rFfE1aNGMaw+8ybg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697264591, "uuid": "49a590fb-6ce5-4cb6-a1c8-2317520d30d0", "value": 70704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697264591, "uuid": "8587ecf2-3489-4aeb-9d13-7a00dd385927", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697264591, "uuid": "30a5fb88-725d-4386-bcb9-40ea9e3308be", "value": "744ac77e01d0c9435409ad763f149ae6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d9b13f2-6a84-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697282696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697282696, "uuid": "5ecab085-100a-4636-941f-e0ed56d7358b", "comment": "Malware payload (RedLineStealer)", "value": "30aa6dea9541439fbd186e042fbc607f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697282696, "uuid": "c60a85ee-04b7-4693-8ef6-54a3e5e1543a", "comment": "Malware payload (RedLineStealer)", "value": "81834bf319c4acbdf2b43255658e739c7a55cc77a4d984e11d11e0db9bb2e613", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697282696, "uuid": "1a2c337e-40df-45f0-b341-b9e5e17d173e", "comment": "Malware payload (RedLineStealer)", "value": "137306c74f6d056b357c9c0fe2bdcbd00d370297", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697282696, "uuid": "3ccf8dd5-3cc3-4cfa-88db-a9e8552c93b9", "comment": "Malware payload (RedLineStealer)", "value": "607ad3adcd3ae7ffda5cb5c2381494b22540839fc9d73d61cfea2de91d06ca1fa59be2a66b4a2c88a5a76aa0f688d923", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697282696, "uuid": "ec10cd2d-a2c2-4afb-b613-bc0f6231a111", "value": "T1D8552312FBDC6237C8B5177040F911C30EB5BD665A384B2776C1AE9E1A23E889D76327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697282696, "uuid": "6b8f124a-63d1-4bf5-9bd5-add93326f973", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697282696, "uuid": "14a6238a-ea4a-49d6-ac1a-e506bd457c06", "value": "24576:jy5KYCJ/13VsxW68PY3MI2WjQiScrl4MH4XYGAInJZVj0:25oJd3j9PlB4oYGAInJZVj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697282696, "uuid": "3683cdd0-974d-437f-aced-ea07af27c23c", "value": 1361920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697282696, "uuid": "4e464efe-c383-4587-af59-fdf29a3edc94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697282696, "uuid": "363f801b-48be-44d2-b5cf-8d8fa1b80646", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71d2193a-6a68-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1697270731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697270731, "uuid": "e2b3a2d6-aabc-4c37-ab3e-4e543db2abc7", "comment": "Malware payload (Gafgyt)", "value": "d44a9d42f661600851821c0d4e384777", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697270731, "uuid": "96ece355-abf9-4505-b1e0-7f27d3a40c9d", "comment": "Malware payload (Gafgyt)", "value": "822ba1f29182c1827a33d029d1593ffc01fc57882198a545c55560d68e634127", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697270731, "uuid": "4cdb834b-d6c0-4509-a4c7-c9ae87da2c8d", "comment": "Malware payload (Gafgyt)", "value": "6abde39dc37867eb940eb87a7cd5720f0ed287f0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697270731, "uuid": "c3aa2487-3c91-4062-a5c7-0a894bda3b3c", "comment": "Malware payload (Gafgyt)", "value": "4c676998266259fb016f517115b494808c1e47a79c93e8353975c9e004bcc6d9e76beb08015c6a0b072ca33938c3eb12", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697270731, "uuid": "e08f15ee-2352-4d16-acc2-2b285ad9c5aa", "value": "T196244B46EA818F13C0D717BAB6AF4245333297A4D3D773069914AFB87F8765A0F23606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697270731, "uuid": "4b794fe2-b1ae-46e4-a260-14fd81b9f49c", "value": "6144:60wy6NPxaRNM3thcoOkVA0He8wRJ9D+vM/9ZVj0+mjwkTSFlsj:6zbNPxaRNM3thco3nS8k/fV4+mjZTSFi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697270731, "uuid": "545674d7-6d30-434d-88a1-40404a319fe7", "value": 217912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697270731, "uuid": "060aba97-31b3-4a79-9a20-2a985d64974c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697270731, "uuid": "545f148c-bcd1-40e6-8840-99be6e16dc88", "value": "d44a9d42f661600851821c0d4e384777", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e0f2baf-6a75-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697276147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697276147, "uuid": "c4135186-d02d-4159-b212-bc60fe491bf7", "comment": "Malware payload (RedLineStealer)", "value": "f4f434e0b8d040ec3eb7e8fa407722cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697276147, "uuid": "2826d763-004d-4779-8c07-9278f40db3af", "comment": "Malware payload (RedLineStealer)", "value": "8263546ce49a8d3e8e320fdad866c82ee5b7807b5ee3bbe45a2cd603f3e17f53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697276147, "uuid": "ccffc5b1-8dff-49aa-a6a1-dcef2059e578", "comment": "Malware payload (RedLineStealer)", "value": "01a3c24ab75dd174b0c8000e86f557030a9bbb8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697276147, "uuid": "15447176-d39f-4c9b-b0fb-50e156deaf2c", "comment": "Malware payload (RedLineStealer)", "value": "c3caefc5c096baa89f8f8fe9fcea110cc906d16fd0f1fd377dff373610291d85b071d495a6a9fde28dd4f72dba1fcc35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697276147, "uuid": "33b71e69-9a54-4582-894f-2fcbb6c30458", "value": "T16575235B6FE5C0B3E6E4237040F743A71BB6BD614A3C83BE6746A1460E716A91532B33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697276147, "uuid": "641b1cc8-989e-4ce1-8a86-7264582f37ae", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697276147, "uuid": "95700076-7109-44a9-9cc9-252b1a46fa2a", "value": "49152:MY5ydpfG0fminU/YZgyh8icaFHDpzFLw2I2Ir+C8:7yb2inUgMicaRDp5EJpSC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697276147, "uuid": "411c8322-09a4-4f99-8dc4-ee98ce2f6ffe", "value": 1625088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697276147, "uuid": "8dcc360c-bdb1-4c27-9485-4262eedf0391", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697276147, "uuid": "1daadf57-c7f0-4fd0-92ac-8066d3a39309", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f6c503f-6a68-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697270673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697270673, "uuid": "10f3cc80-5e82-4b5b-9e91-e41bd00af3b2", "comment": "Malware payload (RedLineStealer)", "value": "b44a696f461d0e77466424ee4812b445", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697270673, "uuid": "b3ddc9fb-042e-4078-9fb3-529602c5ffbe", "comment": "Malware payload (RedLineStealer)", "value": "842996307a32755e82be9d7c8f3e2eafa848e627cb1a817022dee9b9da5c8d96", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697270673, "uuid": "461c5130-6a0f-43dd-a65a-2bde4c4c7b70", "comment": "Malware payload (RedLineStealer)", "value": "42c67c01ed7444ee8f5e19420e00677d4dff6920", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697270673, "uuid": "c91783e2-d9ce-48c0-a34b-4df06d1f2eb3", "comment": "Malware payload (RedLineStealer)", "value": "e414a7df73667e734c0aaf8a26bfa936f1128f3a522b3bc4a66b14e3041f9342bbf014aa1df24600b962eb6f4101d04a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697270673, "uuid": "0e382d91-4a80-4b44-bcaa-df51100b4df4", "value": "T11C7523A0BBE58032E595277054FB51931E37FD66A83843AF6B85E81D5CB3EC081B136B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697270673, "uuid": "d4be10b7-95b7-4620-b19f-c2108e497752", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697270673, "uuid": "f7ecf72b-54f6-4107-9765-8662afcda1a6", "value": "49152:afFTy8tovDqZg3he3UaWO6+4cyg0foikGJh9+nD:qntovWN3UarZXKb1+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697270673, "uuid": "dff42e20-670f-489a-b2a6-7eac473d5f43", "value": 1624576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697270673, "uuid": "64992301-b88f-47d6-b807-f1dd5668e964", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697270673, "uuid": "355956d2-fd70-4047-b6d2-9629ba9a002d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e75b3da-6a2a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697243989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697243989, "uuid": "e16a0df6-5efd-4986-bc94-8e38faa87e0e", "comment": "Malware payload (RedLineStealer)", "value": "8da5c411940053360485d1912978cc7c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697243989, "uuid": "16144713-d78d-46f4-ab4f-075280afc997", "comment": "Malware payload (RedLineStealer)", "value": "86062cb035cf8fbeaf78c23e24af482c660927e637d1ad1a3c81e167eeee44e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697243989, "uuid": "8c62a5cb-214c-4624-9e18-2ba263dca871", "comment": "Malware payload (RedLineStealer)", "value": "91888aab885f3500bc07c613576327694b109733", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697243989, "uuid": "86ffe7da-58bf-401c-98e1-f6acabe3de21", "comment": "Malware payload (RedLineStealer)", "value": "a370d38767eee5281cc22dcc82e00c14f8542b4a8ab3cbaed5481c02087ff838adbc6fdf1e91d5b99e5b672bd0ed6676", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697243989, "uuid": "66f7da84-bd19-423a-8715-653d4de2b73b", "value": "T1E2753356A6D8C031EA60677118FE13D30B79B879CCB843ABB782E8590C73AD415B077B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697243989, "uuid": "05c3595c-6f0f-4c0c-8239-a5a7afe85614", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697243989, "uuid": "c888dcf9-886e-401f-a980-9cf991cf2437", "value": "49152:vZuyp4MY2JcpAwFu5y4ZgVhX5YaeIInRviHzYx5Om:A3MYDD4tI5YaIcTE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697243989, "uuid": "2a3ffe7b-3633-4562-b945-50820cc5c418", "value": 1625088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697243989, "uuid": "b75f5b46-fc83-4c9d-9334-9c11738adcaf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697243989, "uuid": "a002e25f-e06e-4525-94cd-c70f26270827", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1f70206-6aa5-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1697297118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697297118, "uuid": "6bbfbf94-8b5f-45ea-b5c8-8eafba9fa420", "comment": "Malware payload", "value": "4e10c8d3d71136e870cf58c0e31db2bc", "object_relation": "md5", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "NukeSped", "colour": "#FD42CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697297118, "uuid": "8aa5a0d4-c513-48a8-ba33-d317cb15e99f", "comment": "Malware payload", "value": "861a0b52b3676fb46f4d97699cd3dc02f2f8b5964633491f61a8b22ce9221b1d", "object_relation": "sha256", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "NukeSped", "colour": "#FD42CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697297118, "uuid": "e98ebe25-b379-449b-ab5d-5268f34ccb08", "comment": "Malware payload", "value": "d2f160bf01a1f7b863188c9b953c197f7b876c7a", "object_relation": "sha1", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "NukeSped", "colour": "#FD42CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697297118, "uuid": "1bffae9c-3891-498d-a00c-37e79fdad8a8", "comment": "Malware payload", "value": "06e1967c89461a2ec896906d44f9d637308d619962d6040b825c371c73f1dee439c867e0a17c6eeaf3fe96a3b07789c2", "object_relation": "sha3-384", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "NukeSped", "colour": "#FD42CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697297118, "uuid": "a126353c-880b-4260-924d-babf75fb2bcf", "value": "T140E5CF566BB440E4D1B6C13C8AB6D682F7B278950B31CBDF16A5536E2F33AD04D39322", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697297118, "uuid": "c512a57f-49aa-4428-9e6e-b9a072a4d3a9", "value": "49152:kwG5dutV04/iT5W5pLoJ6qJNPhERaU+d:ZGgJNVARX5ERaUc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697297118, "uuid": "258bc20f-1a57-4be1-9e66-d859067c0835", "value": 3260416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697297118, "uuid": "7b132662-899e-4bc1-acc3-3fe87134e5d8", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697297118, "uuid": "1568ed8e-2ea2-4f77-a835-3661fe0368c5", "value": "Skill Assessment.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "826d3f60-6a68-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1697270759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697270759, "uuid": "d63f3d38-50f0-4ea9-a4ac-9841bc5b0a98", "comment": "Malware payload (Mirai)", "value": "69b2e02492275370ab7ee0eb9a794ae6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697270759, "uuid": "601caf68-b2e7-4c9a-bd37-855867a28014", "comment": "Malware payload (Mirai)", "value": "8759dd317b04164ff725168175e539a4e3a4916c437dfa9faf954f1832ff322b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697270759, "uuid": "8063f5cc-6bd5-47f8-9cca-90e421bcbddc", "comment": "Malware payload (Mirai)", "value": "587a14a00e665bf7fff09466084f2a84dd3cc32b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697270759, "uuid": "dfb94b2b-bc4f-4677-b485-b1a0cc49feae", "comment": "Malware payload (Mirai)", "value": "9a06eb53e82bcb478980f86fbbc4569b6cbcf255c4e14a6aaae9ae04b76b2560168686e5d046147f3421f17854e79f83", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697270759, "uuid": "a79a9d0f-773a-4f72-babb-6cf966eae389", "value": "T1B5E30945F8405E23C6D622BBFB5E428D372A17E8D3EE72079D216F21378685B0D77642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697270759, "uuid": "a10e924a-a8eb-48dc-9593-f5f63a2232b1", "value": "3072:PC2DFa1nq64RSaw4ac5wHrE0MkApU79ELwbZnN:PCKdEaw4agwHrEuApy9ewRN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697270759, "uuid": "49080db3-57de-4e13-a7f1-a194616a028c", "value": 152864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697270759, "uuid": "52ad529f-3498-4868-88bb-2047e96aae96", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697270759, "uuid": "cb62bb5d-15b0-45bc-96fd-6a839465b383", "value": "69b2e02492275370ab7ee0eb9a794ae6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "857d0dd0-6a41-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1697254014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697254014, "uuid": "cdd7b1ff-925e-4a9a-a605-fd71f1e228ff", "comment": "Malware payload (Amadey)", "value": "1419fce8619e2b04dc3b00721bcecadf", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697254014, "uuid": "d4b6b9ea-6b9e-4ab8-8de4-78565806c486", "comment": "Malware payload (Amadey)", "value": "88346d120aab14a6b27d029e8910607ccbe15dcac309864ca97243a340ac98d4", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697254014, "uuid": "f39b6310-c277-4a53-963f-206655bff70f", "comment": "Malware payload (Amadey)", "value": "220b2a4cffc7e225dd11098077730d113a2ea5fd", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697254014, "uuid": "12537766-ebc3-43ed-a29b-15b19389302e", "comment": "Malware payload (Amadey)", "value": "ff6071736e8ef8a4d7157e851e267ace68dedb0cae87927446bf9aa5e0914c708a0629bf3554e3eaab2f50b5d9107de6", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697254014, "uuid": "ed886c72-aaea-4ac2-898b-8f0649870d04", "value": "T1A2752361BAC9C536F5B22B3009ED43430B35BD668C3897FB7B53A40A5833594A5B0B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697254014, "uuid": "0a2af8a3-0aa5-40d3-b880-586bc9e2a4f8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697254014, "uuid": "dec1fbce-8b94-4545-b65c-498abee63a2e", "value": "49152:dRPmZFApXdkPWZgmhFSeafaY2SQT2WJ5KNP2td:3cidkGPSea3nWJ5KIz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697254014, "uuid": "1bc9c0c3-7894-4a38-8091-f4d4052c6f7c", "value": 1624064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697254014, "uuid": "c07c2963-3d8f-4419-8a91-df1fa48fd81f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697254014, "uuid": "6802cf5f-9991-41f3-bd1c-e7a0d7004bc2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6f2cb6c-6aaf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1697301448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697301448, "uuid": "ed05b151-fa34-44ee-94ad-1c672f02aa9e", "comment": "Malware payload (Mirai)", "value": "51268b41b3d353c5fddba11760d9a462", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697301448, "uuid": "2125c309-61e6-4fc1-afae-71ad76268274", "comment": "Malware payload (Mirai)", "value": "88506e3f9029c0b297c6149e05166e9ef1af27cbafe13beff41eb04426f2850b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697301448, "uuid": "24b93ec1-ea82-4e56-8a98-0e859f3991fa", "comment": "Malware payload (Mirai)", "value": "c3093436868f6ac8caccfb2da2bf3ba2788cd862", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697301448, "uuid": "3d04484e-aee5-444f-ad4d-ac0461bf3b91", "comment": "Malware payload (Mirai)", "value": "31f37729311cf26c827c070328f66f0993eb0feeb2015d8c8f7406dbc8dc9a94341df3d6c319dd9c5f02c6a2f73780be", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697301448, "uuid": "5495288b-55eb-4ebc-a584-cf4afb91a693", "value": "T1E3D2E174A78A38B1C1B00234B6A847DB46571EB4D0FFB377762014B579F718E3AA05E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697301448, "uuid": "5ed7246c-6c95-4b75-8be2-761ba2188dce", "value": "768:6A4uBc0T/nVvqV072G+IFYoXHZCx3GKCjR9s3UozJ:6PuB7/nVMYn+Kf5z+zJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697301448, "uuid": "f986b5b9-27f9-489e-a075-4a4a4106cdc9", "value": 29944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697301448, "uuid": "9707b77b-5cdf-4cff-b210-3cbc72b9cbd3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697301448, "uuid": "0efca7b4-7010-47e0-8eec-13f49d51fb58", "value": "51268b41b3d353c5fddba11760d9a462", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b3ceb2c-6a54-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697262023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697262023, "uuid": "058836a5-accb-4ca6-ad61-21876925e8dc", "comment": "Malware payload (RedLineStealer)", "value": "3f8549297684a6023dece283bfb1e40f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697262023, "uuid": "74f69556-3009-4401-8ecb-751c70e75a20", "comment": "Malware payload (RedLineStealer)", "value": "8cfa9addac427a6c1156e42c46a734e64172f36d297154b458533a52d16f3632", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697262023, "uuid": "613250f0-375d-4a92-b5f1-24785dcbec6f", "comment": "Malware payload (RedLineStealer)", "value": "4c749c9f1fcf8f7e8358a5905e323ce9910524fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697262023, "uuid": "1d0d2068-0f2d-4086-b543-5f809e6834c7", "comment": "Malware payload (RedLineStealer)", "value": "d33f8b00369c264dd8bea7be23d72b8b1826dc1a79956f7cf6820a9ba45b04bc1ec426fd04ca2b98b68d798f89d834e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697262023, "uuid": "f13a1326-052d-4aa5-83bd-3f31156f3bec", "value": "T13F752382A6C98C71F63527744CFB02431B3DBDA5AE61836EAE418D0B4973BD464B137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697262023, "uuid": "ad4f84f9-167f-4cf4-a633-1c18cca2dba4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697262023, "uuid": "73dd44d6-ea02-4f91-ab5c-3e5899c92e0d", "value": "49152:3B6IG0OaAvZ77ZguhqxragXY3Lh5tWwLDgI:lbWJIxra1Lh5hLDg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697262023, "uuid": "fdabe0d6-a265-4dbe-9293-6191b4b9453e", "value": 1625088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697262023, "uuid": "4921138d-0db9-4c22-a192-00ac5b02e871", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697262023, "uuid": "2047d1ad-9522-4503-b6f5-5ae925650cfc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e35c0b1c-6aaf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1697301416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697301416, "uuid": "66258d19-697e-4efd-a090-787976d05144", "comment": "Malware payload (Mirai)", "value": "ac73220e9d32bc6387460282a1125c74", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697301416, "uuid": "5fc9cfff-8f9d-433c-8e74-607467c7579f", "comment": "Malware payload (Mirai)", "value": "8f2beef88301cbdcf02181c7b640dc08d6bfd4248985facb998fce92fd2354b3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697301416, "uuid": "da4c8cec-f4b3-46b5-9bb9-3828b541e9cf", "comment": "Malware payload (Mirai)", "value": "297929ee608b0181545e9aef98fae29221b88531", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697301416, "uuid": "52b33904-eaba-413b-b52e-c20bcdfd4dbe", "comment": "Malware payload (Mirai)", "value": "25b78cb82a734ffa578c6f8d64d4fee8b6524c90784ead70caf2c9bc69a9c502139eb4950936096e3a3fb8501b3c9b0d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697301416, "uuid": "1db654ad-c174-4b7b-a904-df210b582a7f", "value": "T1C2735B24A97A2E26C1D4A17E62FBC321F1F6230E25B4961C3CB60F8EFF1465464562B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697301416, "uuid": "335105e1-b874-4456-a930-fc5a2bb648ec", "value": "1536:ubHmkTSo3BOIqS5aq+Dc035R9QuEk6vNNicKzfZFx8:kmcjaq+Dcc5J+vN4Fzfp8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697301416, "uuid": "896b3ca3-41b2-447c-abec-79d84d7c0a1d", "value": 74572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697301416, "uuid": "900da699-1870-468b-9acf-1f0c6a504542", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697301416, "uuid": "4a7839de-5939-4a15-b0be-503edea80f3e", "value": "ac73220e9d32bc6387460282a1125c74", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b08f9d88-6ac3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (QuasarRAT)", "timestamp": 1697309920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697309920, "uuid": "087a4879-3b70-482f-b963-9e075c853b62", "comment": "Malware payload (QuasarRAT)", "value": "8ce7767eac028e5ebb49abf2d5cda701", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697309920, "uuid": "bd3a6ed8-7ce3-4e6e-9928-0c9241e40f64", "comment": "Malware payload (QuasarRAT)", "value": "901551f43436ee34d1776a82759e8e0ebb0ef629412699a806c75b9e938c21f6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697309920, "uuid": "f7db4dec-74e3-41f0-84a2-bde6979e8a34", "comment": "Malware payload (QuasarRAT)", "value": "e7d58f89ba1b43b1658e56ea547e76fdcadc5e7f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697309920, "uuid": "ae7cec04-44ee-4b27-a4a2-32380a65ad06", "comment": "Malware payload (QuasarRAT)", "value": "7d27a4ca06b9063a40b30cc3d312915e224a4de5d14fb25984de6d2e2ef6313461632cdd373f31fe052a8b5b0b56cd22", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697309920, "uuid": "01aefbce-96c4-4f74-a474-12a05a55cd57", "value": "T151E56B0437F85E33E16BD6B3D9B0501267F0F86AF363E70B6191667E2C53B9058426AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697309920, "uuid": "07e93c11-6426-4f7a-8a12-1b1fefe6fb4c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697309920, "uuid": "7ac2dc4d-216d-42b3-8e88-f37509a50d82", "value": "49152:KvIt62XlaSFNWPjljiFa2RoUYIhd1SLoGdUhTHHB72eh2NT:KvE62XlaSFNWPjljiFXRoUYIhd1c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697309920, "uuid": "2e272400-34e2-4e3c-acad-150fb280c0e8", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697309920, "uuid": "be43e44f-a24a-4781-8db3-5a6bb8416cc0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697309920, "uuid": "c395c75b-0fbc-428f-832b-75ab4b96a643", "value": "8ce7767eac028e5ebb49abf2d5cda701", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36ad91ea-6abd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1697307139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697307139, "uuid": "dfdf76b1-725c-4860-aeda-5dbf6c780f68", "comment": "Malware payload (Mirai)", "value": "a3d62d9098a4cbf6f598c326d65586b1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697307139, "uuid": "01bb2d26-4eae-4ea3-ada2-40953cfb868e", "comment": "Malware payload (Mirai)", "value": "906b08e6498deb4c669d72b81fe57a5e0e33ef3bb33c3f07b4cf65f001ccf5e9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697307139, "uuid": "9752b10b-2cd5-490e-ae31-140eb8f23525", "comment": "Malware payload (Mirai)", "value": "3eb6b5af62d3d523f5c2a173e8a6a6cf38fa7c19", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697307139, "uuid": "88e26c78-4209-4f7b-a146-7d2105aae2f7", "comment": "Malware payload (Mirai)", "value": "06b1b5f23cbfa086ca9b8014eca3a83faae877f2e875d3b0eb035fd4ccc96f425a87ff1310d57d0f864aaa250058a567", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697307139, "uuid": "46b25e53-9adc-48d3-91f2-83c38984216a", "value": "T1E673721E6A21DFFEF69D82340B738E206799229136E1D6C4F25CD7181E7024E685F7E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697307139, "uuid": "cd75d1e1-15ee-4a37-95af-ed99c0b16229", "value": "768:QlzhL0WN7Czg2qd/qegc8fV+Npfj9hQyiRr9nrl6FAEq0OfyUAteHx04IhKTCnB6:QJHJM9mI5nIZbeHx04EKTCnB6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697307139, "uuid": "1b95ec11-f6d1-49be-b3e0-6359da917f68", "value": 79256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697307139, "uuid": "d1a150f2-3b85-4b78-942c-4844361d2340", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697307139, "uuid": "df98aa02-bbc9-47b2-a9f0-72f8fa0b8c3a", "value": "a3d62d9098a4cbf6f598c326d65586b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b7fd22f-6a81-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697281297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697281297, "uuid": "da22c2a3-955c-4a04-afc7-de255cd3cdf6", "comment": "Malware payload (RedLineStealer)", "value": "35f5eab6f30930c23649afe1c9d4354a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697281297, "uuid": "44d267ea-8535-4943-bcee-0861431110ed", "comment": "Malware payload (RedLineStealer)", "value": "907ea6bf471a15bad9025ecdeae95a9d25f660e9830c722596b29ef1faa32f24", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697281297, "uuid": "5497c29b-3620-4f31-850f-15a3db1429a5", "comment": "Malware payload (RedLineStealer)", "value": "520734f05a9cedfde2fd094a4bc5922889538acd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697281297, "uuid": "4e9461ef-3231-4ea9-a818-8001322d51c2", "comment": "Malware payload (RedLineStealer)", "value": "274fbe4fc85fff3cc7e5f205762f26dbecc92482b9476af585583f7412d6d320f8a8d2bbbfd2050e577b7760494a3ac7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697281297, "uuid": "e950e6c5-d468-4837-8001-83a5975275db", "value": "T135552352BBEC8072CCB1173199FE03D35D353AE1193896DB2B6B694749B2A906C31B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697281297, "uuid": "27c7b627-9a28-4aa5-9bff-f6b95ab11786", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697281297, "uuid": "928f8bf7-f2d1-4356-9997-cdee753d6649", "value": "24576:Wy4aYfMWtDrkd1ihzoAABql40JK2LBdpodrCpxLyuSIuh52eRi/r:lhG+dQKclxKkjp+ryNyuSIC5rC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697281297, "uuid": "3c695c8f-8401-400e-9181-e8a311203a5f", "value": 1359360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697281297, "uuid": "30afadfb-d293-4731-8734-1022d25bcfac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697281297, "uuid": "215d2038-805f-4daf-bd75-f9092226d6d1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "881ab915-6a31-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1697247146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697247146, "uuid": "4d91384d-e25d-439c-bdac-1dccf65e6bff", "comment": "Malware payload (Smoke Loader)", "value": "b4b15aef4d2769d9e337702ce7aa7567", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697247146, "uuid": "cf288ee6-58a4-458a-b189-035f6d8d1ccf", "comment": "Malware payload (Smoke Loader)", "value": "914f1d5465e5201dc2a565458ac9744aae002a6c7ec55a77384b0b8aac97da40", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697247146, "uuid": "50c80397-8b2c-44b4-99c1-b03e900403c0", "comment": "Malware payload (Smoke Loader)", "value": "e86f505fb4ccbd77cabdc6287b3a4fe0de1b526c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697247146, "uuid": "68d8a4ae-287e-4458-a304-8a9464126307", "comment": "Malware payload (Smoke Loader)", "value": "29a1d051bc441229b45535bcac1b065191434c2972e55ba708495c995f9029d91aeb3fcb13d73cafd26e47e8d920985b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697247146, "uuid": "65f8438f-60fd-4cff-814f-a331542fb6e8", "value": "T164347C0B92D0BC62DA2647758F1FC7FC7B1DB9508E597B6722189E2F19722B2D663300", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697247146, "uuid": "deb159c1-2721-4a8d-a9e3-be3e1df28976", "value": "1c3ca84f6b5898827a66133fb3e0d8f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697247146, "uuid": "748f1ff9-3fa5-4b2f-9a3e-9f20d864f7e3", "value": "3072:e8MOh+yFRASFi4K+U8Rh68InevzpZ0zvX5DQh1Dk:etkSSvTnRhWnAzpoVQh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697247146, "uuid": "272647ac-ad3d-441f-927f-9de01f060160", "value": 246272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697247146, "uuid": "20c8db65-0ad5-4cc6-952d-9314833bb8ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697247146, "uuid": "b3554241-3093-4182-9592-fe9c948727c8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2e466cf-6ae5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697324500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697324500, "uuid": "04785fff-18f5-4882-8517-96b0e250cda7", "comment": "Malware payload (RedLineStealer)", "value": "a1c893d6fac1fb2c8b8c0383ee4b2382", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697324500, "uuid": "c180102f-4712-4528-9143-e358732e8096", "comment": "Malware payload (RedLineStealer)", "value": "916624f991381a252d8446fa503682255716f5b3c50dd9d3947a2eb2ee39fa21", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697324500, "uuid": "99c57cc1-8ca1-447d-b0f6-8bb6ce90ee61", "comment": "Malware payload (RedLineStealer)", "value": "97c9580385c390b06c0d1b4888393d4acc4517c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697324500, "uuid": "c10d01df-367d-4f08-ac4e-394b93b42527", "comment": "Malware payload (RedLineStealer)", "value": "e6f36931acfd87b5eda4e1ce0602fe8e74585d51607df0806ad42f46fc376f70c3413c98ddcfba0d612685381cfe9cbb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697324500, "uuid": "0734de46-3961-4a6e-96df-d90b30b05e6b", "value": "T188E4220377ED4921E4B90FB018F603D71E35BCB1697842AF23A2E9951DB26C4693937B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697324500, "uuid": "2dee6b89-4a13-46ba-9f95-c0d01d3ddaa6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697324500, "uuid": "74a01d65-4ac7-4eb0-9532-cf37a571c065", "value": "12288:QMroy907Vvgrqsl1xhHSVUsNyc9d7GHDYKwp+n+LJ/8Vg7WcNyHC:oyiVvgrPfJSasNBd7EIL977WyyHC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697324500, "uuid": "baa78b8f-d246-427b-937f-b75e6f4a10f5", "value": 708608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697324500, "uuid": "f81e80f6-cd7e-460b-b402-45b0482ad393", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697324500, "uuid": "bb9b8704-6fdb-4d27-b41c-5ddf79a1c85f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd3bb9b7-6aaa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1697299204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697299204, "uuid": "fbb840a6-955a-454e-8be7-928169d45ac2", "comment": "Malware payload (Mirai)", "value": "82321d71a078166abc4503d777a4c539", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697299204, "uuid": "fa05f00e-2501-4fb6-9575-615e64d9e466", "comment": "Malware payload (Mirai)", "value": "9374500c46d6c12a270079dbb6efe0b33e96bf7000d09b622de4dfbd70587199", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697299204, "uuid": "ed4ae0e5-24b7-4760-88ed-fd3ab1aa9f3d", "comment": "Malware payload (Mirai)", "value": "48f86ebfb4f5ff8b87c99296133ff5f25af516f6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697299204, "uuid": "663e860a-374a-4a91-9927-f04df0550b41", "comment": "Malware payload (Mirai)", "value": "f97a5c15f97d62acb834b50c7e087c008f896823d822ad9a8dc7575bee25c88cac75c16d4030888adf6afb4314644cfe", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697299204, "uuid": "8a58d664-8c3e-48ec-acaf-42a16729c9a9", "value": "T126D2E0B5AE6CAED68089F7345C8ACC5E70DDB4736F3EA5084E8109463126D02A6B4EC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697299204, "uuid": "108fda43-58d8-4077-963a-6ba5a6f4db7e", "value": "768:xN8f6tfoQmQAXV7E1QDvjnVAiSZd8H0GuOZk35AZqR:jMJXFl7IQjU6u97", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697299204, "uuid": "4d7b16a1-6a97-4c1b-99d2-4e49d38c22e2", "value": 29896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697299204, "uuid": "64ce7728-75f6-4d34-a131-c0e32c010e9b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697299204, "uuid": "63e1a477-db8a-434f-903a-218669e9f821", "value": "xd.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e98b4914-6aaf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1697301426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697301426, "uuid": "422e2538-a8c1-4cd7-9db1-385b2feef152", "comment": "Malware payload (Mirai)", "value": "dfdded5d9d28ff160c60429b57c44c18", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697301426, "uuid": "37eb1f9a-a427-4758-aa2c-683e9a77c699", "comment": "Malware payload (Mirai)", "value": "9478be47e7016a9107d65bd27af7cd4664dceb64d992ec5c986009e0959ebcae", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697301426, "uuid": "5b2ed1de-f3dd-4ef0-a5b2-ad37cd4327c2", "comment": "Malware payload (Mirai)", "value": "973c44f74b0a291ced171f1291598519818de6d9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697301426, "uuid": "dcdea532-d552-47d4-aeda-abf990034deb", "comment": "Malware payload (Mirai)", "value": "bc0a4fc9892ccd2a034cd6c69ae39cb747410859814b13706137814bb08935e3018ae534fdb793261ac1d66bc74eae17", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697301426, "uuid": "7c7fe64f-f16d-496d-9cca-ba97e90f84a7", "value": "T1DAC2E045E3002E89FFDFBCB95E2691C477371B9F678B94B3B67855122462D2B7800E88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697301426, "uuid": "df0014f0-d109-41cc-971c-89be1139a859", "value": "768:wUbgeS1f8Dnz+AHyRas6JAshPV/4uVcqgw09E:wUbfaAQGAiN/4u+qgw09E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697301426, "uuid": "d9847fe8-7fef-4b56-b2ec-ed5de1b468fd", "value": 28280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697301426, "uuid": "54aa7803-7ac9-4337-a78e-ae31149487a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697301426, "uuid": "bc522e9c-43a6-4db7-8d6a-a9693715e05a", "value": "dfdded5d9d28ff160c60429b57c44c18", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6bebf30-6a98-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1697291462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697291462, "uuid": "43f8f6c0-9112-4040-80cc-490c18d2994c", "comment": "Malware payload", "value": "d751bd12f47a85d8f92d9de92adfb111", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697291462, "uuid": "5434c258-78c1-46f5-b950-60d339bd0f05", "comment": "Malware payload", "value": "992d090a7e3aa8a7ddca6d6950d922b65f5020d94d42576b6449e38520391353", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697291462, "uuid": "baf614ff-46ea-4797-a071-eaf5783260c0", "comment": "Malware payload", "value": "182eeaf9f7c54755fcc04669a9f1b3fef02fe610", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697291462, "uuid": "988591ce-a734-4e6a-92fe-865780f8175f", "comment": "Malware payload", "value": "f83bd7ece605d1580fa279a9be55c26a0975d136e70935eccd23fe7fbd0ebccfc67f81cbe74c99b803ba62dc2f8a0e1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697291462, "uuid": "207d75d4-840b-4af8-9e65-34e894b6270c", "value": "T1EBC55B45BA814CB6CD5E25F1D39207188F96C7762B00D1AB2AA785DEB32DDCB9C4F183", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697291462, "uuid": "8d404983-6782-421c-872f-e7000e37a8d1", "value": "24576:G0RsmskmY/14ey0ENn2hTMj0xLw0BCsXI2txMAjeaTkKmNLewFF5:Gmj/1VXEshTgq80BtXI2AFGAFL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697291462, "uuid": "673d040f-461f-4980-90e8-c33a0568dcf7", "value": 2681856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697291462, "uuid": "a89a9661-7788-4ecb-bbe9-905893a4bc55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697291462, "uuid": "f8681f74-b6a5-4ef0-91d3-cf8b06c98ea1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a53961c8-6aa2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1697295728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697295728, "uuid": "a18e34b0-c0c2-4dcc-b747-46efb9b2a7a1", "comment": "Malware payload (Mirai)", "value": "ce7b05ef1a981181be054747313fb9a7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697295728, "uuid": "1686d95f-7871-4dfc-9ea0-6eeae4be699b", "comment": "Malware payload (Mirai)", "value": "998eb890270758d67cdf7856ef4929aa3f95b578b3eb31073c04dfa53c178cad", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697295728, "uuid": "7577c1bf-aadc-4cef-bce5-cf26035feee8", "comment": "Malware payload (Mirai)", "value": "e9ba485432e19b06f40de618b889380ef8ceb004", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697295728, "uuid": "2d7e3d3e-cc69-4855-b6e2-03e0c4c78c43", "comment": "Malware payload (Mirai)", "value": "094ecd7be8a4014198a3ccd1efe23917efd8e921aded4efdb7da147a5a70b1b25672387790a6f9a655c87fdad4bba01c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697295728, "uuid": "93ddb389-339f-426f-b0a6-01826c45e71a", "value": "T187A3720E7E319F7DFBAC823847B78A219209339666E1C584D19CED026E7438D741FBA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697295728, "uuid": "bb35ef47-b7a2-43eb-ac42-3b435b364cf3", "value": "1536:FFthwgB00avmripirtxZmc6bUwfKpEvbk0W7LV/P1QpDv+P:vLwgBFGpirNmc6bU2+6k0W7LV/P1QNQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697295728, "uuid": "fc93d6c3-d01c-4af3-8e5a-aec5c4e2696c", "value": 105248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697295728, "uuid": "7b11a014-727e-468e-9605-e07f9886be48", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697295728, "uuid": "c604bf67-5ff1-41fd-aeda-7bc734340a6e", "value": "ce7b05ef1a981181be054747313fb9a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "195f0a6f-6a5a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1697264570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697264570, "uuid": "012cf416-c1c1-4563-b768-095bcacd5a95", "comment": "Malware payload (Mirai)", "value": "028ea762f8cb9852114d39dbeea4dbb6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697264570, "uuid": "703dbed2-cec5-4c98-8438-acde3f716507", "comment": "Malware payload (Mirai)", "value": "99b71c5360e0833aa717911047b7051d55c53c5f6fa70767fb311e7edf228e0d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697264570, "uuid": "3a132933-468d-45dc-9c71-cffaa40f5c63", "comment": "Malware payload (Mirai)", "value": "9babb568cc68e9711e86862aecd280bb9c31fa02", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697264570, "uuid": "e2f2d161-41f8-47f8-8245-2ea926cba093", "comment": "Malware payload (Mirai)", "value": "84eb0507a1caa2e509499931ae12d5156a9c3c607cc147790ad8164193dab973d0966e975f6c281b777792ab6e449d2c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697264570, "uuid": "a5e1a410-64f1-4b53-9b84-f7284c7d71e1", "value": "T11293E896B8C28E15C5D423BBF92E00CD331667A8E2DF72129D106F2477CA92F0E7B955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697264570, "uuid": "ad32663f-828f-4c73-bfdd-8cbba463f786", "value": "1536:FwNn21vn1P0YAvT7C+P7V2o6Ahb0rkHP8U6jWX/w6M1uxCwU85u//5+FYcpITiQi:FFP1sYu7JPZ2oP0r+0U6jWvXMAHHqVCv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697264570, "uuid": "5a35febe-4191-4240-b40d-fa7f53e75ec5", "value": 91440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697264570, "uuid": "23baadf6-7cca-41e5-8a81-49154dcba5de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697264570, "uuid": "f0205485-35a9-460b-bdd6-89e71163e33f", "value": "028ea762f8cb9852114d39dbeea4dbb6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69687ba4-6a7d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1697279736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697279736, "uuid": "52fa93c3-5a97-4d52-880c-9522ab0297c3", "comment": "Malware payload (Smoke Loader)", "value": "9c4269ac2171e502c77a27271b82bd9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697279736, "uuid": "4d067c8c-3171-4a6c-b480-9b58f483f42c", "comment": "Malware payload (Smoke Loader)", "value": "9bbb603adce2702285a8251053c673535c407244ff7eadf7b47f4ad1f983abf8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697279736, "uuid": "6eb1147b-750a-4939-8445-2726f290cc00", "comment": "Malware payload (Smoke Loader)", "value": "ea8f6d79bba1dced2eeb74f2ee0dbd2747bd3c68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697279736, "uuid": "01361e19-27df-4c0c-8d39-dab8ffe1e3a0", "comment": "Malware payload (Smoke Loader)", "value": "e24d342dc45879244478f315816c2745cb7010c541af1e1190eea2037842651e2049788c82eb54a17de0256c8f9d18eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697279736, "uuid": "3f998939-0679-4f98-8528-146187abf3cf", "value": "T15C752316ABD140B3D8B96B705DF50BD31F3EBD62057CE3249B86AC1A18F3681B27531A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697279736, "uuid": "45b4a8b7-aae3-4dde-a26c-15c962416a73", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697279736, "uuid": "4c02364f-ccd4-412b-8482-461f70cf085c", "value": "24576:TyEGMyfS3CxukLGZ+a2zt+X0OvWoMWeI+BojzIxN001oStTSshtQJB:mE7yf6IDXa2R8nMZ4IE0fTSs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697279736, "uuid": "e31fcee1-963f-45c9-81e5-3663b9faa54a", "value": 1625088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697279736, "uuid": "6261cf7f-ecfa-491b-89e9-0f198b05e210", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697279736, "uuid": "4ca3d287-2219-47fa-a51d-214903846b49", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "701946b4-6a4f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697259991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697259991, "uuid": "f902fb7b-5055-48d6-9e8a-bbb44549a25c", "comment": "Malware payload (RedLineStealer)", "value": "69336518490f56e113a3805ef9cbcf42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697259991, "uuid": "d448a036-5213-47f3-a2c0-ec390dc62124", "comment": "Malware payload (RedLineStealer)", "value": "9e7316d1158f9cd61e9742422aeb0c34bb98992ba26eb9b2a64b2db4d3799178", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697259991, "uuid": "eef97564-5345-4b72-ae16-f004a9bb9fe5", "comment": "Malware payload (RedLineStealer)", "value": "545cc6c8df25833f4a00903b90065c8466ba521d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697259991, "uuid": "188744b3-0bb4-4fda-ba77-261c18ee5ff7", "comment": "Malware payload (RedLineStealer)", "value": "d71d712bf4fee1a69daddbb57e773599edafb9453e8a20a9de76ed59bd200e85d19cda53cfeffcac617496e8c58b57e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697259991, "uuid": "8e0993e1-bd7c-4c13-89c4-03208fc91726", "value": "T1C67523429BDD886BD4703B3048F603032A75BEA5ADB043E7AB42C55A5EF3294D1B2777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697259991, "uuid": "94ae0f28-2e53-4d1e-9efa-409447409648", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697259991, "uuid": "39f71732-0ab5-478d-95e9-f76ad23bd855", "value": "49152:yw06kj40wPgL3jAHtg8JZgqhu/daCEWRx/jOv4wwQYiNY1T0:4/coQHtggk/daJW3/j4TNY1T0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697259991, "uuid": "37b55de1-cdab-4134-8bbc-5c6daa2422dd", "value": 1626112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697259991, "uuid": "2f89d94b-3223-471f-9871-1f6d3feb2459", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697259991, "uuid": "5addfb45-be61-4f4d-b433-e25a72e8f8a6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e34a200-6adc-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1697320385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697320385, "uuid": "33899cf8-5f73-46db-9a6f-999724ee6901", "comment": "Malware payload", "value": "fc4cf551b9c055b2748e4d36e2616d66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697320385, "uuid": "5aed8447-2ccf-47c4-8d98-47da9988a7df", "comment": "Malware payload", "value": "a315e10b7df980d692b47438c7b8f1cc12436774e1e8ffe36aaf29bfa53ff2a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697320385, "uuid": "0d3ab532-54dc-4ebc-8979-35e75fb4c30d", "comment": "Malware payload", "value": "998da62b649055eda603ba6cc2cbb304463dfe17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697320385, "uuid": "e292b5b5-2b24-4669-8f40-17b15c1e092e", "comment": "Malware payload", "value": "06fb55e2265e55f46982b23cc26a03bff08704d7804576f869abb791d1f7df4ac932980fce7d6d1c5da9dcf61a7d58de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697320385, "uuid": "cc3678ef-8f0c-48ab-b75b-86d07dc1b06e", "value": "T18615234667E84422E8B65BF01CB7036B1A327CD08D790A5623A8AD5E1CB36C4F57377B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697320385, "uuid": "49a469fc-29c5-4274-af61-18f6fb1d7bc6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697320385, "uuid": "5f5f82b6-6de8-463c-820b-459092426d35", "value": "12288:fMrfy90ElfnKiWRvPfAU/i4ArcsFshXetVjxRsitQB7bPgYG5IMdikvnTH6tu:EyjUtp9sFOezjfsitmtGSEJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697320385, "uuid": "e5f18dff-fe5b-4a51-aaab-0d23b4db6d98", "value": 897024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697320385, "uuid": "9b23d866-a3bc-41f6-826c-83a27b473065", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697320385, "uuid": "033ee73f-6df8-484b-a547-889016ec1f5b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8519d14d-6aa2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1697295674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697295674, "uuid": "0355e86f-93fd-40dc-8a9b-b85a6d115901", "comment": "Malware payload (Mirai)", "value": "e65288da2ba7ec64e15cb76db428e3d4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697295674, "uuid": "384f2702-3a36-4eaf-87b0-372e8bf0f384", "comment": "Malware payload (Mirai)", "value": "a3193e018afbb3a99395837b6f0757546c5d6c9967f0a96266f9a1658f66a95f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697295674, "uuid": "c62bfbda-5210-4d1f-bb9f-f95cfc6357d1", "comment": "Malware payload (Mirai)", "value": "52aba6d56c22ae7082bfa9795a2ccb8219bc4318", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697295674, "uuid": "74cd5138-37f0-456f-8ff6-5441e864ea0e", "comment": "Malware payload (Mirai)", "value": "8b82f98e98a3fe49cdbe4654e8d65790b15f15e58f76a6f7a4bf994c0d8f72b8143547a69685b2f74142df92eb2725bf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697295674, "uuid": "221b5401-96ec-476e-b255-6f7acdeaa3d6", "value": "T1E1833925A87A2E27C0D4A17E12F78711F1F6320E14B4CA6D7D760F8EFB54680A55B3B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697295674, "uuid": "9a063d6c-2758-44c3-85a7-11bee638c720", "value": "1536:y2mMa2NlYeVHfsy7WedwWbPd16CVUhboIdUR2U:DN7ntbPd11VUhbBUN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697295674, "uuid": "9fc3bfc4-55d5-4fba-b8d6-3d4987fd1b23", "value": 86688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697295674, "uuid": "3c50c5af-b2c0-4475-86f9-519fb8697c3f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697295674, "uuid": "d2858aec-235d-4cb3-8fa4-31193a7cdd0c", "value": "e65288da2ba7ec64e15cb76db428e3d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "832a3f8a-6ad2-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1697316287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697316287, "uuid": "77754fe4-41cd-40a2-992c-bb24ae419122", "comment": "Malware payload", "value": "a9e28f93dfa56ad1849340dd937b3743", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697316287, "uuid": "58bc98ab-a3eb-4b66-b499-9b6a86338adc", "comment": "Malware payload", "value": "a3738bb20fad0a7d07afc9fa0b666b10351da248ffc10d3f983282d27c8aacc1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697316287, "uuid": "274bb297-b44a-4d79-9fa1-581a6af53d7e", "comment": "Malware payload", "value": "e18b8761ef8dae1162797ef38c7d48afd8378701", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697316287, "uuid": "331be670-d02a-45d7-9dfe-29795f63bcbb", "comment": "Malware payload", "value": "516aa2e62df277cf447dc32060dfb1118f718fcc53a4e39fa0e889d9c3b042ccb656def1abfc2dcb43be544d91780ca0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697316287, "uuid": "404242af-29a1-4f19-a914-edd415f0af04", "value": "T1A515120296D89476CCB10B3198F652D30E36BCE28978932B1740ADAD5DF3BD45236B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697316287, "uuid": "d6f6b380-55df-4c85-acfe-3f68ffc30f04", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697316287, "uuid": "8e1d6f14-3c2e-418e-95ad-8b41fad1ae4f", "value": "24576:AyGkwk3uY64QOJuH9ElgLPbKFmh2rCE3Lbm:H6Y6dH9MgLbK+2rCMb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697316287, "uuid": "3c4d65a1-1583-44f5-a703-09087039d6b4", "value": 898048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697316287, "uuid": "dfd0f0fc-b434-47fa-b265-ef5d66e11eca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697316287, "uuid": "ff58bee5-f4b0-44c5-b27c-905dc479066d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22326ee6-6a5a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1697264584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697264584, "uuid": "244723ba-563a-4930-b0a9-77b1bfab2033", "comment": "Malware payload (Mirai)", "value": "5a0182124235dea987bee9023a496078", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697264584, "uuid": "eb5d1b40-4ed0-46f4-8952-54f775aeb5cf", "comment": "Malware payload (Mirai)", "value": "a384a4b898998b0db2144da322be5a32556dc1b23e8a63751c13c6f606d1a398", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697264584, "uuid": "e2f18556-a1f2-47a5-ae6d-e0e1abb501a1", "comment": "Malware payload (Mirai)", "value": "a10f22d4c99a8e8eb1507529b02e98b52763a75d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697264584, "uuid": "d7e789d8-09b0-4965-bbd4-7f698056f511", "comment": "Malware payload (Mirai)", "value": "db41a68f1fe795c1897f5c177b7bee55561b9ec24e68f851fe424d697117d5ece8e2cadcb41ddfba51aecb5a62b97af7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697264584, "uuid": "1aaf07c2-89c8-45c3-b17c-06840eefc683", "value": "T1CC639D76D419AC94C4844338D4E24B792BA3B808C3771DB6AED585BA4047EFCF9193F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697264584, "uuid": "c21d322e-9747-4076-90d9-b22b510455ff", "value": "1536:2ap37YpmCFqhhlDwtkbGwYtB9wh/NtXxI+9vDz2Cj6:2As0CchhlDABaIYvDz2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697264584, "uuid": "b09c4894-3e75-404a-ac77-2fdbded65633", "value": 72272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697264584, "uuid": "46dc6edf-1e11-46b2-9d4c-8a0c59f95264", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697264584, "uuid": "d1b4fac4-1855-4a4a-9a57-44f8a313903c", "value": "5a0182124235dea987bee9023a496078", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "044e5113-6a46-11ee-a6f9-42010a9c0055", "comment": "Malware payload (LummaStealer)", "timestamp": 1697255944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697255944, "uuid": "420e88ae-12e3-483f-958f-ca55df948279", "comment": "Malware payload (LummaStealer)", "value": "f7f4c10dd56dd175ed57b936d3ae87d1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697255944, "uuid": "3cb9ae6d-907d-4ef3-b2cf-748f9b63317d", "comment": "Malware payload (LummaStealer)", "value": "a39eba51e56a3038058473c7d625e3331961938985451ff4120a518a80fa09ce", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697255944, "uuid": "fa6663db-1453-4008-b7c5-99a4a1d4ffc2", "comment": "Malware payload (LummaStealer)", "value": "df2c485537f84ab875071c431a21f2cdf477605c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697255944, "uuid": "53c3ed8f-458b-49d2-a508-96e435982df8", "comment": "Malware payload (LummaStealer)", "value": "e48fce42a8393a4b9aa550c608f3f15573a4d19f495521feae7523d239cd78fccdd229a1430d51f489be426c2f3c423c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697255944, "uuid": "8a3ba4e0-307b-46eb-8348-0e0424fe4335", "value": "T11936E724C319C926EFA34D791F619CE41E2028E59302FF1B1BFD3A34C8D466D15AB66B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697255944, "uuid": "7a5af49b-0e24-4614-b8a2-191f09725805", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697255944, "uuid": "31a9be71-4187-49c4-b30d-cb40ac5f4823", "value": "49152:AHPWfQaF8DfGXbwtsEvV/g/sY6UXKGJmHyQRXZM:AH+gtsM/CqqmHyMXZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697255944, "uuid": "fc5b121f-f8fb-4f34-9c63-e8ff1ff10dbb", "value": 5097472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697255944, "uuid": "b6bad086-6231-424b-a7b7-3b8a149bf176", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697255944, "uuid": "177b535e-8751-4c74-9b99-30fc11ed095e", "value": "f7f4c10dd56dd175ed57b936d3ae87d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fc4ab4a-6abd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1697307127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697307127, "uuid": "7376418b-90b8-40df-9c18-424cd20c9725", "comment": "Malware payload (Mirai)", "value": "178af03a9f236f52a72f0e2fcace9047", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697307127, "uuid": "5586fb8f-da52-4d5a-a4ff-12de017fa404", "comment": "Malware payload (Mirai)", "value": "a3e5667528ea608051998134a63e55c1618dca99de3651b7cfdcfb35dbd18ac0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697307127, "uuid": "05557df0-889a-42be-b03e-377e5db2df64", "comment": "Malware payload (Mirai)", "value": "c40faf92b262093c95efa14321197b46c6563cb6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697307127, "uuid": "75fef41e-7f58-4035-b412-5f1822755852", "comment": "Malware payload (Mirai)", "value": "59601b6e4e0e8b42b52f2bebc4f89c9296e8c998a35fc5ae3071a0ad7d124650678e775305009b1985b07f13fc72478b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697307127, "uuid": "3c8b5252-c44c-4457-bda4-e75cfe96f525", "value": "T15E633B36BEA11D27C4C9547A61F30325B2F5478B28BC891A3DA20E8DBF74A9076537F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697307127, "uuid": "1e89aac5-8dda-4204-ba5b-a6f374306689", "value": "768:4TO974SS11QQgUBfWZSTYBO+lM5Vb/llMj1treqoIK:NS1FgUBOZiulM56tvot", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697307127, "uuid": "ad1792dc-d22d-4fe4-9338-4d2b3e5f418a", "value": 66856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697307127, "uuid": "93dbe8ce-193b-42b2-a962-b69cc976cff2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697307127, "uuid": "c24b8d2b-ca50-4913-8273-7bc0134ae443", "value": "178af03a9f236f52a72f0e2fcace9047", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec670ad3-6aaf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1697301431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697301431, "uuid": "149d3f33-3c61-4de0-af8b-01973d3c1f8a", "comment": "Malware payload (Mirai)", "value": "c3130e2bcc0e7454503580fe8b84934b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697301431, "uuid": "6323ccd7-c1ff-45af-9d8a-1feb03a34612", "comment": "Malware payload (Mirai)", "value": "a5ea4162fb85a409f1f42706da0fd5ea37530cbbfa4af02d389132b256313266", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697301431, "uuid": "39428a68-58fc-4176-bd31-234f67812778", "comment": "Malware payload (Mirai)", "value": "f1db3e12e7b593c6aa519f89355556a9949909d4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697301431, "uuid": "83f1f6ef-cfa3-461f-8dd4-28ce0d2b0852", "comment": "Malware payload (Mirai)", "value": "0be37d989de3a19b1b48085c0d9ad58a92826918a5304c1ec671477a41bbdb77f0c2748cc6d7bd7d198c16b1eb57cca1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697301431, "uuid": "ce64579f-0db1-4ea8-a520-97b692c1f8fa", "value": "T1EB539FB5C5A8BD99CF698278B61488389723900565E33DFAE741C7A6D00BEECF10D7B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697301431, "uuid": "515104a9-8aa5-43ab-be4d-3c09bf745cb7", "value": "1536:B/bivQhunGauwt4IduhosjT1RYeycfs3QtLok1cY3CJpa:BjiBGFOdOT1Rhf+Kn1cY3H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697301431, "uuid": "5acb0c73-27bc-44b3-bc0f-623ae0a95343", "value": 64348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697301431, "uuid": "8132ddf7-0a80-49de-8fef-09fd60ce8337", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697301431, "uuid": "1bb16155-8e62-4204-9913-fd3563d62d64", "value": "c3130e2bcc0e7454503580fe8b84934b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d976806-6a36-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Heodo)", "timestamp": 1697249276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697249276, "uuid": "7822403f-cd93-4667-9e44-9ecf2d2761c2", "comment": "Malware payload (Heodo)", "value": "85fd43751333aa5d3b831d3d2fafebb7", "object_relation": "md5", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697249276, "uuid": "e6f33cfc-da43-4c84-a1cb-649bd928b151", "comment": "Malware payload (Heodo)", "value": "a69719f8d5dd3a3725521d32e16623be5f39aa5731a12061cb3e08793c2c66ba", "object_relation": "sha256", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697249276, "uuid": "475d77bc-62ff-4328-a322-bff67a822e00", "comment": "Malware payload (Heodo)", "value": "fd6e3b35b1059108d92d34660b0c54205d39529b", "object_relation": "sha1", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697249276, "uuid": "fade0f38-909f-4656-9c51-cc4d14f6cd36", "comment": "Malware payload (Heodo)", "value": "13801b6bdbbdc2dec9cb16a29f1014e054945d0357b08e05d43681398aca90aca59de8d4760ff66b16f4f612587c9db6", "object_relation": "sha3-384", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697249276, "uuid": "d2871278-d66b-430a-9500-6212963effda", "value": "T13635126036C9C536D6AE163784BB8B642A26BC361B35D0CF77943D6D9D302D3AD38346", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697249276, "uuid": "bbef2200-cc3e-4b81-9030-2deeb318c576", "value": "24576:+tncpVGPS3Hj74zrIbOCFd7m1+DfxQSSTooZVwn3/V4XCAXBv:DpUPS3D8zEbOw7m18ZptMCK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697249276, "uuid": "69e2bf39-4620-43f2-b1f9-c4b40dccc263", "value": 1163264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697249276, "uuid": "0b8fb6f1-dd6a-4e12-80d7-786db2b6dbf4", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697249276, "uuid": "9021081c-d319-4bf7-9914-5d89e5059d7d", "value": "abb556b6e45931b1e27b40f9f5f610dea7c4e59c13a4299899b022d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaed7d7b-6a65-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1697269646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697269646, "uuid": "bdb78d22-93ad-40fd-9901-2d8838637e2f", "comment": "Malware payload (Smoke Loader)", "value": "d119bd538e6eab346fc9c5841ed25785", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697269646, "uuid": "e8daa607-5d2a-4838-a536-54a8934b9fe9", "comment": "Malware payload (Smoke Loader)", "value": "a79a91f607c7dd7864ac1021f6b66e64ed578688b03c04cd706c6a7b32376242", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697269646, "uuid": "6d911b3f-f705-427d-a73e-2a222cf1db06", "comment": "Malware payload (Smoke Loader)", "value": "a5e2d726a8ae23c1e901dfd364e97276b86848f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697269646, "uuid": "d4b71f95-943b-4fa4-a778-3eb39fa1e571", "comment": "Malware payload (Smoke Loader)", "value": "16a725740076453ae19055fa3b049451e971be116dfebc564579da2a1158858d5f9da0ef7e0b1c9535b38dfc9739b7e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697269646, "uuid": "7a462ebc-b3ad-4a4a-8b53-6fc8a13c9f64", "value": "T1FA7523529FD84832E5B59BB058FB02130B737A65AC7503867B8739DD0D736E488B236B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697269646, "uuid": "ec94fd04-cb5d-4904-b6f4-10ddfb2e8505", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697269646, "uuid": "06527280-d4a1-4b79-92df-75ab1f7f2222", "value": "49152:QHG600AyYqUs/0vxHzPZgAhQ4aaXjaRpp7dR6XOSwzh:2rArqevxHVu4aae3T49wz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697269646, "uuid": "e12fdf6a-704d-4b33-9ce8-ea80ddc1340c", "value": 1625600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697269646, "uuid": "39b3b1eb-5f73-491d-b659-c68123d8612f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697269646, "uuid": "ee966dde-00d5-45da-8299-889c3ae4feec", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76c617de-6a36-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Glupteba)", "timestamp": 1697249264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697249264, "uuid": "3796aa6a-b3e4-46ed-825f-4e7ef49e3aa5", "comment": "Malware payload (Glupteba)", "value": "aef7291a66ff41e90aacbcf954f06a12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697249264, "uuid": "d86905d4-20c2-47ff-8958-84e9deb36356", "comment": "Malware payload (Glupteba)", "value": "a8fa0f3fc329d7dc807d49af679fcfea9d573bf965482632b34a0b730a87a4f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697249264, "uuid": "efe19ddb-126d-4e73-bbdd-eeff7670e192", "comment": "Malware payload (Glupteba)", "value": "77c3186dfa8ec98f1ca06e94ef6dbf0c5c0d42aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697249264, "uuid": "48305852-0d16-4270-af04-3f932a2509f1", "comment": "Malware payload (Glupteba)", "value": "dcc07b1c1c2be15d7682e3a0de66279d677125dce4bcc28ef92c8acd92eeed8a17dd51ed86bd972719a7f2e9b20928e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697249264, "uuid": "5e0e68d7-f6a0-4d1d-ae72-e50e59107ddf", "value": "T16F05AC51E9BCE709E5FE4876997493D0B2326C33B202DA45DC8BB639EC6D1C39AC0D61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697249264, "uuid": "ee8e3597-912d-45d7-ab94-17c497ed37fa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697249264, "uuid": "2758a14f-1bc9-4039-be9c-650a2eb8bb82", "value": "24576:58YAHcHhjQg4p19x+s50bb96ZanuhOdD:58Y+cHh2p4y4B6ZOuhO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697249264, "uuid": "f8339fa3-f3f3-4789-9200-49b47a706d62", "value": 803840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697249264, "uuid": "50833541-0961-4245-afa5-81493356d23b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697249264, "uuid": "3d0a8953-6e22-4703-9ef9-1a9674c07e62", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8f17664-6a68-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1697270850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697270850, "uuid": "42979401-fe99-42be-a9b5-d7809bc6125a", "comment": "Malware payload (Gafgyt)", "value": "1b1e089285a8ee24e3c34ded1efcbff8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697270850, "uuid": "2397ef51-d117-4dd2-b683-ece929371369", "comment": "Malware payload (Gafgyt)", "value": "ab4ab97239ba7ccae207cf04d0f2016faf55b4a67210403931b8c5311a3af2b3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697270850, "uuid": "03433c0f-75bd-47b6-bb27-d9c9fbbcf58b", "comment": "Malware payload (Gafgyt)", "value": "46c0e6b140c71593cc88de045a7a9af7d9f868c3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697270850, "uuid": "b121c594-3bfe-4546-82eb-be79cfc000e0", "comment": "Malware payload (Gafgyt)", "value": "27655849c663f1b48291739eb98052eb681e7f9db7c901214f33fe50d7ce21f0b3bbfafdb8c04240b6e675504b83d3c0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697270850, "uuid": "0a874842-968b-476d-95f3-f9a985dabf6a", "value": "T11CC33A49FD829A22C2D613B7F66E018C372513F8D3EA72039E225F25778A45B0E77A51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697270850, "uuid": "917da817-3e35-4700-8ad3-7554720a5b55", "value": "1536:6+useqiyeK+G5CVZ7+fuF4uWMna1kbETX1zRJmtqJ3q8f66T44zLbOjpwWu4PXZ+:6+uszH8vf6k+1zR0ti6Szi5BwbZnN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697270850, "uuid": "d26e9086-a73e-45d2-b0fa-e761cbc1a5af", "value": 120492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697270850, "uuid": "ad9e2944-f3c5-412e-a3df-b025cbb29f4f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697270850, "uuid": "45c30cdd-96ef-449e-b2dd-b98a7d679c61", "value": "1b1e089285a8ee24e3c34ded1efcbff8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a84fbad0-6ac3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1697309907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697309907, "uuid": "d74ff920-f75c-4250-887a-ad6c7dba3264", "comment": "Malware payload (Mirai)", "value": "588fb5d51cbc2097b65ad0473f2e16be", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697309907, "uuid": "38e0ec39-fc1f-40c3-8d0c-e98364ea249a", "comment": "Malware payload (Mirai)", "value": "acbe2d48b3e1492bbbc544d699db35860efdce8cf70eaaf4326e142a499f2cf5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697309907, "uuid": "031c1c79-5fd6-412c-bcb8-55704538b877", "comment": "Malware payload (Mirai)", "value": "65c754d58c150067641689a73e7e124fa936e17b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697309907, "uuid": "f17c9558-549e-452c-8378-6087cd870726", "comment": "Malware payload (Mirai)", "value": "66f07df5e302c186e68ccd43b8f74abcafe01c02e988f9c649c1a876de696426da60dd2911bb14d5ef0b11e5936fbe16", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697309907, "uuid": "81cb7ae0-0cab-4dd9-a8dd-62b69acdd20b", "value": "T109331A85BDC19A16C5C1917BF71E43CD772B5398D2EE7303A9299F2173CB99B0E2A101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697309907, "uuid": "8701ad49-8947-4e1b-996a-c4aa6a656964", "value": "768:XEM92cn8tVAgXfht5pB7QtSgLfzU5AycVzwQM2l/bmrjbl9uR1A2bxI:/2s0t5b78SgLfA5ARe2lzuXlYRjbx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697309907, "uuid": "34fc5b03-8ea1-4cfb-8ad9-a683d68249e3", "value": 54568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697309907, "uuid": "7a3b882c-c2ab-4b6d-8c00-91784506ba94", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697309907, "uuid": "958f9447-1f1e-453c-9bc6-bf181a05d33a", "value": "588fb5d51cbc2097b65ad0473f2e16be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c07b6373-6ad1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697315960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697315960, "uuid": "a79b164a-a665-4546-99cb-17728d434426", "comment": "Malware payload (RedLineStealer)", "value": "c04ebd34754cad3e4c6a20175aa58dd4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697315960, "uuid": "93a402aa-1753-4673-b357-1a09fd5744c5", "comment": "Malware payload (RedLineStealer)", "value": "ad9036440334fca8e65a7c04a8a8a0f5ca8f9cac902885bf37e1fa04853b7ca1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697315960, "uuid": "8937eaea-5f0a-4716-baf2-d101664ad882", "comment": "Malware payload (RedLineStealer)", "value": "46a11d1928b2304935c982bc9d5ad9a04920e53a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697315960, "uuid": "7dad55fd-8432-4629-9e49-1db4dc801f5c", "comment": "Malware payload (RedLineStealer)", "value": "f9053b14a57ca7bd92ad2da4adad10d19a15fc3aeeb3376daa6080f2c32ea3e2e8142938df8674d1994a638108eaf1ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697315960, "uuid": "7c31d9e0-4dd2-45e6-aa56-2df7c218162a", "value": "T1D2345A9366D0FC61D81647339F1EC6ECBB1DF560EE496B662218BE2F1971272E263304", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697315960, "uuid": "1374a885-f03d-4811-a601-651c48ddaf77", "value": "926dd17391512bf392950d0d8eb6f29f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697315960, "uuid": "ce5274c0-b188-48c4-a379-d0f60e2080cd", "value": "3072:p6XTuQHCSrZv4mfvJi5QIwTpLXKjZF0DLB5L8z1TAfWxzY:cuqCs4m5i51wFEL28z1TFz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697315960, "uuid": "4fb0c3ad-1fec-42bd-81c2-e10816af73e6", "value": 245760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697315960, "uuid": "bfc7d3d1-7d24-4aac-8f72-5af45354282f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697315960, "uuid": "baecf33b-6c7a-4eed-9414-90a626112c1b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f22d593-6a74-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697275827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697275827, "uuid": "2c10b76e-142f-41cf-8c62-2ed4ac546c8b", "comment": "Malware payload (RedLineStealer)", "value": "9b9f7d15b36027928f3bf3397139eca3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697275827, "uuid": "52514e98-ded7-4989-8c09-50ec08da3f49", "comment": "Malware payload (RedLineStealer)", "value": "afbd517384e9adfd9bce9acc13e9096ba0e5212a64c50a0b0e02b542d67eceeb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697275827, "uuid": "2ca7a325-38cc-4890-be70-f1e192f7b303", "comment": "Malware payload (RedLineStealer)", "value": "cc3816b1ab8a4fb9518aa28550bf2fe718d1c305", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697275827, "uuid": "d2a09144-9ef6-4a88-9798-a93ee20fdc36", "comment": "Malware payload (RedLineStealer)", "value": "ceea3701a8c9752b72d751804ea188b4fc532bbc30e2d7a0fbd71a635cf9491e96f14744b711b9aadd99e9da8290c969", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697275827, "uuid": "7f9ddd10-bd80-48e2-99ff-3cc3263d20de", "value": "T14E345A4362E1FC60D91A47738F1ECAECB71DF561EE496B6622189F2F16312B2D253B10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697275827, "uuid": "358a15f6-4f46-4a51-8b2d-30932e3dc3f9", "value": "c28395a853011e8d0c47586e839f95a1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697275827, "uuid": "09b343a2-017a-46c1-acad-16702c56e746", "value": "3072:kRRUbohxRxftJf0S+izhjwPl6yBtwrW/IUHRwLcBpZCSQ1O5E/t9vxlWL:Kmbo7VJ9jJwn2r4IUmLmtU/t9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697275827, "uuid": "95afa485-74df-4dc8-964e-4d9902b5fa2d", "value": 244224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697275827, "uuid": "b8d1a7d1-17a5-4a20-b156-9fbe3d0732fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697275827, "uuid": "fd9b8925-dc62-4919-912f-52b97bc2aa54", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80f25913-6a63-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697268609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697268609, "uuid": "c1d8c20d-492a-4f39-83f4-df2f53372580", "comment": "Malware payload (RedLineStealer)", "value": "176229c36e7a4e9c452aa0fa8aec1d3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697268609, "uuid": "a4b396d1-325c-4b3e-9043-38e5a7055a0f", "comment": "Malware payload (RedLineStealer)", "value": "b0ced9f723960ba2689be522dcae0d65e42252fa830fa27ca90effd46820d856", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697268609, "uuid": "13a0ce21-52b6-4ecc-893d-f1f1f604fc80", "comment": "Malware payload (RedLineStealer)", "value": "9a2929f81d62fe1b5234c8bef6f80db767b7a5f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697268609, "uuid": "d2fc1f7c-a313-45d8-b2a6-94306bede155", "comment": "Malware payload (RedLineStealer)", "value": "700a19dec8f1ed2901e5f1ae680b4a8d23784672eee80fab1fa43d403524a12db1f64548635ccb941c9bec87a04f851d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697268609, "uuid": "47b3774f-a5d6-4eea-9aca-dc2ab6c587e6", "value": "T1AA049E9270F8C4AFEA56E67B84E1893C49D9FC7807664D4B7F8C52EE09240F1A72474B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697268609, "uuid": "4901e5c7-a850-4f1b-8b10-9c5dc1d01de9", "value": "fec5e3ac8231eb123a87c533e215da11", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697268609, "uuid": "3df8963a-21ed-41ee-b46a-10d2b046efb0", "value": "3072:clmNQkFpfQBvQYdPy8fLFScwnOE8Cc1gGowCMj6XF+osAMKWxiMZYY8+BTj:wmmkPgowfQ8JCpwoeKWxiMZYY8+Bn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697268609, "uuid": "88a3444a-f813-40fc-b8bc-f3fc1a003a18", "value": 187392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697268609, "uuid": "cd5fd80f-8401-4b97-aa9e-4ea705abce06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697268609, "uuid": "832f05ec-7738-48e6-a275-52a689ca7a1a", "value": "176229C36E7A4E9C452AA0FA8AEC1D3B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6de020b1-6a68-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1697270724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697270724, "uuid": "f55d9a02-5398-4d62-8516-3248a8205877", "comment": "Malware payload (Mirai)", "value": "2d114e303a2fc58b647883c6d02ad172", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697270724, "uuid": "107d64c3-159c-42c3-9571-ba833451e7b5", "comment": "Malware payload (Mirai)", "value": "b0e67f73527a7e293877c5de7166c7eb05b1e7b61cae7d7c9a8dc472b2fd555c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697270724, "uuid": "4451d061-11f6-4627-b21a-7ded76463742", "comment": "Malware payload (Mirai)", "value": "662ff5b42076beb29fd372081c25e389b5c321fb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697270724, "uuid": "016466d6-af42-4389-8379-508203a37451", "comment": "Malware payload (Mirai)", "value": "5e008c01930d97e0b942b5f4e2058fbdc7273979d465db8248b16a0dbf12d79a5b85c14fa433f16f0947f53a3ae375e0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697270724, "uuid": "2f017fad-f6ea-4599-9863-f8b20e221086", "value": "T1D2D36B72D836AF58D564C170B0748F783BA3A59081871FBB29E3C2759047E8AF549BF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697270724, "uuid": "2f0a83d0-df3a-4f8f-bda0-4c27d2ad4af9", "value": "3072:365CYXMuiancwCOCqikO5IUsWQ3LnnJ4QwbZnN/l:36TMuiaLCOCzNFQbnnJdwRN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697270724, "uuid": "bc123440-fbb6-466f-b2f6-cfa235aba898", "value": 138464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697270724, "uuid": "08f0cabc-3264-4e1f-b93e-a953bcfda419", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697270724, "uuid": "2a4d876a-e6ef-4d8f-9be7-2a010f6226cc", "value": "2d114e303a2fc58b647883c6d02ad172", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ed4f5db-6a9f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1697294429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697294429, "uuid": "4de2915a-e4fd-4b39-b1df-2579c1d05c0a", "comment": "Malware payload (Smoke Loader)", "value": "12f93bf8533a3785b8a086f1a2290601", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697294429, "uuid": "89b1afd0-ece5-4f4a-9479-b8df5a0716d7", "comment": "Malware payload (Smoke Loader)", "value": "b21c893c9c411160bf2bfbd1df40247757aec2d9606a9a4e873ebd36ca2b7904", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697294429, "uuid": "868ec29a-385e-4f39-b8c1-70d4b6142645", "comment": "Malware payload (Smoke Loader)", "value": "2a2cf9109da07a60db6adc7c9d907a16ee348bad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697294429, "uuid": "d989f1a3-cab2-43bb-adab-763ac0c7bc96", "comment": "Malware payload (Smoke Loader)", "value": "9831db662d3ff38db04ad4856238aae3f6bbd58878ed93ea4eaba0825baaa3570f16c2e130a1c706bb76c470c3e64f77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697294429, "uuid": "dcde8e83-9b52-4628-a204-e677843cb6f6", "value": "T169346A4366D0FC61E91A47338F1ECAECBB1DB560EF596B5622189E2F1971372E263310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697294429, "uuid": "e439e4eb-825a-488a-9724-219d1c322ec3", "value": "f521864df4943f912ba65d6169a61f62", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697294429, "uuid": "f4c36ea2-0e24-4b69-9510-359c17768c25", "value": "3072:eKhpwVR45X9hNiGV30kjgIjq2abR7kxg5il05bptJ+jRu:JpwVK5X9HNYxbFAiptq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697294429, "uuid": "df164a74-04ad-480e-bae5-e73970a4b0d6", "value": 245760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697294429, "uuid": "91bcc924-931a-419d-b2f1-822530c29508", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697294429, "uuid": "fb4538db-cf20-4187-8296-8d4d6329fd55", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf403272-6aaa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1697299208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697299208, "uuid": "0db3c246-4f1b-464e-9131-b2d02c95d8da", "comment": "Malware payload (Mirai)", "value": "93807c5eb8d675aab4c10cf2016bdb1f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697299208, "uuid": "2f7b46bb-4cae-44fc-82a2-49e49a0fec7e", "comment": "Malware payload (Mirai)", "value": "b21cdd6edb4cd8094772ca92d5c3cfa6144bc0b4dcf40f6f6560b149f70c82ab", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697299208, "uuid": "9b1c7fd6-876c-47c5-ae32-ae0ff8bc3bf3", "comment": "Malware payload (Mirai)", "value": "cae03fc228a35e7b46009c216deb9d977fbb3061", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697299208, "uuid": "644cb712-2dd7-4f34-96f2-6d0eefbdc754", "comment": "Malware payload (Mirai)", "value": "a9b3c1f6935da7ad15634657adb7a940f95a763de7b354db338e66832da0f188d5c45f2f69950cfebfc0885ada0b7de7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697299208, "uuid": "0654d094-a4ef-4966-8858-6c2033a06fe4", "value": "T194C2D07428056570D370063DFFAD86875BABD1F482F8321219501AFEA64B487B9B778F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697299208, "uuid": "98166085-dc40-4dcb-945b-be2d8ce04959", "value": "768:4RSa8ZS/L6rze3OXrFKg9KZrqoDujZrbXs3UozYU:eSjFJXZBCJDujpbKzH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697299208, "uuid": "7fb26f05-dd15-4d3d-b477-c3da9cc94f3a", "value": 26292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697299208, "uuid": "937c711c-f302-4c3f-a465-dc1e2d7075f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697299208, "uuid": "4983c6ff-c4ea-45b4-87e7-17be517d666b", "value": "xd.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75c0cdc2-6a68-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1697270737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697270737, "uuid": "532578e0-af81-4d89-beca-f4d7b06eb436", "comment": "Malware payload (Gafgyt)", "value": "52dbe4a2d44c5d444cdb553b1b51e7ab", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697270737, "uuid": "d6f285e7-448e-4468-b349-f93a84575741", "comment": "Malware payload (Gafgyt)", "value": "b299c81198beb815c5a6563f2d3da9da4ac4864dbacd8502bd93a9993c3d1130", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697270737, "uuid": "3f16763e-f2d9-4378-8130-fbb8c13fb409", "comment": "Malware payload (Gafgyt)", "value": "7edcc79b5767e25334f64687812dbc5113452f91", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697270737, "uuid": "823d5b88-8dc5-45b1-b69f-05838a5d64c7", "comment": "Malware payload (Gafgyt)", "value": "50a4f45279d27cfaeae8731b13077a3403a31ea26d06d672ddaa465e94afa4dd76987003b7bfb2fe1e721b64e8f59e38", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697270737, "uuid": "dc835918-a8b6-4c8d-a6a8-e935e15c615c", "value": "T10DF3E806AF210EFBE8AFCD3712ED0B01359C998A22A47B757570C858F54A14F56E3DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697270737, "uuid": "8f07d969-6498-4fc0-bb95-fabcd8e42f9e", "value": "3072:bEXrgVqaLAOu6ZRid1NX5kglluswbZncf7:byrgVqaLRgNXvLnwRc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697270737, "uuid": "1cba7df2-c498-4a29-a494-90abda050927", "value": 160540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697270737, "uuid": "64bd6700-5ed6-4837-b326-5265e119aa2d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697270737, "uuid": "7263d400-c806-48db-8289-5a77a07bb76f", "value": "52dbe4a2d44c5d444cdb553b1b51e7ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc7ee84c-6a6f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697273970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697273970, "uuid": "3ae4002c-f544-456b-91ac-15cb95c5e69e", "comment": "Malware payload (RedLineStealer)", "value": "8fcb7efd32f759d91c29944e0af809bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697273970, "uuid": "a007b6d1-0b20-414b-a8df-eecafbb31fd6", "comment": "Malware payload (RedLineStealer)", "value": "b29ce1fb0e867bdfd5f4da18a9a8bcc6c945345d69cba935b43ff6e2facaab36", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697273970, "uuid": "9ce6f89a-0d2d-48be-8381-f2ea8fb416b1", "comment": "Malware payload (RedLineStealer)", "value": "45e6321bdd68d3b7255cfc88565ec05817808352", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697273970, "uuid": "0df2a137-6ff4-4bf6-81b4-07f734953159", "comment": "Malware payload (RedLineStealer)", "value": "5622c25dd28aa592d57a6753cf173d84fcdab7c67a996d29112899f27a3a79ab2a195a1418008f2851f580e5c69e62fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697273970, "uuid": "e1f7a9e3-3cf9-4d45-86e6-885668abf488", "value": "T1AC752312AFD08876D9B46B301AF343D32B387D21DD38D3A2AE5678095D713949272B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697273970, "uuid": "4f6b7e33-e52b-499e-9dbf-dfdf56b0df25", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697273970, "uuid": "656d2460-3beb-4117-acf9-ff62869e693a", "value": "49152:gbNcupKkckHvE62ZgXhvDBqkBtrVW7gCYD+3xkG:2NPQk1vEbqD46W7glShkG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697273970, "uuid": "aa3126d0-67b0-4c62-b4de-10ad7595b10d", "value": 1626112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697273970, "uuid": "9e17cf0e-7530-4ff9-9942-233499b93429", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697273970, "uuid": "c1dc2200-dad5-452b-84e9-dcf0b7d001ab", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f15f081e-6a2a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697244316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697244316, "uuid": "acc39160-6ced-4ed3-b8a4-fa5af1fa0b1b", "comment": "Malware payload (RedLineStealer)", "value": "169c5334636189897a4ad1a1a66380ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697244316, "uuid": "a7afa587-7299-4c65-9694-0b84802377ea", "comment": "Malware payload (RedLineStealer)", "value": "b3ae9f4bd3275c0fe16058f809ab21156dcd3c83d74102ce555d22456d4f2bcb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697244316, "uuid": "934c0ff5-e981-4348-bba8-6db9b7b60438", "comment": "Malware payload (RedLineStealer)", "value": "b9210797b7cb25c3e2a0e7256e5ea6e34681bcbd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697244316, "uuid": "7ebbf639-7668-499b-b75f-aeb7f1f49acc", "comment": "Malware payload (RedLineStealer)", "value": "c534f9c6de6240cd9ed918871e25dce33922d311d006770a2a7badc47ebf4d17e59b07941e4067441f6d0a39733c54ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697244316, "uuid": "ee7c89cd-02fb-4c8c-ad31-a0a0f7e16567", "value": "T1F9B4AF5434EF16D6D636FFF343992C8497EAF172520EF81A2F86168B912DF00AB02975", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697244316, "uuid": "8788f720-922e-4dfd-a006-295e3167b0bd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697244316, "uuid": "0c700141-31c0-40c7-97dc-59d0a099e09a", "value": "6144:NYPVDZscn2kxYPNfgYVfcl2pvxAItLi9Wz5rNMNfIUUujZoCFjf8/jk4S4/AqzLe:NCDZscgfdVLdlN2f3oCZojVxv95swE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697244316, "uuid": "12e9e2bd-3ba9-49c4-9d93-b91b31beae90", "value": 499712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697244316, "uuid": "b063303f-41ec-4da6-b11f-f89b4a069bb8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697244316, "uuid": "f0ce6ce2-1b85-4b83-b38f-a8e63c7e1fe8", "value": "169c5334636189897a4ad1a1a66380ad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cea0aa3-6aa2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1697295660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697295660, "uuid": "35c6394a-59a3-42df-a764-1e5e0880aab6", "comment": "Malware payload (Mirai)", "value": "95a5abb5de4b07cfff1079c20480d34c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697295660, "uuid": "94359c12-3b58-4d32-869e-d8bcba0bbc3e", "comment": "Malware payload (Mirai)", "value": "b86d9bfb9358d2e84dafeae343d9bd52f31d874f2e3072b31fcafa074ef360c3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697295660, "uuid": "ec189abf-8416-46fc-9a9b-18e24c990380", "comment": "Malware payload (Mirai)", "value": "52177a0216ee5efb8ebcc500d4634842a3b7f9ba", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697295660, "uuid": "1e4994f6-fdf5-4705-a013-3b3337271ee3", "comment": "Malware payload (Mirai)", "value": "10c3d37730f91221db1b3404037bf491ec0b49f5fd959f6f9c15f824cf7bd8697be94ecd4b8a71bc0e96493e0824269b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697295660, "uuid": "202b8d50-2f0e-4047-bd50-545ab14f660a", "value": "T13DE35C86EA408A13C1C61776FAAF414D3322A759E3DB73068D185FB43FC7A5E0E27646", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697295660, "uuid": "60c2a272-b330-4a00-b7f9-1fa4cbb7d015", "value": "3072:55hwGxF6QKUWXbGOYqpIpzJ8zYSW7cERegNafOJquM/9ITDL8l:jbxFwUWrz+8zYSW7NRefOIuM/9yDL8l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697295660, "uuid": "0f653d40-66b2-4704-a111-e8b433d8b780", "value": 157031, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697295660, "uuid": "38284c8f-7f7b-4181-bea0-51e2d1cc7731", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697295660, "uuid": "23110e72-ff27-42ba-acc7-1cbba1f09681", "value": "95a5abb5de4b07cfff1079c20480d34c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1ca5817-6a38-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1697250222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697250222, "uuid": "2f8d40b3-0257-4324-92f9-0c12e20f313b", "comment": "Malware payload (Mirai)", "value": "1ba49b4f6e27be55e43a0b906abe9343", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697250222, "uuid": "75738df6-b516-40ea-93f0-481bcfbbe85d", "comment": "Malware payload (Mirai)", "value": "b9ddad39370980407a98646a30a968ab6140ca2efa94f12c122558ae6ee4a37f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697250222, "uuid": "251d466b-34b9-40bb-ac14-4154d53f8908", "comment": "Malware payload (Mirai)", "value": "d5d9e00d832cdaa34c452cba020a2334750181f0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697250222, "uuid": "42f8295e-2c24-4b2d-86b5-855a8111a815", "comment": "Malware payload (Mirai)", "value": "3b474087c6825701959c3bdb9642a432d6d607f53c925d4ba3dd3d93c0f6a3ca190dd9fdbccbd1f92baa1581134fc80f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697250222, "uuid": "198b22f2-3b64-423a-9d19-9641c65a9479", "value": "T11D536A20AD792F2BC0E4F57A22F78724B2F5174E35A8C61E3D620E4EFF24640564B6B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697250222, "uuid": "69337469-4a05-4766-8b17-6c5873bf1223", "value": "768:SFE78ArMRXoZgFPO7Eq9IC705oIxqhhVqofeOgQHvtj/O+N/X4ls:Mc8Ar2XagFPOoSIC705oI2neOg0DCW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697250222, "uuid": "15c9f240-e722-4cad-bf85-762311f4baa9", "value": 64560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697250222, "uuid": "4d5aeafc-9995-4142-8b29-0e3a6feda206", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697250222, "uuid": "82dd1c2e-b6aa-4578-a303-d8eeca03a25a", "value": "1ba49b4f6e27be55e43a0b906abe9343", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c08cc6da-6a4d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697259267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697259267, "uuid": "074e62f4-7322-4814-a490-fc08a41d835c", "comment": "Malware payload (RedLineStealer)", "value": "5ca10fbb734494e8f9a9647fb3fbf528", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697259267, "uuid": "909ded85-c8e1-47d9-b297-22d092199e20", "comment": "Malware payload (RedLineStealer)", "value": "ba815374953dd7a3e960ce379c0d469c56b72f5d785b6282491f9f594a637e95", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697259267, "uuid": "2354a3b3-a502-4df6-84d7-811ca7c0e620", "comment": "Malware payload (RedLineStealer)", "value": "6a98f0fb189a5def21e29411d725b2bcfaddc3f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697259267, "uuid": "f1923d7b-4f0a-46b5-bd7c-a27c88504ca0", "comment": "Malware payload (RedLineStealer)", "value": "f1f26320f2ffe50a06c40f1dd83a091a91d14df735198d810972def13678d943f839734bd834dd617708cec781759d06", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697259267, "uuid": "78f8335a-60d8-4485-aff9-3ec6153396e3", "value": "T18D752383BBE4C472E5B1977080F702530B3679A05D7883926B86D49E4DB3690B5B3B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697259267, "uuid": "bde707f3-d6f4-4a60-96d4-251ee3040d2f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697259267, "uuid": "1377f32d-a22d-4a54-bb86-a60f36aa2973", "value": "49152:8RxbXF9vgC0zgTWAZg0h3DTaQKpfQ5qyE/e4MnGa:+pXF9vgHgTh7DTa1pfryEW4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697259267, "uuid": "b49658d3-a843-4edf-9ed3-7cab6bc93826", "value": 1625088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697259267, "uuid": "28b7a4b9-2a77-4efc-b00b-04bd89818adb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697259267, "uuid": "262d4aaf-55b0-4455-9e0e-4df4947a6093", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5023eec-6aba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697306170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697306170, "uuid": "894f8d4d-c211-45b2-9da5-334ef8b08de2", "comment": "Malware payload (RedLineStealer)", "value": "661ed54a3b1b1774d47b011611d1d9bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697306170, "uuid": "0aa34277-10f4-4a34-bfdd-a6930a2b7a62", "comment": "Malware payload (RedLineStealer)", "value": "bba50e5211dbe39d71812f552c7856a3960ac0046006cd0233616fd2ac12c7d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697306170, "uuid": "4e6babbb-493e-4472-94c2-b9e1ea37ed2a", "comment": "Malware payload (RedLineStealer)", "value": "51e3669e243a411478ffba5e1bf4ed1691374cd4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697306170, "uuid": "6a26876d-7e21-457a-a54d-13d6bd79399f", "comment": "Malware payload (RedLineStealer)", "value": "97ec1122897f690691b2b4dece674fe699eca6cde25c6e6ac2a0c3c0acb917fba224fc4e040aa2a95653df80e5be88a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697306170, "uuid": "7f4512cb-db8f-4cb2-ba87-2acd4bfda9ae", "value": "T1E8152316B7E9D5B3DDB43B7014F2538303327C529D74C32F1B49AC5E49B2AA069327AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697306170, "uuid": "576784f3-8584-4dbf-80ab-a56ee332d9bc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697306170, "uuid": "bc508d27-fc00-4121-83c0-c0573cf08c15", "value": "24576:tyCv+HCBlRQX4MLbk2TYSZFcijB1F2SJE1e:ICWiBoMBk2K2H1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697306170, "uuid": "04094212-46da-4f64-9b5c-2bc789bc2633", "value": 899072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697306170, "uuid": "6c6f32e4-b581-43e2-9a4c-e73a48157ac4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697306170, "uuid": "f4dbb663-e3f7-4bfa-b268-cb2a29658a36", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f16d2bba-6a33-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697248182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697248182, "uuid": "e6d4c05b-9871-41e0-bdba-59799a7c1545", "comment": "Malware payload (RedLineStealer)", "value": "85a5f22e3ab8d6df5d44d498cbdf776c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697248182, "uuid": "71676b74-6ef4-48ef-b7f9-9b608e9083aa", "comment": "Malware payload (RedLineStealer)", "value": "bbe13af8c1c06eae8044502415b90c979f2dfa61aaeb5391a62fc25562253cd8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697248182, "uuid": "9caf39e8-1161-4041-b07a-a8606faa733c", "comment": "Malware payload (RedLineStealer)", "value": "9d4818e1713d260cbe41a6a2f52d47b24e7613f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697248182, "uuid": "795e2604-6b82-4297-ae4a-8355bf472be3", "comment": "Malware payload (RedLineStealer)", "value": "addd60a5cde808883416f78a60b5265a0f64b90ed172ba523cb29c84f838e6fba200468b5892aa5ca7c41b89a42812b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697248182, "uuid": "00f203c3-e446-4e08-a6e9-059cc2f97980", "value": "T12F752365A7C6D0B1D0B42B711CF702130F35BD66AD78536BAF1AA8894CF15B0E1B236B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697248182, "uuid": "cd803f5a-d0ed-4b8a-9b05-84e685c4be5a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697248182, "uuid": "91779f4f-fe17-40de-82ad-76628404d538", "value": "49152:ez/1j2xylhpA9isvBKy3GMZgNhOJDaJNBhfGcBa0JREueKIhK0U:qj2IA9iJy315JDabBhfhNbkw0U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697248182, "uuid": "166fb8b8-dd70-4e0a-bab5-c158eab7d9ed", "value": 1625600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697248182, "uuid": "87a1d166-2cbf-4ab8-ab09-bc239fab30bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697248182, "uuid": "400c20b8-c1c5-4c2e-9e0d-ca4e498d539b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "000f00f1-6a46-11ee-a6f9-42010a9c0055", "comment": "Malware payload (PrivateLoader)", "timestamp": 1697255937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697255937, "uuid": "403ab1ae-d85a-47d8-b68b-9e4ae7f10de4", "comment": "Malware payload (PrivateLoader)", "value": "9f2721fbcc5f835a7dd623dc875937b7", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697255937, "uuid": "81405ff2-515e-476f-89de-4d3f083e8af1", "comment": "Malware payload (PrivateLoader)", "value": "bbfe892212b563f55273825e83c4e719e3fd408fdc609760223d1ca501f1e3eb", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697255937, "uuid": "09e2a77d-7d0c-4c67-8700-a11314a389bd", "comment": "Malware payload (PrivateLoader)", "value": "6754efe8281fb17677866277fc0a88a7852b0367", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697255937, "uuid": "78c8e011-bdb1-41cf-8beb-2d2097d01ffa", "comment": "Malware payload (PrivateLoader)", "value": "ac12790d0829ba0053b99360a28cd03b4ae766d00b5498ac271354b5aaf4bfcd77cb5026aa4cda695479a3d454d8629c", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697255937, "uuid": "cff5a9f5-b3a7-4316-a96a-75dee3788d37", "value": "T1DCC512993F8621FFC19BC7358192688FB9973B93FE6274891789A1240E313F44FB9458", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697255937, "uuid": "07a55e7c-10f8-4a9e-b2e0-f66a02eaf478", "value": "b5fd5c5a28970cfa1aef9750a101db08", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697255937, "uuid": "10610840-0c31-48e3-bb56-092b6cfd6db8", "value": "49152:CMrd91qiYkCPQHPiKkqY91+O0qJPLpY2G72q+b6juHEUPObu4VWc3EBXVA:xh9giYkCIHPigYPPXdq2e2JejfUPOC47", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697255937, "uuid": "9e68c2e5-7fcb-4e32-b75e-c8c9b5aae3f2", "value": 2730496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697255937, "uuid": "58077db5-ab6e-4246-9a75-c3e27929baed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697255937, "uuid": "06885529-a19b-41e7-9611-7682fa7ecb71", "value": "9f2721fbcc5f835a7dd623dc875937b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ac9b836-6a68-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1697270800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697270800, "uuid": "e69e24ce-3c97-4fde-851b-41f4b2a51b20", "comment": "Malware payload (Mirai)", "value": "df1c854fe0a0f314a4f3065f43f42c7c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697270800, "uuid": "6fe82940-92fd-4a26-815b-23a9e8a98463", "comment": "Malware payload (Mirai)", "value": "bc09d354ad77a392aa25bc3c32b3dbe0d483075028a5d739714e2b4e1e6b9816", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697270800, "uuid": "30b3b287-bbc2-4efc-8b4c-5cecf9179389", "comment": "Malware payload (Mirai)", "value": "ceb438f4207b95b34126472c55fb0f9db7350d61", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697270800, "uuid": "5aab7c68-33ab-405b-b4db-e57e6a11988d", "comment": "Malware payload (Mirai)", "value": "fa6c6fdd9fcd7b7c38015de7c501a86582801d2713c76d5e762f1f1376ff20b36fb621f18f1a33fa2a6fab027860a89f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697270800, "uuid": "8a0c0e3a-788e-4fb8-b227-c9e0853fccc6", "value": "T153D30999F9824F12C5C612BABA2E514D331217B8D3DF72139D10AF68B78B41B0F77946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697270800, "uuid": "06b77c29-4132-4d90-913c-d3e30bb3cdc2", "value": "3072:viIchIqXPUjx8a7TSv8zCzD4hDH3wbZnI:asq/gx8aXSvQhDXwRI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697270800, "uuid": "4e9fe394-0d3a-440f-88bc-40d80626e76b", "value": 132892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697270800, "uuid": "dcfab51f-61da-4e6c-bbea-ce04a3a09cc3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697270800, "uuid": "c8f8f620-330a-4de2-aac4-9c45790fd11f", "value": "df1c854fe0a0f314a4f3065f43f42c7c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dddf78a8-6a2b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697244713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697244713, "uuid": "80187066-4d76-42a3-882f-93351adb3195", "comment": "Malware payload (RedLineStealer)", "value": "abc285af9b33b49edcce2ff811fc9d57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697244713, "uuid": "d8382503-1475-4dd5-adf2-55593944fe57", "comment": "Malware payload (RedLineStealer)", "value": "c1ec7410e7c56049bcdbb51ca6df1bae2e8bc6d04ff8673c9e25d876f2d1fff9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697244713, "uuid": "a2f62dc9-9f9c-4963-9d58-f76302c4c195", "comment": "Malware payload (RedLineStealer)", "value": "92304cee748c64f43a39a6afecad502ffe7f696b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697244713, "uuid": "4e18c57a-098b-400d-a625-6151ebf5d501", "comment": "Malware payload (RedLineStealer)", "value": "e2102bbaf42039b4d5dfb74589065290e88eee4ee64a6a23d124fd6f191f042af6d8f3d106478c655a97b0313f905725", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697244713, "uuid": "bf9b27d7-bc27-492b-bf79-f078fa1f22b5", "value": "T1FA752352EBD08033D9B0677828F703030F75FD64996882773A95E0966873ADC71B5B5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697244713, "uuid": "6ce35c05-364a-4537-8494-792f8921ca2b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697244713, "uuid": "42fc9f65-084a-4ad1-8376-f8de931687a7", "value": "49152:lWtmredRia4yYGAiNOuZg8hsMWatVCiNFa6jn/QE/Rv:wIedRiakGAiNXkMWaSua6D/QQv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697244713, "uuid": "d3e49d94-6361-428a-9598-02d11498a915", "value": 1625600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697244713, "uuid": "de3ed9b3-92a6-4b52-9784-13d213df148a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697244713, "uuid": "0d411a6c-cb5f-48dd-a784-46a56bd3cdba", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "613368e0-6a2b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1697244504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697244504, "uuid": "2d986b3b-1645-48ab-8efd-92e26aa6a29d", "comment": "Malware payload (Mirai)", "value": "20712c66e46f17da509567d718e1aa9a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697244504, "uuid": "3b149d81-2dac-48ac-9abf-7aca4093c338", "comment": "Malware payload (Mirai)", "value": "c2a264da87eaec6cdea247dba517ba765d4b0ac3fb2320eb4d552759f1b849b5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697244504, "uuid": "44beb964-6ccb-474b-8a1b-66eef2b5ddfb", "comment": "Malware payload (Mirai)", "value": "94f98a0895240d3a95043d72b7f1ea70c1bcb60a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697244504, "uuid": "4a12e7a8-efaf-49a9-b578-28f772cf10ab", "comment": "Malware payload (Mirai)", "value": "f2fd27195a5da18f925138035cd2fdabead837b5834b3c816af7d7f435b810b559a3f9fa9c9c277936dee0fbf436bc65", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697244504, "uuid": "d02514a8-cb63-4664-895a-0aaf23ad73fb", "value": "T1F143AF32C86D6ED4C25D4278A9349F3C2B13D504A6971EF24E9A8A924047FFCF6493F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697244504, "uuid": "bf884739-e5f6-44b0-ad56-84acf9440df3", "value": "768:5/B04NLq+zKb5QmwDGajzQFSwtY8Ue6sedM+UvkE2LlrRQmCl3oxdfrJCuP+:5/qQLZWlfajfwtYdeldClrRzlxBJCuP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697244504, "uuid": "acd08101-7452-4e9c-91b2-b0698ae1dad7", "value": 56372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697244504, "uuid": "e5463d52-5847-4ff2-be1c-18406410a039", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697244504, "uuid": "0f03d3b0-1578-4575-a297-196815231967", "value": "20712c66e46f17da509567d718e1aa9a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "266a9e11-6ade-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Healer)", "timestamp": 1697321285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697321285, "uuid": "1f67c168-93fe-49fb-abcd-b6c70b1f1e05", "comment": "Malware payload (Healer)", "value": "f19b25a510f738c87d225ec095f62267", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697321285, "uuid": "dea4f6db-09f7-4758-8c8f-a6e75db3912e", "comment": "Malware payload (Healer)", "value": "c3451f17e68d7115f4d2304d7102363fd86a8fe137f2557445f9020dd081584e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697321285, "uuid": "6345885b-fc74-4797-a215-4e95fef17e47", "comment": "Malware payload (Healer)", "value": "7c88a8cfc3a21a191f30a0a25a7beade95aacdbf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697321285, "uuid": "e033fe41-f9a8-43e7-8638-a236aadfca34", "comment": "Malware payload (Healer)", "value": "2b72de55100a06812855267d7bb51c2175e3e172bf9c279991fd3fed14c690be7a810427e9e31b32018f204d17270f21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697321285, "uuid": "41154f88-cd9d-4f30-a1f6-9192aa8c7d6d", "value": "T1E2152303F6E58072DCF517B41CFA2A930B35BCE264B982773358999614B26D0D93A72B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697321285, "uuid": "8234c548-e3ba-4e98-a302-70d3cb7ad6dd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697321285, "uuid": "ec377929-0516-41b3-a633-7edce911cd5a", "value": "12288:xMrNy90/jzTZ7vwCgfMHrwSTw/xQdvTccDJbrLK+8+4hIE6afosGF8fU7pTMRJv:4yEj+C3jw/xQpcQfLP8M5gQsuq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697321285, "uuid": "fe7de451-feab-4317-999d-467127b48362", "value": 898560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697321285, "uuid": "cc2e86f9-25a9-4406-a96a-63ac9bfce58b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697321285, "uuid": "11ce1512-67f1-4d16-be22-7f9397053e88", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc5f6519-6a46-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1697256253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697256253, "uuid": "ac6e0b15-96af-4445-bb12-e74eb7df6374", "comment": "Malware payload (AgentTesla)", "value": "9db0aa4d2c28205d89536de9244cb7e8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697256253, "uuid": "a034fc69-b1e9-427d-9b03-5b54e5dbb475", "comment": "Malware payload (AgentTesla)", "value": "c48c301c70e75c95d192049ed30c1d2f4d32717b67139aad468a6de1d5550dca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697256253, "uuid": "83c8680a-711d-4883-a9e5-685c28549d8d", "comment": "Malware payload (AgentTesla)", "value": "e6fb1e2e73acf67569315c3d9f47f85d36aa3e0b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697256253, "uuid": "e4f69129-e8b0-4b4e-adef-b67794019e69", "comment": "Malware payload (AgentTesla)", "value": "b4de72f3ba5028dcf730743129060dd25b67baa4309832fe72c43d48190b3761a9eb6a6af219e762142ea95f2529284a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697256253, "uuid": "dd3207b5-52f2-4c82-b872-77420ba60f1b", "value": "T10B25F32C0CF809124161E1AEDFD8EA57B2C08CD6664C9D9687C68F995A1393BF09FD3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697256253, "uuid": "11f03163-4369-49b4-a9be-46d287cae8de", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697256253, "uuid": "0f953624-e7c9-4db7-88f1-4c3dedfdbf2e", "value": "12288:UFBXecyPM0fPFoMpUNdV9JOYvJ1pos0r:aBucUtRpUz8ao", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697256253, "uuid": "ae34af46-d5db-47b8-8fff-214e3f8b76db", "value": 1037824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697256253, "uuid": "0cbcfb24-1c93-4666-8ecd-68dd9aa5a241", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697256253, "uuid": "f9bc7dfc-14d2-4b7b-a833-e1909b245d8a", "value": "9db0aa4d2c28205d89536de9244cb7e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac97822d-6a89-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CoinMiner)", "timestamp": 1697285003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697285003, "uuid": "e260e94d-7705-4b7f-a79e-1276fc96509f", "comment": "Malware payload (CoinMiner)", "value": "b3b62354285669b0a6b4b4a1a67de8ad", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697285003, "uuid": "a2a7b79a-618b-4f6a-9c44-a51c5523d8cf", "comment": "Malware payload (CoinMiner)", "value": "c4bf193f7771479f52b4316ada901ac28a45d624fdb8a3b9792ddd2a5f198645", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697285003, "uuid": "fc471c73-5388-428c-a878-116b5ef4ed0d", "comment": "Malware payload (CoinMiner)", "value": "cc2d1942a4efd60670eff4e5a18ca31de3c89eea", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697285003, "uuid": "db7e92e6-a32d-47e2-a7cc-d5dc424c5c1d", "comment": "Malware payload (CoinMiner)", "value": "b9a15ccb4f6007dcf37ea6e8e43d200f43eb2227d9bd51bd16c66bdf89adfefaa84528f4338cbb237bbc02d00c7f44c9", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697285003, "uuid": "33d21c12-7a89-4946-a697-526ab8276355", "value": "T1AD46E114FB363B38F6D1637DC22D4669D8A19A1648937DCFB9A463004382D76DBF206B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697285003, "uuid": "e686153b-4ae3-45dc-aa3c-a471e76264db", "value": "f7505c167603909b7180406402fef19e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697285003, "uuid": "3e25a511-9b77-4aec-9707-e90571fc03f1", "value": "98304:MzPKjj2PeAKUG7QroF1ljbLcrMeo0kNfAsSj3eiue/9AjMtjfy/6+fYSfqTbQlOQ:M12AH4Hf1e3k6hj3eiu7jejfw6+QSfqI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697285003, "uuid": "ee2191e3-ca34-4c5f-8232-01140409855e", "value": 5860664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697285003, "uuid": "ea3b3e16-a272-4dbb-816b-adf55f3b6039", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697285003, "uuid": "4df32e50-3e21-473c-9e8d-7080f38e53c9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b504e290-6a44-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697255382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697255382, "uuid": "98abce30-ba22-4502-bea9-e12e8a1e3198", "comment": "Malware payload (RedLineStealer)", "value": "a15612a524e789a66817f9439220627f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697255382, "uuid": "31d09aa5-679a-45fb-83f4-fb155a4e0b10", "comment": "Malware payload (RedLineStealer)", "value": "c6ad52e5c40666ac6c8e913ceb5cc18b3e5a92b535ccf68c2caf183ec14f7905", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697255382, "uuid": "be65a4ab-e870-42d8-af20-d08f4fa13fa9", "comment": "Malware payload (RedLineStealer)", "value": "23d263a16d22ffd7decd9149d5d90ac5f0a70d5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697255382, "uuid": "f7685bf3-1ec9-4d1b-96aa-79211d36b0c6", "comment": "Malware payload (RedLineStealer)", "value": "d7dd3321c9659589f6ed53ead4a35bdad7ade49b1a630dfcc416b8cff66923234eb476b637325e2356cefd1505ef73eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697255382, "uuid": "bd2859ce-7a5f-460f-886d-f90f2d1269ff", "value": "T186752347FBC54176E9B1173088FA02430F36FDB1482493BB6B9AB85E097365496F0B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697255382, "uuid": "27e3ee2c-4d15-4342-bbad-b0737057d972", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697255382, "uuid": "1fd7c987-9b3f-47b7-8523-b740dc2dd278", "value": "49152:bB4sTwmH/eNG/qiTZgshm6ma9KAVVksM9iM:pNH2PMs6maIAksaiM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697255382, "uuid": "93f1a92e-ff9d-46b3-b535-51365a77b4a8", "value": 1624576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697255382, "uuid": "32062825-2e5e-48d6-ba2f-08af2792c4f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697255382, "uuid": "dc0ec6b9-8f22-4d20-8c7c-52e4da62c114", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "492550d1-6ab4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (TeamBot)", "timestamp": 1697303304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697303304, "uuid": "1840fcc5-1fd7-4e1a-be91-369074321738", "comment": "Malware payload (TeamBot)", "value": "df25f71bbfe99d98745cef918cda8d77", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697303304, "uuid": "5d6c8834-e783-430c-8c69-3cc9c7424da3", "comment": "Malware payload (TeamBot)", "value": "c7a4a9461d04291e8efee8c52ed3b2897b61e2fc3a639296c60afc307db7a821", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697303304, "uuid": "500ad40b-b4c7-475d-a70e-2b01cf196494", "comment": "Malware payload (TeamBot)", "value": "abad71342f8117b6c1ec710874fc3eb2a841497a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697303304, "uuid": "7e2a0719-2d01-49b3-9015-705cffd0ccdd", "comment": "Malware payload (TeamBot)", "value": "c9d61d08a967205758ed9c5b53c00eaa7520ae63dccf4e2d0c1e65b6272ea9494df28a7ca123fa945c6e689996efc7aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697303304, "uuid": "36381c8d-8e61-47ca-94bf-bb2640ac4cbe", "value": "T1ED34599352E1BC70D81647768F1EC6ECB71CB560EF496B6622186F6F19722B2D2E3310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697303304, "uuid": "02a71e66-68de-4f46-9c85-ba552c9c99d0", "value": "8447c3e0660cbcbbbbd5e35ceec5d5f8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697303304, "uuid": "368272ab-df2a-44d3-944e-cba57000e702", "value": "3072:kCEWivbZ/pFgRv07856weP7FqAKU/TX9sLsv57qtN+y7qh:qWsbTF8M7856TwHUrXhVqtN+y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697303304, "uuid": "37bf0887-3ae9-4764-9c95-e83dc0a1fd05", "value": 246784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697303304, "uuid": "590e8b0f-1f39-4f27-8047-e45a55b3e39d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697303304, "uuid": "c0e99e8e-0fff-4ff5-8a05-891b5c8f4410", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31e0cc8e-6abd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1697307131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697307131, "uuid": "0c607207-57d0-4c0a-8bf8-f562ff030f7c", "comment": "Malware payload (Mirai)", "value": "6154e5f83746f3f9bd57c80841d65998", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697307131, "uuid": "2643692c-554c-4464-9a77-7ac79b20e9ad", "comment": "Malware payload (Mirai)", "value": "ca0c90227e3c338b7be4f964ca3eccdc7f58dc642c4b614b1ef43959da433579", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697307131, "uuid": "0dd5f203-cd10-4dac-895a-0110f64a783a", "comment": "Malware payload (Mirai)", "value": "bfe08f8edcebb202fb36713664dea7b75f59758d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697307131, "uuid": "8068507d-2fa7-4230-9d7f-6ee46398f8bc", "comment": "Malware payload (Mirai)", "value": "2a0f89ce748b35d2562e82a1f78160bc552c980e641260306bd7acc40022eedc5881622a22812f1aca4da0ac06587d41", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697307131, "uuid": "0598887f-e942-471d-8f2f-216824f194bf", "value": "T14D334C41F30C0543D1636EF0363B37D1E3AEBA9122E4E185355EEA8AB176E329545ECE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697307131, "uuid": "c4264d2a-ec50-4599-ad9d-1e5b6be8d851", "value": "1536:CSFROuc3Y+feoTPo5Juhs2SIDYd2ciIbp:CSWDoMlbofsSIsd/fp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697307131, "uuid": "d84d4d73-e3b8-49e6-ad52-bd62859b3725", "value": 54656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697307131, "uuid": "144fd5b2-7fa5-46f9-ae8e-bac6c57532ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697307131, "uuid": "5838975c-5e54-44b5-bde4-4b75b27fb2ae", "value": "6154e5f83746f3f9bd57c80841d65998", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3294fd3-6a4c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1697258841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697258841, "uuid": "b4891ba5-db7c-47d5-bc2a-f4bff01d85ad", "comment": "Malware payload (AgentTesla)", "value": "be5084e351dfbf93ca2cc522907e4cc6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697258841, "uuid": "e5111cc1-9711-4500-ba7a-b3d0b4c2fc37", "comment": "Malware payload (AgentTesla)", "value": "cc06328c412ff41125dbceb0bc2838c1cbea24fa2909b7614e08b6546ad77891", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697258841, "uuid": "99442f7a-664a-4c6f-8181-d50bea00c6b1", "comment": "Malware payload (AgentTesla)", "value": "9f27fdba883f1e1b2b83b335e9d45ccf642778cc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697258841, "uuid": "f023195e-8410-4f91-897b-31ac19e2b23e", "comment": "Malware payload (AgentTesla)", "value": "8f0a7681c50e8370daa603c912d3e4631197cecc963cf6f13e5ff9287f016b15fe16600d56b719e912c807f53a8f80d2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697258841, "uuid": "684c0cc6-1315-438a-a907-d5dccde89315", "value": "T141D412AB65E70E5BCB850779C1A183470F70A34B1677DB18349426FFEE263C05687AE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697258841, "uuid": "3a294ef1-c9ad-4b03-8b55-6ab630cc2301", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697258841, "uuid": "b08e38a8-5070-4c83-ae0e-fbbb52710c57", "value": "12288:WdJQwYCvompQDjlazJ4ipgBNi6flZs1MQRb9d6AaJUHRvkffg3R:WdJQzCvohnl2aK36dZQ9l9d2JUHRvkAB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697258841, "uuid": "7b3a6ae5-82b6-490c-8267-588807d8ec30", "value": 613888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697258841, "uuid": "e901867f-7976-4997-969b-94925cb6b7b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697258841, "uuid": "bb2d3c51-5f36-44f2-be69-20d298840672", "value": "be5084e351dfbf93ca2cc522907e4cc6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a888b6c-6aec-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697327305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697327305, "uuid": "8ed2b7d5-e6ea-41d0-a8c8-c09b673bbda8", "comment": "Malware payload", "value": "6cab36c14f7acb16b08d9fc1601e61e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697327305, "uuid": "b79ff8cf-e2bb-4df4-bf98-95a106ad71db", "comment": "Malware payload", "value": "cdd2732dab9b93cef835ca681538205972a178fec406812be33889a4aa28b4d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697327305, "uuid": "5d9c176d-13e8-4ee7-9477-f81045be55dd", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697327305, "uuid": "105700db-35c5-449e-930a-a3dd87fdabcf", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697327305, "uuid": "69cb8671-ffc8-4f1c-a74e-694fc97b00f8", "value": 898560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697327305, "uuid": "f91e2142-51d9-4232-a7af-3887428a27e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697327305, "uuid": "1a37e2fd-328f-41fb-83b1-315c443beecd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88086b60-6a47-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697256595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697256595, "uuid": "363a5a0c-843e-4684-93ba-f75766c6e995", "comment": "Malware payload (RedLineStealer)", "value": "b6fb466f7fe20639e0e6ee5296fc6357", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697256595, "uuid": "f89f27a0-a5af-4a82-ac45-5812c5cf8c05", "comment": "Malware payload (RedLineStealer)", "value": "cddb246e5137dddb4ce521d383b4802c90bb60fb2c9fea52bdbaa7fe644883c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697256595, "uuid": "723a1e09-a3eb-453e-bc46-9b600b8f5c1b", "comment": "Malware payload (RedLineStealer)", "value": "c8f388215bf61313660aaeb9ba511259be5eccb5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697256595, "uuid": "b1baab85-7ed6-45d2-a055-57e0ad7a7fba", "comment": "Malware payload (RedLineStealer)", "value": "425e58329886cb78dd0def5a2f3f8438fcccef67698445d4d8d199733195cfcbd21a33f2266c182261995d2bf458c923", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697256595, "uuid": "ebe68fa5-24dd-4dac-802e-67c989d8689b", "value": "T18C752345E6F48036E9F457B108F703670E397CD62DAC036BEE4DA85E0BB15A42AB1727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697256595, "uuid": "8e2806d8-5804-4f81-905a-f532d0602492", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697256595, "uuid": "f0feb991-09be-4059-87fe-0540a4a65ba5", "value": "49152:940coGiLDLEwjgTCZ7TZguhd1ga37uhQRm5pStyRp:tfLEwnZRX1gaahQR6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697256595, "uuid": "37e905c9-de0d-4601-81ca-dfc02b3f4b1a", "value": 1623552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697256595, "uuid": "81bbccdb-1f24-414d-b2bc-a8683b10a68c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697256595, "uuid": "e245055d-357f-4d04-8314-f06ff0fca427", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f73e9be-6aa2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1697295638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697295638, "uuid": "6965350f-b504-40e9-9133-50dd35aa7c2e", "comment": "Malware payload (Mirai)", "value": "0300ff7025c33066b7257f5492c021b7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697295638, "uuid": "36780c46-0861-45ff-ab62-12ee54b8c862", "comment": "Malware payload (Mirai)", "value": "ce4c2c3ec7a40c296f6ae48e30ab8fb36b821a51b26989215dcd44a44f74816e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697295638, "uuid": "7e115cd5-0654-4b42-b3e8-51f72f2089ec", "comment": "Malware payload (Mirai)", "value": "5556a06ec1f6d5e2bae8ea7f7e2e05fb07b29956", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697295638, "uuid": "2f6cb83e-2870-4458-a957-f7797e2c0072", "comment": "Malware payload (Mirai)", "value": "991e4be8ce9fa2e499b30ecc72708100da3121b221cdd00d1ce7374d551e518a1b81870e5f919b3f33924f53a9a19977", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697295638, "uuid": "fb614c21-5c43-4599-a8f5-e14b2a370f3f", "value": "T1908307792945F66CE9F640B8F45329E628120A083FDCD1E36883543BFF70B48B56DE5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697295638, "uuid": "a993eb3e-3d9d-466d-80e4-947f476eea15", "value": "1536:seJ40bxEawKAPwXSw2+gMjVBIVCCfy0K9rzSNM:TTbxEZPkSw7lhu8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697295638, "uuid": "bc8af745-918e-4f53-896a-91242268d232", "value": 83328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697295638, "uuid": "dc1d4070-d07b-4fe6-8b68-33f8e581674c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697295638, "uuid": "5a3d139c-d31a-4f7f-9a4d-ac0ae2b47e17", "value": "0300ff7025c33066b7257f5492c021b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62a7bd74-6a90-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1697287885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697287885, "uuid": "e77c43bb-6590-4979-a08f-1a641fe0880e", "comment": "Malware payload (Smoke Loader)", "value": "90783d71b3b80cc7f9034ed00c0698b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697287885, "uuid": "4561dc4b-ff86-481b-b4fc-d89c255d7580", "comment": "Malware payload (Smoke Loader)", "value": "d05e51e7907e1d380981f0e3e87e3f68d513883d8f999c5cc9c9e80c43577cf7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697287885, "uuid": "c1883694-c0d7-4173-bcf9-44f8087af970", "comment": "Malware payload (Smoke Loader)", "value": "96c4a99135e737c6fc9c5efe16396be282e85ea7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697287885, "uuid": "13b31d4f-9e9c-411b-859a-80ee0df0ea8a", "comment": "Malware payload (Smoke Loader)", "value": "bd4008105f7afb7a21cd58dbbc4f2b7ff616ca29a56037085a000eadb58d809fd37cc57a22483c1323b35ed92ad51cb2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697287885, "uuid": "8f1d6f13-4889-44fb-9adf-f26614b9c74e", "value": "T142552356A7D9A433D9B433B084FA03E31F2A7D668C75831B2A645D860DE26C07D7173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697287885, "uuid": "bca56f66-140d-4793-a2f5-bf5422bc74aa", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697287885, "uuid": "f7c991a5-91a7-45a8-bb5e-34d0799231c3", "value": "24576:ky1lxpuhX8qv3nmiMjaLQOLn+1hDiF+0+yDC057F+gIcRRAK:zdo8qvRp3+13q57FGcRRA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697287885, "uuid": "3103baf2-b4c9-4103-9433-534b1c0bbe8c", "value": 1354752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697287885, "uuid": "39484441-01ca-4675-969b-f433a58e2141", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697287885, "uuid": "9653541b-6dc4-4493-bc91-42efc27f71af", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eabca93-6a68-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1697270752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697270752, "uuid": "e1b5ead0-3cbf-43e8-a907-4ffb62b0d47d", "comment": "Malware payload (Mirai)", "value": "adaa4247e1884b81696139a3f3b2ac0d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697270752, "uuid": "af1aff72-d47a-46c1-91f4-a77ca4827abb", "comment": "Malware payload (Mirai)", "value": "d07ed4ff4bddfcac95a284f5293140223e45cc583ab4d67c2899a1cf552310ba", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697270752, "uuid": "05593825-2a8f-4a50-a94c-2e221bc5d388", "comment": "Malware payload (Mirai)", "value": "522bfb0d3d2786e13d1635f1a6705a2a8f28f8ad", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697270752, "uuid": "3ab05f5f-3d08-4e66-a5b6-f4a0993dd2fb", "comment": "Malware payload (Mirai)", "value": "b75517750c48f2743001b1870e504c8b57f5883297a11baf9c4313bcdbf07f55c2965d3cb3abd399206ea3aaf8220a98", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697270752, "uuid": "d266191c-74b3-468d-8389-8846ab89444d", "value": "T1FBF31B46F9815F11D5C612BAFE1E118E33131BB8E3DE72139D246F207B8A96B0E3B915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697270752, "uuid": "4c24a217-07ac-46d5-9ec9-442161d832f9", "value": "3072:tMVQMikUikqY3XFMQaVEja8aG2PDGui36NqwbZnId:t1MikdI3XiQaoa8jui36QwRI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697270752, "uuid": "f47aa991-4922-4245-b8b2-5a405d61cc04", "value": 166940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697270752, "uuid": "a40763ec-b8f9-4515-ba56-3c4a9c8ab10b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697270752, "uuid": "065843a5-c972-4c63-9c4a-fcddac956220", "value": "adaa4247e1884b81696139a3f3b2ac0d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0864c6a6-6a79-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697277855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697277855, "uuid": "c47df8c9-9169-47d7-a38e-fa9dad04e942", "comment": "Malware payload (RedLineStealer)", "value": "88062a8a54be43b95c2b30712bdef066", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697277855, "uuid": "1b00ef65-1647-4545-80af-27bd677a9850", "comment": "Malware payload (RedLineStealer)", "value": "d111ba3ce108de210766124e1ac55a2e040458ea1481c7eeb3c96b112ee64a74", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697277855, "uuid": "59826fdf-d2de-4724-bf22-7d7eed4370d8", "comment": "Malware payload (RedLineStealer)", "value": "17ed42434ee8710ec09c926ddce5bd491f5bad6d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697277855, "uuid": "ed7617cd-262e-4292-b349-2878fe4147cc", "comment": "Malware payload (RedLineStealer)", "value": "10326662ab6d2db11af81241cbb8bc3990ab7e96ce47bcce0b3a2f0bf19def681d76e0641e18ab0f90fa5bcec545d19d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697277855, "uuid": "43f04483-841a-499d-93da-dc371a9ee3bc", "value": "T16A752322DAD84462D4F46B7148FA435347337DE2CDB4825A7B8A258E8CB56C0DAB173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697277855, "uuid": "0cdc9ac4-5768-4b3e-8c88-714d52e00591", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697277855, "uuid": "abc5f459-c83c-406d-8853-64632d86c5d9", "value": "49152:jSkz6l4580b2ZgPh5GU1UHKLGx7lb9Ql:Ju+80i8GUOqLGrbO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697277855, "uuid": "07d4027d-9cee-42a4-9979-4abf249a685a", "value": 1625088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697277855, "uuid": "2f8602fa-f21b-4296-9165-927c1a274314", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697277855, "uuid": "6ee86e00-fa07-4370-95aa-360ecbb1c2c3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e78461b3-6a8c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RiseProStealer)", "timestamp": 1697286390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697286390, "uuid": "b4337439-a2ba-4fb6-b7fb-dffecd90fe2d", "comment": "Malware payload (RiseProStealer)", "value": "df71a06b859776129a744f9dbfddc401", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697286390, "uuid": "bc172805-a20c-4b1c-89f9-8880f3ee59bf", "comment": "Malware payload (RiseProStealer)", "value": "d2fb526d868cb4488157564ae891059160b4349d550a291398b3d48ae28b2681", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697286390, "uuid": "96c293e7-c82c-40ec-a9e0-abb4b3e05776", "comment": "Malware payload (RiseProStealer)", "value": "a8823e2b086fc4c9e5b148ad6cd29f095da05337", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697286390, "uuid": "15b4ba78-a313-4685-b2d6-38cfe2f58fec", "comment": "Malware payload (RiseProStealer)", "value": "3de14d06d409fb0aa575337333aebaaa7e0ee6754b6c0c53b7bfde7df289c09219858c136e91586e07cf0897a622ee34", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697286390, "uuid": "6ab7d6e0-e007-4a55-85b4-595845d74906", "value": "T176063352FA0B57BBDB6C04F13B9ED412764F24BE49D94CC85EBE18922A61070351FEAC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697286390, "uuid": "e30daf10-b706-430d-b083-4a43718c6c9e", "value": "a7b93c85322555ce5149c255418da6de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697286390, "uuid": "d112d494-a4bf-4c9d-9a18-240d47cf92c3", "value": "98304:8/uReoGk4cdsOjHE6FDAcKysPL6gUAqsSaYsEHIZwkx:CuReonPdbPFDS9W6+dssIZf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697286390, "uuid": "a7c5752b-795b-4f7c-a981-f9c4a3d2bf94", "value": 3745280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697286390, "uuid": "cfe93940-bcf1-4bd5-afae-cfe32b5a61cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697286390, "uuid": "562d8427-9232-4e7f-b8ad-fc2b512103ee", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "874d97d2-6ac0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Healer)", "timestamp": 1697308563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697308563, "uuid": "ab372992-c158-425a-ae90-7dc1db305ad7", "comment": "Malware payload (Healer)", "value": "042e9ff3eb2884903c304965a6c3fd2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697308563, "uuid": "1629cc69-5ce0-4775-bc91-3d6398086c02", "comment": "Malware payload (Healer)", "value": "d33d17445df87212813fd8d4d849c66c90ac946e2d3deb9ade08d92c95d40a93", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697308563, "uuid": "83827b46-7f47-4bce-9388-527aa9ec58f4", "comment": "Malware payload (Healer)", "value": "d488b60fb1d1f0ada321fbe25554b3d79d95327c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697308563, "uuid": "49a129ce-f256-40b0-b746-fe64e8e0a77f", "comment": "Malware payload (Healer)", "value": "257ce76a18d5f17a7ddd78f3125e19de3c89cea507753b8774a4c4f06149bdc0aad43764a5e72eb229a775aeaa53bab2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697308563, "uuid": "1d11ef30-ad96-4ae9-90e2-490b63fb0f81", "value": "T12015231AAAE850B3D8B62BB095FB53D30F353CA15874D3BB7B815D1A0C72785A1B0727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697308563, "uuid": "8870ac8e-2563-48a7-86a0-97b9900f5fdc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697308563, "uuid": "fda07c51-0047-45a8-b129-650833bfc8c6", "value": "24576:byWSFeOSZ0QV/2J4UcTjJjAysYTz5dvqZym2FVKKJ1Ka+:OWCC0QVOaj/Jj1VX5dw2TfB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697308563, "uuid": "9cbd8621-bd39-4f86-91a8-087b13d71e6d", "value": 899584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697308563, "uuid": "87de2808-c4f5-4c61-9e8b-019a03515644", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697308563, "uuid": "581ec302-2125-4755-b39f-c2557c4f87ce", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95d177e3-6aa2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1697295702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697295702, "uuid": "e6515db0-b665-4b71-8f95-e1a5bf0ad61e", "comment": "Malware payload (Mirai)", "value": "b9f9a34e8de775a9c87c637dc8abea7e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697295702, "uuid": "f2c3e4b2-0663-4ccb-9ea7-7274cb158c9f", "comment": "Malware payload (Mirai)", "value": "d4ecc23614c24bfdda616544623ea0e91d9443f76f65047c1920922cef4de4d8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697295702, "uuid": "6e542d1d-5a47-4711-8b37-47b1563df127", "comment": "Malware payload (Mirai)", "value": "c23ffc7166ee383de50a037f66ea8d1f971df3c5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697295702, "uuid": "e3c8a669-9ad4-45de-94ac-1d3b6e2698fa", "comment": "Malware payload (Mirai)", "value": "e6530291a57837c5f815e08aba6ce873dc62e775f1daea2cfa96edd1dd7ef26002f650c005e2b0a0573e42126a73c8c3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697295702, "uuid": "1ade780f-0d49-480c-b3e4-356d510f9b27", "value": "T118733B0133588F07E9AA4EF9243F17D483BEEE8011E5F185690FAB5A4235F73585AF98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697295702, "uuid": "737efc4d-8afb-4758-9be3-a8dc63151b80", "value": "768:Xode4JgIgF+URInRoO0SXXR7SZhe0GF52iOTS+RVS0umSBaUx/6YCqVIU2zGU5d/:4LkqjH+GF9RXCqVIU6s9YjaemXOO8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697295702, "uuid": "15efaf88-16d7-427d-80a4-b2230f190e66", "value": 76936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697295702, "uuid": "c4a7f996-8ab7-48cf-a953-95efe4c052f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697295702, "uuid": "36242176-bc4e-4e9c-943c-e66bbe037358", "value": "b9f9a34e8de775a9c87c637dc8abea7e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db9dd9fa-6a7a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697278639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697278639, "uuid": "9955bd45-260a-4d2c-9ca1-e1598cd55551", "comment": "Malware payload (RedLineStealer)", "value": "c275e48f6db5cbfcf44f9c045dc08cef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697278639, "uuid": "e30e16fd-88ed-4d11-8f74-5fdfd11af0bc", "comment": "Malware payload (RedLineStealer)", "value": "d517f83af8533e39c70585b291a695f50abd4dd4324c8f6cbb5a626f41b47220", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697278639, "uuid": "bf052318-bb6e-498f-806a-4e6b7e60fb5f", "comment": "Malware payload (RedLineStealer)", "value": "7913888d57fdb0e3861c8eb972a0a0999b241c83", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697278639, "uuid": "cfdd7eec-9570-4d80-83e7-c832a962e968", "comment": "Malware payload (RedLineStealer)", "value": "029bf810a5a52750499b3b410f6bff701e1f770baf7ea4f7953c3d75c754471e7f9492c0d96126fde50563ea43cbac6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697278639, "uuid": "6f884dc8-04fc-4a52-8ca5-571d1e95ea84", "value": "T1D2752313D6E98436D5B4EB3148F612630F377E998D7947226E89984D0DF2288F4B2B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697278639, "uuid": "08af9eca-ce0e-4d07-9dfd-cb81329c90a9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697278639, "uuid": "8b814ce8-f148-4c94-b7de-b3431352c7ba", "value": "49152:jJ9sOYRmpjtzTMrZgFhaC0aUoiNx1H4rwgcV9B:sfRizTeZC0a0NjHXgcVD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697278639, "uuid": "0e96b986-feb4-4fc8-b09d-b578ef407717", "value": 1624064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697278639, "uuid": "d3e056dd-eade-4a78-ab22-fbed30c52b75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697278639, "uuid": "9c083338-7473-4cfe-bda6-40bfedf98631", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cf2d272-6aea-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697326450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697326450, "uuid": "94334973-36fb-4f1a-b637-b1a27f08c20c", "comment": "Malware payload (AgentTesla)", "value": "771bb53824809e438fa9c6be25a04ca1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697326450, "uuid": "20dc536c-6c4c-4e3d-9dbf-bf8a9400adf3", "comment": "Malware payload (AgentTesla)", "value": "d85a9526b3eb9c38f7f5dc77ec40c9778e19939bfda294d25a365a743c4a5434", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697326450, "uuid": "6bdc66e9-3411-4ac4-8281-008cdac1d7ff", "comment": "Malware payload (AgentTesla)", "value": null, "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697326450, "uuid": "f8c6bc97-e3f8-4fe3-8d5f-443f3e7e4940", "comment": "Malware payload (AgentTesla)", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697326450, "uuid": "fc73218e-c905-45df-9928-dbd7f0689376", "value": 508416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697326450, "uuid": "d98444ac-e0f4-40a8-90be-cf3968aff431", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697326450, "uuid": "fbfdb7b3-e25c-45e7-83f1-3dcb83c89454", "value": "yandere.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8da8b77d-6a68-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1697270778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697270778, "uuid": "01c3eed9-25fb-48f0-9fba-12ad7cdee228", "comment": "Malware payload (Gafgyt)", "value": "5f03e992df6913de8cda5713ed6202a2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697270778, "uuid": "518e9bee-3c60-466e-b5de-c3c61c337f48", "comment": "Malware payload (Gafgyt)", "value": "d8675bfdab965a84372949d67d633518e8db3ee43ad7f2f5f93e2af2b8bee2f8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697270778, "uuid": "b0eca281-55b0-46a3-8eb9-616bfedaf207", "comment": "Malware payload (Gafgyt)", "value": "1e83e2214b70fee779015c8ab4ae7d53c71e1c7c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697270778, "uuid": "6bfe07f6-81a5-444f-b755-038bacb36bee", "comment": "Malware payload (Gafgyt)", "value": "395e4ad9f421e503a545c004764045e521d85b68709a974df8833affe973b53bb3f62a250f34d8155065aed8b32a664a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697270778, "uuid": "b8c14b85-e5ed-4d94-afe6-65ff873af229", "value": "T1ABC34B42B7290F03D1A31EB03E3F27E473AAD5C211F0B145399AAF6E8575A734946ED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697270778, "uuid": "ef3739a0-8ad4-4bdf-8e2c-66e1bb8f8dd4", "value": "1536:18RH2fBmpX7alvw8p/N5V/RZ9693Tilk6453PTc2CM7cbAPxu4PXZ7LwbZnlZ:FmpX7aRlv65883PT/CBmHLwbZnlZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697270778, "uuid": "37423761-ef7a-46be-be81-18781796dcab", "value": 124688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697270778, "uuid": "0d1237e0-66fb-4976-9955-5bb07b5499ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697270778, "uuid": "230fca34-ffe2-4059-bb58-48c0dee7ec95", "value": "5f03e992df6913de8cda5713ed6202a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35d43aa6-6aad-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1697300266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697300266, "uuid": "00ab02ec-1f36-4daf-8e25-dac61d4eba68", "comment": "Malware payload", "value": "5ae7696ff36f8c3427540b96b1a36bc7", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697300266, "uuid": "84f6ef9c-306b-47cf-a257-09d875e80239", "comment": "Malware payload", "value": "d8b7aa9a60173b3a20c1281ce6e6ec294bb9c8601c4fed22d02b62fc3045e9b1", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697300266, "uuid": "f81dbc9e-57fa-4c6d-9fc8-412e36c7b2ca", "comment": "Malware payload", "value": "14fb42c1e84d6e55af8728f1c29501969e009286", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697300266, "uuid": "7dd0b8c8-9d2d-4a42-a857-527b255560f4", "comment": "Malware payload", "value": "26bdb9dcabf9db4746231fa8ea79fd468d3a5127146833d0ab7be640628af51e8cd2f121cf65b253302f978208363bda", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697300266, "uuid": "ef92fe11-1b9d-4552-ba7e-72052935e4b8", "value": "T150830113CA12E354CB1298E4B5077C5B0CDB1BFAB69961BA440F1D8F6C9CDA22CE41BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697300266, "uuid": "a8699f33-97b6-4354-b42a-0e3fb2bebff9", "value": "1536:9QMD0V7sj7m2ArSRiMvsZMTW20JWDn7tFYBBo5eOD4oa1OXiSXOV:y20dOKMTW2zosAo+OyyK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697300266, "uuid": "a20e6646-277e-4d50-97d5-0806a71f9719", "value": 84084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697300266, "uuid": "485c8102-1f7f-4a11-9d03-3942256d91c9", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697300266, "uuid": "49612110-925c-41ba-aeed-6fe8ea26af74", "value": "StatementRevenue-REFFJPT3#516470.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc342209-6a31-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Meterpreter)", "timestamp": 1697247341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697247341, "uuid": "983813c6-3aa0-4071-9c90-0d53c801b659", "comment": "Malware payload (Meterpreter)", "value": "6df779cfa4ae3b0abcb5d0bc48432fa9", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697247341, "uuid": "9e4a776c-d2e9-4582-91c1-626a8c933c2c", "comment": "Malware payload (Meterpreter)", "value": "d909148e5963b054bf85ad82cbd20312b117a4eea3c9f613f866a9438e99a0fe", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697247341, "uuid": "554f4ef0-1f92-46b7-893f-38444cecb3c0", "comment": "Malware payload (Meterpreter)", "value": "e64cbcbded20b161ed8f5d772f77863ff1f4799f", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697247341, "uuid": "aed12713-882f-4d49-93a7-eef969d58702", "comment": "Malware payload (Meterpreter)", "value": "01e742722f37a9f36a4dda10866681d85095f99a40abc4d514d2d5b71599632a93f005b1f076cb9f83aab117457232be", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697247341, "uuid": "5727dfd1-7c57-4f3d-b537-8314b7ce4932", "value": "T16A049D12B6908071D5BB527905BBAB121B7D7C310BB6CE5BABA44C8E0E741C0F73A767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697247341, "uuid": "df224fd5-e9fd-4089-9197-f997de16a1ff", "value": "e8d1b179f0e22242443ea10dc9b8232f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697247341, "uuid": "7ff2eb6b-a535-4898-b882-9b27e6f2e617", "value": "3072:RR6C45ds/1sAUsMGbCpcAQbzFkhgjGrRzQYN:b6F6dMiAfgjc2YN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697247341, "uuid": "408db463-9810-460a-91d2-993bdb06be96", "value": 176073, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697247341, "uuid": "94bb6c5c-402d-498c-881e-c30e50400b6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697247341, "uuid": "2bed7f1e-3bf7-44a6-a05e-cf6dcd0f8917", "value": "24e7279203bc2d7aba18f3a5ba88baaf6836e8a5a5e6fd3ce9d16679", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88176a06-6aea-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697326603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697326603, "uuid": "89e4b657-7af5-45c3-9f49-59e2b83ce533", "comment": "Malware payload (RedLineStealer)", "value": "32b9f52e7253c8098d2884dad5889ab2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697326603, "uuid": "f771a43d-3cda-4054-ab08-090b3a1541e1", "comment": "Malware payload (RedLineStealer)", "value": "da77f764acbaab6b9eb2bd7db1a8c3e6ccc6b73d5c12e2c239c5fd6cb78a04c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697326603, "uuid": "5211b5a3-b177-471b-bf28-6602453d1779", "comment": "Malware payload (RedLineStealer)", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697326603, "uuid": "1e7a1805-9947-4692-8f48-cd3b685d4334", "comment": "Malware payload (RedLineStealer)", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697326603, "uuid": "9951090a-f09c-4873-bd98-7f3b69fa09ab", "value": 898048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697326603, "uuid": "f2f60576-1c01-44a1-b063-d2d0a617fdbe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697326603, "uuid": "8c54a735-1015-4f33-b110-6dcb43dcfa4a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69fe789f-6aac-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697299924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697299924, "uuid": "62aaab71-45d1-45b1-8c3b-065435a1369a", "comment": "Malware payload (RedLineStealer)", "value": "cd956b35a1378870c1aafd2d2d5a6621", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697299924, "uuid": "f7fe4071-67ff-4075-933d-9caed0e9f4cd", "comment": "Malware payload (RedLineStealer)", "value": "dbb7984df83f7a7bf7dd3335d963839f9dec74fc7cb83cea840ec2141949cf46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697299924, "uuid": "e716fd62-9ebf-4735-9dd2-999529a21ec6", "comment": "Malware payload (RedLineStealer)", "value": "3dc055ee508e725b648566284cd76eee987d20f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697299924, "uuid": "0e40fcae-ee93-4245-a123-2c7e46f78132", "comment": "Malware payload (RedLineStealer)", "value": "fc67acfc3f828ab2777b062cb71abbc425446f1d5998adaeacddf6c1c7140d2ad630e7d435c9764cfc9288e425fa17da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697299924, "uuid": "a14da5dd-ca8e-4faa-8574-38ffc869d3c2", "value": "T131858E703E804025EDD310375DECA92A516ED1FC1BAB05D316B6B7EAE6683D06B32F46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697299924, "uuid": "c0e49451-736c-48e6-b17e-5f069476db88", "value": "e367cd2cd00d41816448f9c2b20f0e47", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697299924, "uuid": "d75ba27e-eb68-4453-994a-851a600529bf", "value": "49152:VFKcjeOqD/WNb+1hY4fOVlT/DKu9Lq7V9B8:VFS/Yb+1hY4fOVlT/DKu9Lq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697299924, "uuid": "6008724a-2f4b-4a8e-84bb-8d5f1cd8f145", "value": 1828864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697299924, "uuid": "22b9d985-c361-46d0-8ac1-c19a6e457b87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697299924, "uuid": "75c3eec0-11db-44a4-8e5e-b02c87ba53cb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "737383de-6aa2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1697295644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697295644, "uuid": "467dbb4c-fd43-4205-ac7d-ca827376fa06", "comment": "Malware payload (Mirai)", "value": "0c6fbe283e6aea71c1d76949cf7ec021", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697295644, "uuid": "e293e6c5-8533-4954-ade2-c9be94e07a33", "comment": "Malware payload (Mirai)", "value": "dc76d8127d9981d8ff06340a328e85a44031a1762498461a3d26a79e2745962a", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697295644, "uuid": "87f9f966-022b-45eb-9b56-1a873d57c307", "comment": "Malware payload (Mirai)", "value": "f9ec39f2e63fa0eb105e93467a85a0717b139282", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697295644, "uuid": "9c55d9f7-6317-48e7-be5b-5b2e96eb7e38", "comment": "Malware payload (Mirai)", "value": "436c5899d730ead44724db36723185c1dc28a29921be730e2761e1cd44206832c9f85dd95c983fb1c49c2b986fe015cc", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697295644, "uuid": "ae85a343-bdd8-4fba-b359-cf6b764017ad", "value": "T194734C42B98585FDC189E47802BF757AC426F1BD2239B1E737C4BF1B2C09E601B1E56A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697295644, "uuid": "9d0fc3a7-2908-487d-8453-b2bc4a351b31", "value": "1536:wM1FaL5wJ6x2oYIsJNbmtY+Oqeoe14PW0MPTjZ3cEN/CM7U9O:fYG6x3YIsJNQPOqK2PW0M7jZ3D/CG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697295644, "uuid": "73c1a19c-d098-4105-9c46-d028410e2ef5", "value": 79520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697295644, "uuid": "1d090923-2564-4872-a43e-8c911a24df8b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697295644, "uuid": "633ad551-cce1-4c96-84e2-773b179fb931", "value": "0c6fbe283e6aea71c1d76949cf7ec021", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b4f1f29-6a64-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697268868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697268868, "uuid": "d96f5a6b-ea77-48ea-a8ce-aa21cd461b78", "comment": "Malware payload (RedLineStealer)", "value": "9824b94b9bf9c3f15b66813deb0fa5e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697268868, "uuid": "467b2440-6f9a-4831-9e03-7e16064719b2", "comment": "Malware payload (RedLineStealer)", "value": "dcb476514434e1ecf2b8c3e8477708585ef238e2e656847a1b16ab1fdc925da6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697268868, "uuid": "dc51558b-8061-49e3-9d9b-4ae7a0009103", "comment": "Malware payload (RedLineStealer)", "value": "2ab7424e5e6e11f705ef2a5be38e486080070cd4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697268868, "uuid": "0037f1c3-19a9-4d1c-af96-7d15f5ada9f4", "comment": "Malware payload (RedLineStealer)", "value": "c16c9c532d3454d1422fce947f217a5e371f43b406bc6138c49f937d5f94572af181728a55d6ad4b6955b9b9101c47d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697268868, "uuid": "e903700d-baf9-4569-af1b-77398210b416", "value": "T1DD752368EBD0E431D5B11B700CFA06930F7E3E924C6493B7AF82540A4DB3A54B5B676B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697268868, "uuid": "07cc5cdd-a21f-4597-a1d7-3c1e40be99ff", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697268868, "uuid": "309e84c0-3e57-4caf-ac15-efe1b43b2abb", "value": "49152:tOPXMJr9Ssw0/x2IUkWoZgnh0RgaRANcbA9EQqhNXE:+cJhDw0FUkN9RgaKmbkVqnX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697268868, "uuid": "720c8fbd-4df5-432a-94a5-f467ac455fb8", "value": 1622016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697268868, "uuid": "b4e6ad25-5728-42cc-94ff-b638690a8f9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697268868, "uuid": "33f9987c-39d6-4700-8662-6452faed6924", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7afce667-6ae5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1697324433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697324433, "uuid": "77a399c7-5525-4694-991a-d282c74e28f2", "comment": "Malware payload (AgentTesla)", "value": "8e599e94adad7161dd86170d240dede9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697324433, "uuid": "09684c65-be6c-4993-bc45-9b162ed8dad5", "comment": "Malware payload (AgentTesla)", "value": "dce7e736ce81d68584906eca24707654e9610fb57a04893a0688351347401838", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697324433, "uuid": "ab131499-a60e-4b2a-8f87-79e8501dc32a", "comment": "Malware payload (AgentTesla)", "value": "a6096c5d930c6335689f382824455f9f8c2098e7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697324433, "uuid": "79cf660b-403b-42bf-93ab-35408713fed6", "comment": "Malware payload (AgentTesla)", "value": "bac14ed8edeeba6136dfeeb631c1d37733daf069b4103bfea708b20bfebf75818f1a5b31f328b9fde9780d93a8970483", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697324433, "uuid": "efb27ef1-7bfc-4947-9196-168d412c0934", "value": "T113B4E22229FB109DB3A3ABA65FC8F8FF896AE573191E70F5314107468722D44CD52B36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697324433, "uuid": "4fd1d886-6945-4ea0-80fe-d1353297cfc8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697324433, "uuid": "c468b2c8-7143-4976-90dc-ff1c974557cb", "value": "3072:4f8lTxrUikUGq4bs3Smna2eFS5ddPzR+XvnqgiutF/sS28t6iNBIFTOx:4fril/na2e9H5+RO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697324433, "uuid": "cb1a397b-a3f2-4d58-a8a8-274c01986018", "value": 522752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697324433, "uuid": "feff5f3f-cca7-4c3c-8320-d4cecbdd415c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697324433, "uuid": "f5146fa6-5112-49f9-8082-b8ce3368d8f2", "value": "Cuttlebone.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79b6da72-6a68-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1697270744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697270744, "uuid": "7cc23f71-0c0f-471e-8fb4-a1d9b058c54f", "comment": "Malware payload (Mirai)", "value": "a0a6147d6cbaf70156702d1580e7afe5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697270744, "uuid": "d99ad248-70b5-4f07-ab57-0d776c791573", "comment": "Malware payload (Mirai)", "value": "dcf2995af8483ccb14720b07fc2d233128d50f1f737b6a005fe8474b0a6eda9e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697270744, "uuid": "08acd973-7549-4ffd-b1d1-902f9807254d", "comment": "Malware payload (Mirai)", "value": "27177c2c06cc2e1cbdccf8e17fa36feb813c2e01", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697270744, "uuid": "07fc3b2b-6a54-40b3-b78c-4e8f89583f23", "comment": "Malware payload (Mirai)", "value": "1dd35d38bd0edd762f5477c3c483e79ebbd0fea9a78ffe9b9d1a70d22f221109ac559143091bb5ae6b006fa81638696c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697270744, "uuid": "d8b21174-f090-4d3e-8088-0258993bc89e", "value": "T16014B61E6E228F7DF768873547F78E20A76823D627E1D644D1ACD2145E2038E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697270744, "uuid": "4a2e6acf-5486-494b-a09d-68417843c9d5", "value": "3072:3nHL6eEOwYbnxViRXVelzO56EGxutU8xzhn6jNcPwbZnvV2l:3nHL6MwYbnxViRT8NgtFh4NqwRv4l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697270744, "uuid": "02ce1dac-8e76-4375-ab07-fe717274d415", "value": 204208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697270744, "uuid": "ce4105e2-737f-4a43-a767-6320f1fd8e4d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697270744, "uuid": "0a90b471-f6d9-407d-b01b-3ca7c12e637e", "value": "a0a6147d6cbaf70156702d1580e7afe5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2822bb22-6ae4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1697323865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697323865, "uuid": "ec5337d3-84a3-4047-9179-0f0aa6103837", "comment": "Malware payload", "value": "eca05379305a79927fa28d92dfae17e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697323865, "uuid": "a5259a32-0911-45fe-a5a6-58e19157982c", "comment": "Malware payload", "value": "df577e470c318e1742981d5f4029734392e3ef74366b554a77e78023590fc57f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697323865, "uuid": "790da49a-78b4-437b-97d0-d4bde20bb4ef", "comment": "Malware payload", "value": "04dd6087a27ae3c952e37f7e3376d1684c4d89c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697323865, "uuid": "a7cf5415-1dfc-4ead-96a9-0e63ff674512", "comment": "Malware payload", "value": "edb5ec7146771a3bf5b9b2db6bc855c9b581be22e9de4b62c92684fba225321ebfebf0a6826a9611e1c2d07cdfaf8c72", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697323865, "uuid": "88027ac1-3cb7-4075-af61-9f5c5f158e85", "value": "T181152323BFE44432EDB1277198FB09430E367C519D79C39B2685AE8E0C73681A576367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697323865, "uuid": "4694af4b-8d0b-4c33-859c-48a5e4bd9145", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697323865, "uuid": "82299ccd-a76d-4811-ac07-dfac73c09eac", "value": "12288:mMrRy90OZS8MmmyqQaai0wpNTcHMPAqUA/im7He4aHKOC1AzOIwV:vyb/myDaaRecsoqFimDe5Hsy8V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697323865, "uuid": "ff067e75-423c-4a95-af43-6cf1450b13d0", "value": 898048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697323865, "uuid": "8182a80f-9ab6-454d-b368-61157ff25160", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697323865, "uuid": "a7ef20d2-284c-4daf-81d8-84b6a66a54a6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98e82137-6ad0-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1697315464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697315464, "uuid": "4328445c-d0c8-4dea-8efb-addfca264757", "comment": "Malware payload", "value": "6d57be58312131cb7672f3d72bf1b5a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697315464, "uuid": "55396e9c-22df-429b-831a-33a9d762e0af", "comment": "Malware payload", "value": "e000e93034aa809e36c2c270db09f90d9f68949645c3c6d3c7922ebec2b01f13", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697315464, "uuid": "d58e72e1-900c-44a5-b4c8-2ac7be194ef4", "comment": "Malware payload", "value": "3dec741a0e5b7271416ad09dbd35be896f07c939", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697315464, "uuid": "c0402c89-734c-452a-a240-cca047691777", "comment": "Malware payload", "value": "004bf963bd2270e97619321f2816d5cb34a341e4f826d74e657362563860254f38d0be556ecc65e210d1aa7920eafdbb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697315464, "uuid": "19bbe2b1-bb34-4aab-b496-196e8fac23c1", "value": "T1C9D301033AB1E5B7D57307705E7B7AB7EFE8C60015A8E20B4B491E2979329432A1F6D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697315464, "uuid": "aa9481e6-132c-4962-ab8e-642fa1712ee0", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697315464, "uuid": "ca6e57d8-4256-47e3-8228-b10d393d81c2", "value": "3072:Bf1BDZ0kVB67Duw9AMcybGFAjrYEOnEjbWicBGIgPjzgw0XIu0I/2jAM:B9X0G0fjrkJiUgPH/ubXM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697315464, "uuid": "2cf34484-0a87-4464-8434-10f8e113c830", "value": 132734, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697315464, "uuid": "a78f14dd-b1ba-417e-80dc-4c6049b3487e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697315464, "uuid": "920418d0-6cb4-406d-83bf-ebfb108d4a66", "value": "SecuriteInfo.com.Variant.Doina.63280.14488.7452", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2150c1b-6ab7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1697304742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697304742, "uuid": "0180d72a-6ed8-4e32-a158-0568c30e5de1", "comment": "Malware payload (Smoke Loader)", "value": "06cadf7c7150c5c8e99aaf1cbbb10606", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697304742, "uuid": "eeab9a0b-cf72-4603-bc6d-e0344120cd6f", "comment": "Malware payload (Smoke Loader)", "value": "e06732e3ed9b23c2f1c1510c609b12e7613d0aea596391b7e1d674904542a1dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697304742, "uuid": "324b37dd-9e62-4964-af1b-9ebbc910f222", "comment": "Malware payload (Smoke Loader)", "value": "76dd2daab0594d9e78d84b00aa9e0f53eff98f69", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697304742, "uuid": "b9b3971b-5208-45aa-8ebd-96e19b06fed9", "comment": "Malware payload (Smoke Loader)", "value": "ede56c599bcd464699efa1f98d1cebdf662b1ea2a0931b4b3e557edb0c18e4bb97ed8db5ac1c2d5218774c81ab5de2b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697304742, "uuid": "2cc2c270-68c3-4c00-afcb-baeb20cc93a4", "value": "T1DE151253B3EC943AD9B117B06CF602870A35BC5699B4132B57916E6E0CF2381E93277E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697304742, "uuid": "7dc9cb35-3a3e-412a-893c-975be6827ee2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697304742, "uuid": "8e7e54c0-d15f-4694-bbbc-0d50d433f4cc", "value": "24576:JygTDSg/Q5EFDrG+iGCMFORE9Oe1AcuDql:8gXSg/rNrG+pCMFORBem", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697304742, "uuid": "c96cf4e5-2021-40e3-bd9a-999cc7c9755f", "value": 885248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697304742, "uuid": "85175da9-4789-416b-ad59-f3dd1fde3cf1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697304742, "uuid": "6cd355c1-a566-4a81-a37f-3191685abef8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5b25522-6ad3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697316908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697316908, "uuid": "a68f19ef-145e-499e-8645-d8cbfeab25f9", "comment": "Malware payload (RedLineStealer)", "value": "0194696f07a51fbbea0f24f128c2f068", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697316908, "uuid": "25a5baf3-a16c-4edf-9bd7-00abb67493d1", "comment": "Malware payload (RedLineStealer)", "value": "e2618325c89af9a9eb73d76530f1f44b70c980f34672da78d2c2b62e6a8dda43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697316908, "uuid": "159fff66-42a4-4b4b-a0eb-f297864bda24", "comment": "Malware payload (RedLineStealer)", "value": "ed48951cb389c130fa3f1695b64cca3a2148697f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697316908, "uuid": "ceeee8bb-8fa8-4742-b023-d29b32cfb4d7", "comment": "Malware payload (RedLineStealer)", "value": "aaed5305e38eb94551059d1efe541069db0b7de66c8e1d4d09b219b6eb9176425a085ef7edb29faeff8af56e7e9446bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697316908, "uuid": "5cbe8037-baac-4ce3-aa14-f5cdcfd651af", "value": "T1E1652322D5D88172DDA5B73065FA07834F39BCEEAC38462A6701AC5D0D627C0E53A77B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697316908, "uuid": "2fe76091-1018-4ad0-8c00-e598c304749e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697316908, "uuid": "1eff93d4-c40e-4dad-a762-2bc9f8165344", "value": "24576:xy2UnmJW286Kjm4T/1pLH3iTG/ygAhUD1CNDJvTTD3/1WjU:k2UnJ286uTNl7wHnTT7u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697316908, "uuid": "43602aea-62da-4d04-9e76-7243b8a0e334", "value": 1463808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697316908, "uuid": "a2222c51-4bb7-4d33-8197-ca7f270e7351", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697316908, "uuid": "63321959-08d5-41c6-966c-40b8d6a46876", "value": "0194696f07a51fbbea0f24f128c2f068.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe77c7c0-6a6e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1697273544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697273544, "uuid": "afa37bd6-eadc-4389-a0eb-ca7f6e8dd308", "comment": "Malware payload", "value": "1154989fc4defcf06cc96961c76dc7c3", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697273544, "uuid": "7952d06a-a14a-45f5-a79e-12c423f5d592", "comment": "Malware payload", "value": "e2d33db9580d8fd1ca1df45c44cf23d4fe5f0c50ea464a50ecf1743e60d70fcb", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697273544, "uuid": "6029aa01-c577-48ef-9584-8e43c8f79495", "comment": "Malware payload", "value": "db7ddc77393d72917c8d48d21a18eb0e9976a57c", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697273544, "uuid": "5ed29898-7617-4d0f-a1c8-3f08306fc1b0", "comment": "Malware payload", "value": "abc9973bdcfcabc06df09bdb70f5c4995f23372629878af403d5faf8b9c35e7c88c5b6d744f177b8c3f5e9e049d87f05", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697273544, "uuid": "b204e9d9-a879-47a8-ae92-c54bd17fc934", "value": "T1F682C015969CB8C2F2B7D339D0D5601B787E2BBF5B5A341C9C046168B0A8E8C4F7DA31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697273544, "uuid": "6d8798af-a409-4fc3-8923-4ab0db7f5f2e", "value": "384:tu7SgLFX9i7r+SB9X/ihJQFJD3LsS1NwSMNvie8VcgKzdTR7qOOi:tu7lFtG+SB9XwQQSLwBiVVXUdTcOV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697273544, "uuid": "1e52387a-41a9-42c1-8871-82e017d0aa16", "value": 17734, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697273544, "uuid": "21951227-0eb6-4094-ab77-e4fd35799e3c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697273544, "uuid": "a40cfa45-02c6-4202-bc67-e9c6f1f766ab", "value": "JavaWrapper.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41a30ad2-6ab9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697305439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697305439, "uuid": "82d9d30a-73c2-4f0e-af26-2b996ce5beba", "comment": "Malware payload (RedLineStealer)", "value": "6578d1f6d164270531be8c124cf58e9d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697305439, "uuid": "253c61ef-8d6d-419c-8cf2-4bd4cfcd189f", "comment": "Malware payload (RedLineStealer)", "value": "e37dc31d94e2f4ec52641316c1e17dad42a321ecce88e6371488cde1bc3218b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697305439, "uuid": "4fc10e46-8c55-4b9e-86c7-35c97c7901f3", "comment": "Malware payload (RedLineStealer)", "value": "17ad62eb62a6db4f219cfec1c60c07dba40eb242", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697305439, "uuid": "5d5cdb85-1dcf-4817-85ab-bc217e6f2773", "comment": "Malware payload (RedLineStealer)", "value": "7a4bcff544882e7685f9124611d08de6a24b8e3b44a76c01783146ee492422f2f7f53f83acdc846c49876cffa1255d5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697305439, "uuid": "e2cc80dd-2464-44c3-a9f9-09a107a3d14e", "value": "T1C6152217E6D85572EDF467F058FB05E316397CA22EBCC2172389A4691C72A84B0713BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697305439, "uuid": "87943289-7b3a-4ab3-b70c-d1df070ba430", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697305439, "uuid": "ce6a5167-30d0-4af8-81ca-afc75f5d33fd", "value": "24576:vy+Mrj0pJMUeCo2h8F1Xf13jzeqlEdL/Xvil:6+MrIp648F1Xt3P6L/X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697305439, "uuid": "7e3a42e6-0a6c-4e89-be62-18cd4eb2ec48", "value": 898560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697305439, "uuid": "041636c7-0e2e-4170-8002-a24949d8d134", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697305439, "uuid": "abb56fa9-2d36-412e-a8e8-049f13b487eb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94078a22-6aa4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697296558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697296558, "uuid": "46f3f7c2-7e15-4f00-8706-e0127f36afab", "comment": "Malware payload (RedLineStealer)", "value": "bcecf435e8b13f6ce7c8f117b11ac060", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697296558, "uuid": "60cb87c2-8406-4788-9334-00c48e418b15", "comment": "Malware payload (RedLineStealer)", "value": "e4e58461f043599fc2d7f561c60ee7653b5f32be652d9deb2e4119b715aaee0d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697296558, "uuid": "f9755239-69e8-4ae3-ac4e-a274f423e74c", "comment": "Malware payload (RedLineStealer)", "value": "fd7cba491418b3b67ec1ef49bad5b3a5e23303d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697296558, "uuid": "18f6b266-80b5-45bc-85c1-202e98319bfe", "comment": "Malware payload (RedLineStealer)", "value": "1dee2f9f3c1c824eb9423e62d3de03e9dcacd6e5ba5c07509e3354adb978cdc87a8413ebb0264f825187596198d6496b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697296558, "uuid": "6c6f83e9-cb7b-4259-b388-5eb295b8ffd9", "value": "T1E3252323DBFC4513C8B8533415FF42571A3ABCB28929927F23D5AA5919B3AC1A4B2335", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697296558, "uuid": "b452075c-522c-4bab-8f40-22d25ce61fab", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697296558, "uuid": "164b1dea-a0b6-48c4-80b7-f07cec02be7c", "value": "24576:JyTE/6QyTExHteOx4OwuCLOX93ItCbChrsH/m2I91j6Nom:8TECNEvx4OwuCg9kzrsflID+No", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697296558, "uuid": "e82b3e86-d381-4a80-b673-5944d0c52c6a", "value": 1005568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697296558, "uuid": "d0d51f18-0584-49f0-8822-0517a8ba63d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697296558, "uuid": "49e2d38e-ac5e-4e8d-a505-328bbc876854", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d8815e3-6a2b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1697244498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697244498, "uuid": "3f1490ad-6b35-40fa-af20-70d720f8fba5", "comment": "Malware payload (Mirai)", "value": "6bfc879333ce0cde2ff2a1cb36cb5adb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697244498, "uuid": "30ecea9e-9b84-4f6d-8dca-4f3a1d4ce2f8", "comment": "Malware payload (Mirai)", "value": "e648659af84d3c537c69a2aae9b134f022df24f7ea97736a10dcad94580ae576", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697244498, "uuid": "bef4fea2-fff0-42ca-83bf-551f057a9c34", "comment": "Malware payload (Mirai)", "value": "8e62ba541c1c24f24748fe5aba0e4cc3fd1b81a9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697244498, "uuid": "c7dd9b5b-46ff-4009-9771-22e8def395d7", "comment": "Malware payload (Mirai)", "value": "90313217836d5be92a2ed435764e56646661dbc1a2517c22c5fe8d130c5a69701511ac6af9256646966248dc85e90af5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697244498, "uuid": "d4f5fde1-3dd6-4543-866f-e545b62d0fd8", "value": "T1DA535BD9B401DE7CF85BEEBE4016090AFA21635155A30F37A3ABFD93AC721984C63D49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697244498, "uuid": "2fcd54f0-a003-49d6-b234-c65739959278", "value": "1536:GAqryN7fQr0EswpAxxIQ1+wDaWBrsKMMNr8T:GAUpK78wmwMaQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697244498, "uuid": "3ddee45a-a157-432f-8904-03c0dcd3b0e5", "value": 62676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697244498, "uuid": "b1bb6677-3cf0-40cf-b555-6d1187eacc59", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697244498, "uuid": "cdd054d6-e054-4774-84a3-798de91c5d74", "value": "6bfc879333ce0cde2ff2a1cb36cb5adb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa4e42db-6a53-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1697261806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697261806, "uuid": "0295d47a-23ff-409b-86c7-b77459e5e530", "comment": "Malware payload (Mirai)", "value": "e2576745ac97c6463b89871557f6323c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697261806, "uuid": "7d0f7aee-252f-4611-9ca3-e601af873610", "comment": "Malware payload (Mirai)", "value": "ea9aef66a6b4412430c3668feec2d9d78368aabae3c662a79515703f4109a749", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697261806, "uuid": "6f65611d-a527-4a38-9207-a13b28e33762", "comment": "Malware payload (Mirai)", "value": "905c39fec00a3d429b15b29e5628f33b5416fd1f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697261806, "uuid": "155a16aa-1fc7-4e63-8781-e6620c182dfa", "comment": "Malware payload (Mirai)", "value": "fe6a54c5cee97cd7373e02134e62f4f1ad034c75f7604ce5b45891269a5d4e7d3f61d81b51ecb8d3a06055eb6028d8e2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697261806, "uuid": "ef82e906-b13b-4073-be19-c0e45c54551b", "value": "T1A3E34D56EA818E13C4D527BAB9AF01893332A75493DB730689185FB43FC6B6F0E77601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697261806, "uuid": "c6a7fdbc-1c79-46db-af4a-167ba5bbb25b", "value": "3072:MgxYi2gojQeTWKrsRdxcKfKw/LyCeAd27u+bn5mx611Xnu/IM/9UBqh:HxYi2gojvTWK4RcKR327u+bnEx8XnIIG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697261806, "uuid": "192cd155-8572-4b68-8932-15d106b306fa", "value": 156877, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697261806, "uuid": "ab8b9681-434d-48cd-b347-79fb3d9fb771", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697261806, "uuid": "188c3af8-aeca-4eb9-a57e-d6e066f107a2", "value": "e2576745ac97c6463b89871557f6323c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e2c2c05-6a94-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1697289596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697289596, "uuid": "e20ec6a0-e149-499f-8d60-ee2507b5e53e", "comment": "Malware payload (Smoke Loader)", "value": "a41219b2857b8851c4fedc6c9e0eb6e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697289596, "uuid": "054ab605-d6ba-4a07-9a56-24504dd9eaf8", "comment": "Malware payload (Smoke Loader)", "value": "eae3c7b4d941fc604d51599006ea15d3c256bea24c2360928961e8eb224ea000", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697289596, "uuid": "0a6b0a36-d1c9-4268-9605-841e6fefbfc0", "comment": "Malware payload (Smoke Loader)", "value": "e0f1f48eb7f053188cc18aae625409ee2a31d25d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697289596, "uuid": "c1e4a55b-7962-4bc5-8e83-58032f116ff6", "comment": "Malware payload (Smoke Loader)", "value": "a31425746d0b382a5b78b0dec584629355c43ff622e2ac21c0646f6139d4536e039e53969f049001902e6c776211c211", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697289596, "uuid": "38ab29c0-c262-4696-a330-933695acb5e6", "value": "T109552351BFE65472D8F8177089FB0BD3093B3DE21E74A2166B914F190DB2994A83633B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697289596, "uuid": "0684c10e-1abc-46bc-97a5-1bf293ad3300", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697289596, "uuid": "f8afbe7e-60f7-4e2e-a79f-1c3c886b710a", "value": "24576:xymLzeFHozx6W5Mr5emm2OiKscx6+EGLi+o2I6kJDIgByK:kmLaVozx6eCOiKPseLg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697289596, "uuid": "20a06484-be9b-43f7-b37b-cc25f3be8eae", "value": 1353728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697289596, "uuid": "a478e2c0-b600-466b-aadc-6e77870259bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697289596, "uuid": "e3e84e90-f4e7-443f-9ad1-de0d4b1fcb6e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f28cbb0d-6aa2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697295858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697295858, "uuid": "ffadb6ea-28a9-4be5-8417-1ca285d32ca1", "comment": "Malware payload (RedLineStealer)", "value": "83a2b0eaeb4260af630dd174b74d7d55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697295858, "uuid": "04da751e-a073-4250-a95a-8d844941167a", "comment": "Malware payload (RedLineStealer)", "value": "ebf9e00b97a0e562fcc1e3e14dc34fad7535cee3afc8b365206b7f9202bb35a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697295858, "uuid": "48db6427-d91a-45dc-9e51-093f746153dc", "comment": "Malware payload (RedLineStealer)", "value": "158726799da87684fa1f95ef4a7181130a37ddc8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697295858, "uuid": "8a0b579c-8c79-4c31-b992-b4f18cc2fbf2", "comment": "Malware payload (RedLineStealer)", "value": "f30a648694585381892ddfd3e2b02cfa584ec783f81ee62c03e82225255ae1cab7fb4283034c567e1b12a539a56d7797", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697295858, "uuid": "3f291c7a-5265-4552-9221-10c0513ccaab", "value": "T185759D61FD929375DCE610794EEDF43301AD94EC0B2ACEDF06D497FA89219C03A36989", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697295858, "uuid": "0a8f8918-9f36-4a99-9e11-c2b344d6a61a", "value": "e367cd2cd00d41816448f9c2b20f0e47", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697295858, "uuid": "18c3f04f-fca9-461e-9534-ecb6aad1db8f", "value": "24576:G9H8eCvcjeOq7QqhFFhvCKfkp1c8zOgR2L0:kCvcjeOq8q/WKMkEl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697295858, "uuid": "1b018508-80c1-4a33-8b8c-f1b3e565e5ba", "value": 1681408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697295858, "uuid": "65d29da9-4ae7-4cba-bcac-a867cd7cdf9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697295858, "uuid": "0f90cc8d-6c6a-4397-84c2-1985f16f2738", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d96d7b11-6ac8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1697312136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697312136, "uuid": "83863d47-7d48-4922-a9fe-183ffadd1558", "comment": "Malware payload", "value": "0ef27491000a33fca2c1c4da35a79f25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697312136, "uuid": "41c35d0a-8122-4ae2-9241-faefaecf25fe", "comment": "Malware payload", "value": "ed862f9b9cd6b1e574b1c64b13b41d744ed79ab6a04e36308e844b7aa413bda6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697312136, "uuid": "a99a217a-a3fa-46e8-b29b-d5199d24cf99", "comment": "Malware payload", "value": "5e3244c98206c1abab86ca53ced95871cc5f408f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697312136, "uuid": "53bdd5ad-e7cf-4800-8ddc-7ad620e1b8cf", "comment": "Malware payload", "value": "56feb093680154c14aeeb419990b9b66728bd5f1b5208566e8d4eb1143e7d61f06cac936c5ff71335b143c4a1dbc3ec7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697312136, "uuid": "932f617b-a650-4c93-9780-b504698b08a2", "value": "T16E152266B7D14132D9FA17700CFA02530B38BCA54D74C7B627D6BA8A1DF2594A93233B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697312136, "uuid": "625aa7ef-003a-48c9-b487-44ad92ea0348", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697312136, "uuid": "3bf5fb39-8768-49d2-be25-dcc36d184a8d", "value": "12288:TMr/y90W18/YcqhbXw+CWT/sBykUvje93rtW8i5MbQmuxnI5ph6DZcKwI1RQbyT:Ay7g3qB1T/yUQI8i5MUmenkpPKIyT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697312136, "uuid": "8f87f65a-d8c2-4a5d-afa7-978899618912", "value": 897024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697312136, "uuid": "16d35b41-c2b8-40e9-aee1-df02b71ec9c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697312136, "uuid": "68cc9ed6-6879-4da1-aae0-d6b6313156fa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a07400a9-6ae2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697323208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697323208, "uuid": "b7e2bf29-faa2-4199-bf66-457213e119bb", "comment": "Malware payload (RedLineStealer)", "value": "f225bf340e0737cec1f70c47950d489c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697323208, "uuid": "e960f2b6-2208-4830-bcb8-282527e1da4a", "comment": "Malware payload (RedLineStealer)", "value": "edbf49a5b7a06bffb4ec00d4f87bb1f42ccdb7316168356c45e65378b1c90a14", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697323208, "uuid": "8bcd8a10-a8f9-427f-88a7-13fdc08db64d", "comment": "Malware payload (RedLineStealer)", "value": "b725a8db017a07d904ed2b2278ddcb714093efdc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697323208, "uuid": "1c551183-cd0b-43dd-b7d5-52b396ffe1bf", "comment": "Malware payload (RedLineStealer)", "value": "7b097075adc489fe06a261219b5543ca7fb462416fed688e12e7719bb6280f06c772e16b255d24964dfb057ddfac03ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697323208, "uuid": "bdf28f08-7e7b-4556-ab74-1a69b5165f9c", "value": "T143E39E0175C084B2E973093335B0EAF14F7DFC740E505EAB63D45EBA4E24AD09969AAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697323208, "uuid": "3ff30342-091b-4312-9929-ab23aeaa0f4b", "value": "89b4938a013d6b8954f68c2ef1293c62", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697323208, "uuid": "26902461-1946-4162-96ca-b80497340aec", "value": "3072:EWtVJsU12HlWCnUewNzrQuUUpBt2973rC9Qmagv7pzeo+1RARDPoJ:NVJsICnU9Q8MU78H1K9PoJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697323208, "uuid": "d00920e8-bce7-4850-b587-8c1f3d5543be", "value": 151552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697323208, "uuid": "20104ee9-843d-4595-97f2-4931e01bdc60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697323208, "uuid": "7aa018b8-734a-49ee-9dcd-c574c7022b70", "value": "f225bf340e0737cec1f70c47950d489c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d48b8302-6ac1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkComet)", "timestamp": 1697309122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697309122, "uuid": "6422d570-fe7f-4c68-bcfd-4bb298ebe8f0", "comment": "Malware payload (DarkComet)", "value": "220fd88ed61a81dd7238c8385fc8c5f7", "object_relation": "md5", "Tag": [ { "name": "bugramchack", "colour": "#755A41", "exportable": true, "hide_tag": false }, { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "indir", "colour": "#6CD127", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "trojensiz", "colour": "#7FD4AD", "exportable": true, "hide_tag": false }, { "name": "troll", "colour": "#A0E7E0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697309122, "uuid": "eb3817fa-f8c7-421b-9339-6e3a5a145b5d", "comment": "Malware payload (DarkComet)", "value": "eddb245a5dc0d8f70ffb66c033cbaa38ea4639d900739c5580bc37d86f258816", "object_relation": "sha256", "Tag": [ { "name": "bugramchack", "colour": "#755A41", "exportable": true, "hide_tag": false }, { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "indir", "colour": "#6CD127", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "trojensiz", "colour": "#7FD4AD", "exportable": true, "hide_tag": false }, { "name": "troll", "colour": "#A0E7E0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697309122, "uuid": "45b0b0c9-7186-4f8c-b983-d66223e84045", "comment": "Malware payload (DarkComet)", "value": "b4c6ea98e705912f38816bd4aff085871b1bae80", "object_relation": "sha1", "Tag": [ { "name": "bugramchack", "colour": "#755A41", "exportable": true, "hide_tag": false }, { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "indir", "colour": "#6CD127", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "trojensiz", "colour": "#7FD4AD", "exportable": true, "hide_tag": false }, { "name": "troll", "colour": "#A0E7E0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697309122, "uuid": "f4c76c4c-3a1d-42d7-9ee1-582207b32e12", "comment": "Malware payload (DarkComet)", "value": "3587fc0674e0505cd0617e728152b67aa806e7027a4356431c2ebe2f2f811d1033daf79fc6b04f325a2b5840c0126fa9", "object_relation": "sha3-384", "Tag": [ { "name": "bugramchack", "colour": "#755A41", "exportable": true, "hide_tag": false }, { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "indir", "colour": "#6CD127", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "trojensiz", "colour": "#7FD4AD", "exportable": true, "hide_tag": false }, { "name": "troll", "colour": "#A0E7E0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697309122, "uuid": "1892cfa6-983a-4d4b-b193-fbcea9c8cd71", "value": "T18C74F10636C5D677E87A6B780560831057FEAE56E776C3CF7F9812992AB23C04F2131A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697309122, "uuid": "6707ce23-6b45-47db-8a9c-5911e3de4b1a", "value": "9222d372923baed7aa9dfa28449a94ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697309122, "uuid": "0baae437-94ea-405f-ad45-70a7b9e20e53", "value": "6144:hSncRldcNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37wxM:Q4jcW7KEZlPzCy37", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697309122, "uuid": "e86585a0-50ca-46f1-8137-13f1f3d5b057", "value": 358912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697309122, "uuid": "03ca15cf-d1a9-4da9-9bde-8ace33248db3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697309122, "uuid": "aaa099a0-fb64-43c2-8d24-c5443f58a49c", "value": "BUGRAMCHACK.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fde32e50-6abe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Healer)", "timestamp": 1697307903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697307903, "uuid": "2fea208b-846c-4334-8d40-02bd87ccea48", "comment": "Malware payload (Healer)", "value": "d18693c847c0a687ad43dbf77e7bbd86", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697307903, "uuid": "76ace6d9-bc04-46a6-8253-5615d1d78192", "comment": "Malware payload (Healer)", "value": "eed45d9e5d96aeb74fe1cc69021711612a369fda742046e59c00a9515de1e242", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697307903, "uuid": "11b2440e-c2b1-4ff7-b261-d0a4d81d7813", "comment": "Malware payload (Healer)", "value": "c9eee6ebcf13d30e314750739f3f6bea14c6d08c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697307903, "uuid": "87d524a6-e1d2-4b8a-b8fc-404188f1cb79", "comment": "Malware payload (Healer)", "value": "fc4ff9ad3116bd0259e704c31c0a9ced5690db5e7c807d7b9a2a8744af0a910568fdc4429077dca5ceb30c606508b46a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697307903, "uuid": "1a030a4c-4da6-4d9f-9ff9-39c8bb927a31", "value": "T1FC152346F7E98162DDBA2B706CF502C32771BD914A70832B6705A92E0CB3694E93533F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697307903, "uuid": "cd7cd00e-7ae4-4a37-bf09-65a9e8f9ce34", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697307903, "uuid": "18c8bd00-965e-454e-994d-91b924efc400", "value": "24576:3yEp8OtG2I1+mTXyvcEiOMc+jx0D8R/tEG:CEpC1+mrT/OT+jxXR/a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697307903, "uuid": "0d61e1d6-65df-4bf9-ab92-2cd0c2f9f258", "value": 897536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697307903, "uuid": "ced93db8-a51b-450f-9d95-76646e55269f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697307903, "uuid": "cd3ca629-83c1-450b-a06c-7dd6959de24a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c403272e-6a97-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697291055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697291055, "uuid": "4df9d5d0-d683-476a-8b64-b13af274287d", "comment": "Malware payload (RedLineStealer)", "value": "2e0d6dc5ebe6502816b4196f49fbcab1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697291055, "uuid": "97a248ae-cc89-44b7-aecd-a2237aa42f72", "comment": "Malware payload (RedLineStealer)", "value": "efbc1fb615da6198f4704fb2f3f98bb1e1b35258f8b5a7baea9ac35d129cdc9e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697291055, "uuid": "fd02f24e-e7f9-4fba-a57d-7e3157376e86", "comment": "Malware payload (RedLineStealer)", "value": "130c8d63bc2ff046880c7c442b45de7f5de0e9c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697291055, "uuid": "3d87eb1e-6f7f-47a9-a480-2043c66f2149", "comment": "Malware payload (RedLineStealer)", "value": "3e64d5433c419addcfb1cb14d74a7f1926d2ea728bbf7a70cce60f6dee6fb0d637dee34d19b456432ffcad5e14003af7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697291055, "uuid": "e3e760e3-df32-454a-a561-2d0beeb70858", "value": "T197552383AAC86573D5B9233065FB03D30E313DB15E7C639A2755980D1AA39D0AD347AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697291055, "uuid": "0197fb3f-2ba5-45d9-a8e0-34d1fd8fcf69", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697291055, "uuid": "a3c214a9-dd25-4a16-89ee-f83b3d58e438", "value": "24576:/yAPCLR8yve2YrJa8qT/DAqHBQ/dK63P1XOCPPCdIOMaVQz:Kl8yOa8XMBQr3ICHyVe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697291055, "uuid": "3dfc6bb4-4ee5-46de-9a59-0856aeb2e462", "value": 1353216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697291055, "uuid": "cdff2202-dfa8-4f2c-96f6-5e43d9762e0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697291055, "uuid": "8c51c108-7dd9-4a33-a899-8b36d702132b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d92194df-6a72-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697275199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697275199, "uuid": "26d7b159-9333-4aa5-a5a4-704d7f74aac2", "comment": "Malware payload (RedLineStealer)", "value": "3958e6fffe3e1554c284614e4dea2ed1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697275199, "uuid": "30adb562-6472-473e-8ee1-0d5c3871d521", "comment": "Malware payload (RedLineStealer)", "value": "efcefbc70ee5a9cabad473a99d6f031ef253b725b03db59a3822aaa35529ebf7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697275199, "uuid": "cd3d9f6b-34da-4f62-b022-9a25baf751b0", "comment": "Malware payload (RedLineStealer)", "value": "eb98be22dd07fda52bb0b38aa8e09d440fa53203", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697275199, "uuid": "e2da2128-584c-40da-ba11-407ddada3ccb", "comment": "Malware payload (RedLineStealer)", "value": "bcb5c84fdffbc9e07053a4ed99f9abedb9d3a3817f57331ec8fae16ed33242b3374e12c688222f22d3f993c3ad7a58ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697275199, "uuid": "35c3ff70-0242-4345-9984-a1bf3a55eba6", "value": "T1F7752366DFD58432E0A447706DFE03831F353DD19C7893932A85A8998DA2398A5F373B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697275199, "uuid": "34770e42-5b28-4f67-94dd-0644a8ba1225", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697275199, "uuid": "bd693f0c-e1b4-45d0-9577-6e23e0a9a538", "value": "49152:CBzYyvHK3DVNYxciyP69Zg4hxBraBVW+zlByOEn/9qKQ4L:gVvHKTVNliyPO/BraVBpANQ4L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697275199, "uuid": "a6b39cfe-ca29-4e4a-b1ae-ba19a95a27b3", "value": 1625088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697275199, "uuid": "749b259e-9ffb-4d35-a1d1-d39dc79e9b8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697275199, "uuid": "fd1ba0c3-e89f-4012-98eb-78e5566e8fcb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0859d71f-6aed-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697327677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697327677, "uuid": "cceb595a-4ca3-4172-877e-fe7a123925cd", "comment": "Malware payload", "value": "bdbfa4c9c9a72e85cd7aacbbb8a7a5b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697327677, "uuid": "8d776e7a-6ac2-46a7-b49f-dff954793952", "comment": "Malware payload", "value": "eff0ff1a9186ca9d78eeb78f24b97d2a7e558f57bae5f3e1de7b0a7283e78e37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697327677, "uuid": "616e1821-f8d6-48da-9f97-e3a8d954a11a", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697327677, "uuid": "0e448003-24d9-420d-ba02-d1564b9ff69b", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697327677, "uuid": "244ff522-58b5-48f4-8e33-6e50926e4e0b", "value": 6079776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697327677, "uuid": "9abf7d95-77fe-40ab-b65c-7b78a1fd9160", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697327677, "uuid": "76ea19aa-a18d-4bc0-9099-557fb458a0c8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bba0f06d-6a76-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697276868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697276868, "uuid": "da887bf7-f333-4b19-8690-41a674cc2c9c", "comment": "Malware payload (RedLineStealer)", "value": "754653f7481bf1e2eb6bf07751fd110a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697276868, "uuid": "2dc5b79d-f8f9-42c7-b361-438c2d499f12", "comment": "Malware payload (RedLineStealer)", "value": "f1d55857593053a6b18b087ea01a18dc406ee5bbbdfb2e856d17fcc4b59485a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697276868, "uuid": "e2eb16d6-772a-474b-909e-06093c3c5d33", "comment": "Malware payload (RedLineStealer)", "value": "139911a8f330215c1c20da2bc24f3b881a61c021", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697276868, "uuid": "722c10f3-581e-4943-845c-4caf028abfe5", "comment": "Malware payload (RedLineStealer)", "value": "6b4500454be45a73140f97d4eaed04959181f4ec9a3ecaf79648f2b6feac6d2b0900d2491c5b0e85718c4d155460e0fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697276868, "uuid": "cd77f36e-e11e-4d56-8d03-12a279aaed33", "value": "T17C752357DBE48873E7F4273049FA1383063A7C669C78A3673F81658A5C32A64D5B0B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697276868, "uuid": "a8660f88-0dbd-4c92-b46a-d37605e32500", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697276868, "uuid": "1409f335-5eab-4338-87fc-09be74458580", "value": "49152:0/xyZlXh/4zFmAZL7LZgshRDwadmbbDAtBUnDU:AxyBQQAZLZZDwaQbbDAtKnD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697276868, "uuid": "cd2ab485-f86c-4bab-85f1-adb8314db3ac", "value": 1626624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697276868, "uuid": "10a620da-8c63-423c-8903-fe697489e00e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697276868, "uuid": "7156f5df-6326-4a5a-8d21-98a79a3eeca8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17e8e9b2-6a96-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697290337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697290337, "uuid": "43702dc1-90df-4541-8b03-da1dfff12fcf", "comment": "Malware payload (RedLineStealer)", "value": "6ae23deb1cd68ad218163ef0fdfff7e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697290337, "uuid": "b2a41f58-7f21-4afd-a19e-7ec1bb97c2b0", "comment": "Malware payload (RedLineStealer)", "value": "f1d67ba52b75507b52e2b896eaae064f4be27227f27fe14aa09a40f0b1719635", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697290337, "uuid": "08ead91d-1901-4dca-a8b3-b42f721e72b8", "comment": "Malware payload (RedLineStealer)", "value": "e782b5d3a53715c75d536f0416e5d3a4987a8d94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697290337, "uuid": "63c7b984-bd12-4287-80be-4b81484edae5", "comment": "Malware payload (RedLineStealer)", "value": "2749c11abf8bc48bdc98ae822809f27c7b704b8ba3ac550cfc502bf65c3059d4fa6e076ef537dff4a64de055df67a8c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697290337, "uuid": "cfccde78-c368-4514-a1fe-5c3361698fbf", "value": "T1AE552312FAE85652C5F413B01EF613D31D2A7EF29E25436B6782994E0DF3AC0693172B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697290337, "uuid": "461fe8a8-a909-41ba-81fa-ae4c2411c7df", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697290337, "uuid": "127d6780-614c-4dc5-a4f7-cfd1c66e7583", "value": "24576:Ky+DkErnkeRGtUtuoEmcTdh0M3N10Eirk8QuhMXQGy07HpD4H:RIkyk4G48xr10EKnQuhMXl7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697290337, "uuid": "4004fd4d-1c82-437a-899d-4dd1292d45ac", "value": 1354240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697290337, "uuid": "b46c50bf-3e12-4de0-ae70-d60eee605a42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697290337, "uuid": "f5ce0dfe-1870-4699-b91d-cdb8bd84b081", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45788fba-6ad7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1697318331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697318331, "uuid": "c568ee46-6359-4978-bd01-22603f11ca6e", "comment": "Malware payload (RaccoonStealer)", "value": "7648e37f9931d9f8044080819c2b79fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697318331, "uuid": "d6682a11-4e2e-4108-b908-2e8b45d35ca0", "comment": "Malware payload (RaccoonStealer)", "value": "f22ee79b431b781be96eb31444ff322a9c4a32b0ed5f938af2cc8fbac7c1b1b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697318331, "uuid": "7b9ea6eb-0da7-4749-aca5-ad864783da99", "comment": "Malware payload (RaccoonStealer)", "value": "341100f9b256a7ec706d25e7032bcae5e1e6ff53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697318331, "uuid": "78f8b594-2516-41c8-8d46-34367b8806e2", "comment": "Malware payload (RaccoonStealer)", "value": "245959ed1cca12ad82d37a32a164e419aea91579d8412f313a3d84b5afba77f885e87af206b034f0f051a5e5503d2809", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697318331, "uuid": "7ff3aa7b-1d31-4cf5-825f-621fa66a945a", "value": "T10424D736F304952DE87E433DB41C38B09E307C52E16ED32E55EA7AED683BB499A144D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697318331, "uuid": "2eb56149-f012-4a6a-8e40-3a3d3c2b2a46", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697318331, "uuid": "68bbb2eb-6a1c-4e7f-8998-baa16bdf383d", "value": "6144:8ISVjTdNgcj7jwGXYEL0Fo/ibzkI0b37:AHdNgcjHu/Foe0b37", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697318331, "uuid": "5e4a439e-adbf-43b3-b4ad-48f25f9d8dd2", "value": 226816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697318331, "uuid": "92a0d1b1-3a59-41ac-86a3-85becfd63432", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697318331, "uuid": "f2b61dec-b72e-4a54-a184-b240e409fc03", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ab7f0f8-6ac5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697310743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697310743, "uuid": "96cd553f-4354-43cd-b4ae-e4ad2feb92dc", "comment": "Malware payload (RedLineStealer)", "value": "0260aa37b1af7cf86b6954ab85b6a2ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697310743, "uuid": "8db76382-4389-41af-a844-14280d9deb93", "comment": "Malware payload (RedLineStealer)", "value": "f24f6d3ed8d7443b1d0f1018dcfa99fa765705863a4a80317128a497150b0999", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697310743, "uuid": "3c80f02b-3b4b-4f8b-b2fb-e2391e2b1e08", "comment": "Malware payload (RedLineStealer)", "value": "ae8b3a64ac02d6458682591cd826f7304aeb79ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697310743, "uuid": "a35338e3-fb7c-451b-bae1-844810b56b32", "comment": "Malware payload (RedLineStealer)", "value": "532e1961757bb33195543b6ab14462f196ee704d99ee8160d27ed615da12fa33ac24908b6aeb6bd18396e1dde58af79c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697310743, "uuid": "45c4b817-edb0-42b7-95cc-9e63c6f05206", "value": "T18C15235266F88072E9B267742CF702C30B3ABCA06EB5939F27109A4E1D735C594B177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697310743, "uuid": "61887a7b-6c58-445d-9c30-4ba01e612602", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697310743, "uuid": "c7d2e974-055b-4a33-a481-ac80eca0219d", "value": "24576:+y1O4DW59VGUeB+n2GNsYsrfQxLCe/xqa:N1OKW5Nm+n2hzQdCf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697310743, "uuid": "067fa38f-0a96-47d1-a7ad-18cac57f5ca5", "value": 898560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697310743, "uuid": "6b1d19dd-0523-4e08-bf30-95ddd714f43a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697310743, "uuid": "027cfcc6-aba5-480f-a164-01f9f8b110ea", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dfcdfae-6a43-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697254726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697254726, "uuid": "f7aa02b1-8a55-4d33-89b8-1e6eb4cba984", "comment": "Malware payload (RedLineStealer)", "value": "88d7093ea7f6955cbbb00774d2e3072f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697254726, "uuid": "bc06f83d-bf17-46b3-a47f-4833ea93a504", "comment": "Malware payload (RedLineStealer)", "value": "f522b9b627666889f35157af8e1edc9078fce8ea3690c941f8a80528babba534", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697254726, "uuid": "27efc7ab-1ae8-4239-8764-3577cebf93ae", "comment": "Malware payload (RedLineStealer)", "value": "a8a815c2660511dae56c4c2bcb82e4a1cc866fae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697254726, "uuid": "d96d58ae-1296-4b4e-95c4-14fd0e125c8f", "comment": "Malware payload (RedLineStealer)", "value": "8cb23ff6e1230e6f9ef3bd4edbfae9b687dd98c7a13e2680ca102ff26d1d58380c2abd2c28eddaee792bfe6d7ef429db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697254726, "uuid": "97e922a8-695b-4911-a656-e93da14f4a59", "value": "T1E07523952BD98076EAF15B3468F707430F38BCA69E30832EAB45DC5B45B2BE051F0766", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697254726, "uuid": "b66814ed-185d-4d0a-98aa-2c15ba0eb3f1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697254726, "uuid": "7bcd6500-a7c4-4580-ba7c-c2c8ca146912", "value": "49152:OTV5cPAG48+21mFgZgnhtpqaJT/YLhCj0TR/LLGt7tw:eAAu1miipqa1gLhCMRDLGth", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697254726, "uuid": "0f60a382-1b00-4265-8820-1aa6d3747086", "value": 1625600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697254726, "uuid": "bde6a175-73c1-4359-a1c4-07961c631651", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697254726, "uuid": "de750551-6b68-4b42-bd0b-3f36bddfb566", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68a9b8fe-6a8a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697285318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697285318, "uuid": "1c5f41be-96f0-496d-b5d8-35708c935773", "comment": "Malware payload (RedLineStealer)", "value": "3842f0d495b369eefd79a852663eed11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697285318, "uuid": "3129fbd2-c7a4-46e9-8070-b0e1e6f97a28", "comment": "Malware payload (RedLineStealer)", "value": "f777b3ac9761709880db21aae1eaa2adece3d2240a20408edc5917f9e9205b52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697285318, "uuid": "ab180961-75cd-435a-8210-eefa7a3f128c", "comment": "Malware payload (RedLineStealer)", "value": "22c92a864744e1740cb249e529442fb406924982", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697285318, "uuid": "dfffa5fe-9e2e-47b9-9a54-0456b16821be", "comment": "Malware payload (RedLineStealer)", "value": "4f01accb5d7d50e3ad0f53ad370d50efb5ebd9025595efd4991b21dc5c7ebeced5e4ac482ea95c79d6b444df2da9601f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697285318, "uuid": "6bc4df1f-a89a-49bb-8156-ed67c770964d", "value": "T142346C26309074EDD043BE3378DD98B055AA6028FF1F2593F6AD0A4A5B2A7B54B39707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697285318, "uuid": "7d90a7f6-4d6f-4f7f-be54-e7d72e7d8622", "value": "7df1bdeeff2cf1f94a574bfd468d38f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697285318, "uuid": "914e1003-79e4-428d-8cc8-72249a6521b5", "value": "3072:487d9hnxoSU1hye0HzsNAebHmXOnlh//Fi3mt6f+Mu:4Gz5BM80DmXU/83c7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697285318, "uuid": "2e3c833d-f991-4569-8cb5-e5d1e4b0e6d7", "value": 230912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697285318, "uuid": "5c22256d-ec92-461d-b14c-6a9605b7049b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697285318, "uuid": "8f61461a-d512-4c3f-9042-9eb35793225d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7d04971-6a45-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1697255923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697255923, "uuid": "2f5144f7-a9e9-4dfd-8061-193a649846b8", "comment": "Malware payload (AgentTesla)", "value": "c3dc996cee4bba285c8905aaf8a3ce69", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697255923, "uuid": "2aca9ec5-a35b-44c4-a75c-3be66c0ec5d4", "comment": "Malware payload (AgentTesla)", "value": "f7b800601e3b238161684a6921827dbed9d3f285740028da7f59e42968fa96cc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697255923, "uuid": "aa0e76e6-520f-4759-9c1b-8701c143c5ca", "comment": "Malware payload (AgentTesla)", "value": "083a3a677df43b33a3443843e7db9177f90e08a5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697255923, "uuid": "9c27fef5-df0f-41ea-a66d-e21878068e9c", "comment": "Malware payload (AgentTesla)", "value": "23a97197481aa3d8387574d2008259d714cedf60accbf16fad6183b43f63788b68c18301d5091cb135a46ac0606dcc2a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697255923, "uuid": "2875159e-b241-43fc-829f-dc43d156c967", "value": "T19B35232C0CF809124161F1AEDFD8EA57B2808CD6664C9D9687C68F995A1393BF09FD3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697255923, "uuid": "f55e9b95-7a74-434c-b615-6058a667e6bd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697255923, "uuid": "3d6c52a6-83ba-4aae-9d39-337e3bdd93ed", "value": "12288:QFlGL+6YabEBONiZVjYI5W9K1sumHDqWTiegEgZntryc:ulP6Y3Vnsua3iJZTr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697255923, "uuid": "8067326d-52a8-422c-9156-281ab6d981e6", "value": 1125376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697255923, "uuid": "39967d2d-8a2d-4caa-a55d-672401688180", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697255923, "uuid": "ad6555c0-6564-4a0b-9458-4eed7402a8ff", "value": "c3dc996cee4bba285c8905aaf8a3ce69", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ee9ba0b-6a2f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697246272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697246272, "uuid": "61fc1174-f60e-4480-98c3-939d689f58df", "comment": "Malware payload (RedLineStealer)", "value": "07e8011dc4a1229c21db2ce102498958", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697246272, "uuid": "4574c2d5-fb76-48bf-b94b-6eca95c32943", "comment": "Malware payload (RedLineStealer)", "value": "f8c6e94de551ddc93041ee5970dba1c4d6ca765d03bd5c86f6a0860a5758c6fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697246272, "uuid": "53ad4a1d-135c-42bf-88f9-fc60824a38cb", "comment": "Malware payload (RedLineStealer)", "value": "d12a1ace69f67a141b0015b1899d374ab0d9b4b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697246272, "uuid": "b0354229-faed-42ec-9b4b-fd0c4eeb2ed8", "comment": "Malware payload (RedLineStealer)", "value": "221e8b9aa600a38dfe50cf469967a82005cf5f36a6078cb52d5d570f3cf9666b2dc737133ab758a033c68533d74ae1c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697246272, "uuid": "89939577-1440-4f0d-9a19-de72bf8bec7b", "value": "T12F753390BBED4433D8B897304AF90793073A7E96AD2903F65B41E1268DB3690957237F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697246272, "uuid": "f9c35b93-a2c1-42e2-a118-32b7f913ab04", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697246272, "uuid": "749f7a30-4cad-40f8-a88a-053cb828d0ef", "value": "49152:05Jj0Mdv0CU9DzViu7ZgTh7WSawDv/+9rHZ4/Y:gj0W8C0VisEWSaU2rHi/Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697246272, "uuid": "282efc2f-4db4-43a4-9523-5c62eedd79bd", "value": 1624576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697246272, "uuid": "f33ff21e-6678-4ff9-a1c5-9e8095045aee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697246272, "uuid": "ed43914f-5bf6-4d23-8b8c-9e5551fa19dc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "890e1440-6aa2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1697295681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697295681, "uuid": "bca7bbd7-65d8-4c5a-8710-cbed0be4edc5", "comment": "Malware payload (Mirai)", "value": "0177eca7f1875403bab58ac21d4e0273", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697295681, "uuid": "67c4ae0d-d74b-48eb-8550-5092d612aa03", "comment": "Malware payload (Mirai)", "value": "f9c355ee6b3baa1fa4bc15f89ba23bd8d5fd84bdee5cbf063c4c0eb78fd5dfc5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697295681, "uuid": "a1a9284a-6797-41f1-81e1-945dc6be3186", "comment": "Malware payload (Mirai)", "value": "696221ee67ecbb97981771f691badc601f4e8d12", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697295681, "uuid": "dab7efe4-5098-4413-a3ed-f5f10b7e5bcb", "comment": "Malware payload (Mirai)", "value": "4ef26ff2d6fb2ec7b49f2b151f799177c857d2a00ae04aaba973cbac872ce5834eb2788c25a07cab376d58c7d8464f94", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697295681, "uuid": "94a2a9b4-fe49-475a-b077-9b9ac17b9432", "value": "T105730982BC40A62AC7C0177BEE6F108E3310A7DDD1DA3246DC155BA47A8AD1F4D77B86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697295681, "uuid": "58c2cf4e-c951-4035-817b-555fce96f408", "value": "1536:mAuFbM7Sfgy6BKDsVdWRNmkiQ5YeM0rPay7B8t461r4g4/Ted0:YF8Sfwh6Oc7PV84GriTz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697295681, "uuid": "3603503d-55c3-4bd9-9f66-3dfeb1dc625f", "value": 74984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697295681, "uuid": "95927976-c239-40ba-9451-1507ae6e956a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697295681, "uuid": "8b69cd30-de8d-4a84-b251-168b8f44a941", "value": "0177eca7f1875403bab58ac21d4e0273", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bea129d0-6acf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Healer)", "timestamp": 1697315098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697315098, "uuid": "46f02a37-e280-4b44-9ec3-6fb7f9f01d7e", "comment": "Malware payload (Healer)", "value": "5cf30590c99aa762134358dc148a27e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697315098, "uuid": "da83efb2-fb77-4ae1-9e5c-e664d5643124", "comment": "Malware payload (Healer)", "value": "f9d38578548860b25034aff69de426e59020162ab64834d5c8899353021c57ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697315098, "uuid": "401722e7-f920-4904-b0fb-407b6828d0ec", "comment": "Malware payload (Healer)", "value": "627a0b97c6c2964ac518879412c2773efc191da7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697315098, "uuid": "b5a7db9e-7b3c-4913-9608-f65445501f9f", "comment": "Malware payload (Healer)", "value": "75c6806614111e7d51ee16102d436704a9194118ef9d69a65a2400f4ff668b909b35d197f290fd5b31d1ece0e5415373", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697315098, "uuid": "132e8c3e-e0b2-4f27-8f14-bc42ac4cab9c", "value": "T1B6151216AAD86073EC7027B094F983D35B76BD824D34836F2755742A09B1AC4ACBA377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697315098, "uuid": "e2e357b0-691d-448b-8076-0c766fbbd590", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697315098, "uuid": "9b058907-40cf-4521-b822-290b7eda0150", "value": "24576:xyzeIH1htQ79fKIFTycY6wlt608PheVQZxN:kzeShg9fK2nwewK7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697315098, "uuid": "37cbac4c-307a-40d8-af6e-6799c4426898", "value": 898560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697315098, "uuid": "731f6e52-8074-4afb-9290-a2aca8869ebe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697315098, "uuid": "a9d57856-e41a-4a11-bfb2-558a681f32d2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4de18e73-6a2b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1697244471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697244471, "uuid": "061083f1-3eda-4fd4-ba3e-1ad32afafedd", "comment": "Malware payload (Mirai)", "value": "f1a5e9e21d0069ee65f91ea67757dade", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697244471, "uuid": "44f3aa43-6bdd-4fc5-afe3-662e5915071b", "comment": "Malware payload (Mirai)", "value": "fb6d51dcdddfb578e27e872caafb5e9f6f9858e57b8466d00814e84a52fcecb9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697244471, "uuid": "1524998c-ed2f-479c-a4f8-72151149b9f9", "comment": "Malware payload (Mirai)", "value": "fbda3c9860fa989ab9e289c1c964356d94d271be", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697244471, "uuid": "c479e902-2e7a-4699-837e-9bf29510a8fe", "comment": "Malware payload (Mirai)", "value": "94ce788ed2cbc6f7b9a25fee198fc5e063a734594dcf547ddacf42a3b1dd68bf33d0e7fb9fa1fc4094a7fb28d4ea84f1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697244471, "uuid": "2fc43767-d204-42b1-b7c5-306b21c3457f", "value": "T15FE2D0C16632A172C7744833DE198985109F5DFC9279B0BA79868B0CF7D2C696DEDCC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697244471, "uuid": "be51d4cf-f1a1-43b6-abca-3f70f33835ce", "value": "768:ozmPOPTv9qq2iuW6e9mqaRs/kqQkgwUREu4o9q3UELj1:ozm6tnuDAQFENLp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697244471, "uuid": "a8ecd285-22fc-49fa-928e-ed29ef1be5dc", "value": 32476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697244471, "uuid": "f9f6e699-eeff-4e07-aa5b-19ec477d4393", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697244471, "uuid": "dce05a57-c87a-460c-b85b-ea422aaac13a", "value": "f1a5e9e21d0069ee65f91ea67757dade", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "112827db-6a5a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1697264556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697264556, "uuid": "ed2f06e9-a985-41a5-8523-47af55edff83", "comment": "Malware payload (Mirai)", "value": "b19c31922cb1531a3965615fc5e6f9f1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697264556, "uuid": "f7925b96-a927-4ecc-8043-f2446d0de067", "comment": "Malware payload (Mirai)", "value": "fbc547e0d95c9cc2786f225a72148ca03df43277d412ba1f49014930e3f7b82f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697264556, "uuid": "52317fe3-d971-4f8c-bff8-a2540e51c319", "comment": "Malware payload (Mirai)", "value": "5e9a1f1eafa6558993fc9c53f9bc9263f21836f6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697264556, "uuid": "ac5dd44e-cb67-4d2f-9040-a20c6a63732f", "comment": "Malware payload (Mirai)", "value": "09955935b1efb8cb7af6fea7950fcffd9799ab24e66cbc6cb996cbaaa1e20d0d5f78cb9488ac959bd658e8225c2a38f7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697264556, "uuid": "396c8217-ab92-4972-89f9-9b41137aa504", "value": "T1AF734B4371280A47D5920AB4253F5BE083FFF99034E4BA88695FEB5A8635E771086FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697264556, "uuid": "a9918835-dd06-412a-bccf-db56ca80f81d", "value": "1536:9ldfVco/Crhj11ss+Fvd6AeyQx1DSzpI/fS:zghKFvl+0pIi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697264556, "uuid": "c0de144c-6f7b-403f-baf8-f5233fda36bd", "value": 77064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697264556, "uuid": "ca63dee6-3023-44ff-bf8f-f94a23497e89", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697264556, "uuid": "63313a0d-57de-44fa-9056-6d375021cf6a", "value": "b19c31922cb1531a3965615fc5e6f9f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd387a2f-6aaa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1697299204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697299204, "uuid": "96bf077b-a329-4f0e-911c-7a87293d24be", "comment": "Malware payload (Mirai)", "value": "90d623678ace7527a82daa515fef36ae", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697299204, "uuid": "ff3fbfcd-bd4a-4887-b742-69cccfa212a9", "comment": "Malware payload (Mirai)", "value": "fe857af6c5a003d9db0bd494505076bdd9a0eac156ed0f2178ba7f693423f1f5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697299204, "uuid": "879b70c6-feeb-4989-bb20-57a3dc1c62ab", "comment": "Malware payload (Mirai)", "value": "0206f839c5eab2755e8d76adb9b1cacdf5105dbb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697299204, "uuid": "236db012-fed0-44ad-af9a-19fbf3e13853", "comment": "Malware payload (Mirai)", "value": "4c3816a75af927bfe4792cb66ad0332a240e1de232e2699b4eecf827dc4256c5b6f01adee690c3508ad60b789baa0e55", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697299204, "uuid": "5f2165c9-c420-48ad-9b81-9b12eef0ebb0", "value": "T128E2E1AF75A42DF6DE8D8C3E128C057ABBD628970368DB85276144C4A62E4ACF4DC07C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697299204, "uuid": "9035f87e-e240-4b1f-8822-7f529bdbc28a", "value": "384:W83fpCLrsjHIX69URc+hmnulY1qHprFKt6zhS45vDajssVwfpjb56a3dRWGVCz00:WsfpWcehzJFYKgULAssKfpn56a3rWD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697299204, "uuid": "5a97291b-0ba5-47d5-97a5-a23fcc91352e", "value": 31960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697299204, "uuid": "a9043b8b-90ee-47b1-8fcc-62503aad0ca0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697299204, "uuid": "0566e204-5d5c-4736-9ad3-c3658e4c4b85", "value": "xd.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce209e2f-6a58-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697264014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697264014, "uuid": "c45180fb-ee5c-4ba7-bef9-594166293dec", "comment": "Malware payload (RedLineStealer)", "value": "45c89e6afa9ed5cd08ff925eebd0c99e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697264014, "uuid": "54e33476-8113-4388-b84a-35a3288c9d1d", "comment": "Malware payload (RedLineStealer)", "value": "ff0c114c48cf142e42beecc998077c4b42cfa02e5abe6f6d15ca26c9a4ad3abd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697264014, "uuid": "8b7b9ade-1c54-4aa0-a0a1-764fc2572882", "comment": "Malware payload (RedLineStealer)", "value": "f91248ca1378341665efc8053889d69003fcaff9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697264014, "uuid": "df40e39a-3de5-4b43-9f4a-ac67130a9b9e", "comment": "Malware payload (RedLineStealer)", "value": "d956e8769c891f0d7b398b44d354f3c2bf7036b8c36b737d730b5b5c1a0a72833f14e9e856cf481d4bcf04ace64dafea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697264014, "uuid": "75f495da-f31c-46f9-951f-09d3b86abb80", "value": "T1FB7523769ADA843AEA79B7311CF706030B3E7D659C60877F7F81A80E09B1E5441B1727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697264014, "uuid": "0a23c401-4211-49ca-b936-885cd796596b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697264014, "uuid": "cb345733-5241-4bb5-bd8e-183dd10ed2b6", "value": "49152:5MZ+jZi8BM3FhpsO/a2JzALZg8hM+9aWT67XIYCFXIKpJ4A/hby:2qZi8BGFTsH2Jqo+9akcCFPpJ4/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697264014, "uuid": "bab4d1a2-9634-4d9f-8f12-985dcb17a53c", "value": 1624576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697264014, "uuid": "ec35363f-2d95-4ec1-8f26-33f2f25ba731", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697264014, "uuid": "dddd9b64-6bb8-4960-b1e7-5f240afc8bbe", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca2e3059-6a5e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1697266584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697266584, "uuid": "a287a604-16f3-437c-adbf-b8cd4b87d04f", "comment": "Malware payload (Amadey)", "value": "6bfb9b7b4cc3e36c08312a334c226017", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697266584, "uuid": "0575899c-13b5-4fdf-b813-9267a6b19ddb", "comment": "Malware payload (Amadey)", "value": "ffa4b8fc315c5f3bba65e8a3fa6de67ce096ab1f00a334d7af964702525617bc", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697266584, "uuid": "c086f4ac-57bf-418d-89e0-f056e48fc31b", "comment": "Malware payload (Amadey)", "value": "bb0f4094e63a7059eec39734f14b1aadc5636f87", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697266584, "uuid": "f43f3e85-318d-4ffa-b776-69febbf8aa94", "comment": "Malware payload (Amadey)", "value": "768707383f44c91921eac71854ae3fc199854cf643819804cfce0c50a22bc595e39818dadd6680da5a8552254cc0fdd1", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697266584, "uuid": "fbee825a-a669-45e4-85cc-08052e69c887", "value": "T1B8752355E7E48873E5E6573008FA13A31F357EA64CB492B22B41F44A48B23D492F1B7E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697266584, "uuid": "0750489c-2e59-4fd5-ba1e-252d5c43778f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697266584, "uuid": "021bc0e7-0968-4a81-826e-f04c79954014", "value": "49152:TiBShf6wldKnKlQv3jRLoZQ9ZgghgFpaz1lHQmsgWy/wF0b:GCMnKojRLoZoIFpa3HQm/c0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697266584, "uuid": "d841dcac-54d7-4a41-a7d4-c7fbbdd1dca8", "value": 1625088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697266584, "uuid": "d87718fb-b349-4877-b0dd-a3cee5ee0f6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697266584, "uuid": "cc2cf486-cb26-49f2-b058-4f5574055a5a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }